# Suricata Antiphishing rules # Created by github.com/julioliraup/Antiphishing # Last updated: 2026-09-16 13:20:18 GMT-0300 # SID range: 6000000-6100000 # alert dns $HOME_NET any -> any any (msg:"AT DNS query to suspicious domain - Phishing"; dns.query; dataset:isset,phishing_domains,type string,load phishing.lst; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000000; classtype:social-engineering; sid:6000000; rev:1; metadata: signature_severity Major, created_et 2025_02_19;) alert tls $HOME_NET any -> any any (msg:"AT TLS SNI to suspicious domain - Phishing"; tls.sni; dataset:isset,phishing_domains,type string,load phishing.lst; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000001; classtype:social-engineering; sid:6000001; rev:1; metadata: signature_severity Major, created_et 2025_02_19;) alert ip $HOME_NET any -> any any (msg:"AT IP dataset - Phishing"; ip.dst; dataset:isset,phishing_ips,type ipv4,load phishing_ips.lst; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000002; classtype:social-engineering; sid:6000002; rev:1; metadata: signature_severity Major, created_et 2026_08_14;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .settlementdomain .com/5DLFML8/S5T8TN8/?__rpt=0&__po=17304&__ptid=6f70f5681ff84ca09100279f32029176&__rpa=1&__rc=1&sub1=&sub2=&sub3=&sub4=&sub5=&source_id=&__pcd=9)"; flow:established,to_server; http.uri; content:"/5DLFML8/S5T8TN8/?__rpt=0&__po=17304&__ptid=6f70f5681ff84ca09100279f32029176&__rpa=1&__rc=1&sub1=&sub2=&sub3=&sub4=&sub5=&source_id=&__pcd=9"; startswith; fast_pattern; http.host; content:"www.settlementdomain.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000003; classtype:social-engineering; sid:6000003; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro .932890po-20d9 .shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.932890po-20d9.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000004; classtype:social-engineering; sid:6000004; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro .9723781284750 .click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.9723781284750.click"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000005; classtype:social-engineering; sid:6000005; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (center-1 .com/mmjfhy/)"; flow:established,to_server; http.uri; content:"/mmjfhy/"; startswith; fast_pattern; http.host; content:"center-1.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000006; classtype:social-engineering; sid:6000006; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (43 .159 .37 .67/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts .google .com%2F%3F&%3Bifkv=ASKXGp3Pk-F4ZNULN9DP1cVGMMnDGEmPgcEXaKaRWszoUzsn6CSeViyYmRxRIQEEZUcV1AQdIba45Q&%3Bpassive=1209600&%3Bxrealip=35 .203 .245 .116&continue=https%3A%2F%2Faccounts .google .com%2F%3F&xrealip=138 .197 .91 .206&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2Pavm93o1UCT-KBGKoZSASEiIKws31Jm9ano7cwhTZXgQLrg4eeH2FBT3jsqN0xIzS9kn5mGU&dsh=S185019762%3A1778382235249673)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts.google.com%2F%3F&%3Bifkv=ASKXGp3Pk-F4ZNULN9DP1cVGMMnDGEmPgcEXaKaRWszoUzsn6CSeViyYmRxRIQEEZUcV1AQdIba45Q&%3Bpassive=1209600&%3Bxrealip=35.203.245.116&continue=https%3A%2F%2Faccounts.google.com%2F%3F&xrealip=138.197.91.206&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2Pavm93o1UCT-KBGKoZSASEiIKws31Jm9ano7cwhTZXgQLrg4eeH2FBT3jsqN0xIzS9kn5mGU&dsh=S185019762%3A1778382235249673"; startswith; fast_pattern; http.host; content:"43.159.37.67"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000007; classtype:social-engineering; sid:6000007; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (43 .156 .0 .130/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts .google .com%2F&%3Bifkv=AaSxoQyQEeCdGiNQploah5nAij7vrMqrlVIHby1Q4v_ARx9kttGkmffM4ARVCnkvjXQyGpUqW4kQNA&%3Bpassive=1209600&continue=https%3A%2F%2Faccounts .google .com%2F&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2PatJe8CuUZFInjCIsMMyB_S5WIcHcV9_Ey3zgariI7prCGZUZVfP7wWF1q-cB7Syky4URhMs0w&dsh=S356223092%3A1778382971411969)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts.google.com%2F&%3Bifkv=AaSxoQyQEeCdGiNQploah5nAij7vrMqrlVIHby1Q4v_ARx9kttGkmffM4ARVCnkvjXQyGpUqW4kQNA&%3Bpassive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2PatJe8CuUZFInjCIsMMyB_S5WIcHcV9_Ey3zgariI7prCGZUZVfP7wWF1q-cB7Syky4URhMs0w&dsh=S356223092%3A1778382971411969"; startswith; fast_pattern; http.host; content:"43.156.0.130"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000008; classtype:social-engineering; sid:6000008; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ul60ezvizj2 .wixsite .com/my-site-1)"; flow:established,to_server; http.uri; content:"/my-site-1"; startswith; fast_pattern; http.host; content:"ul60ezvizj2.wixsite.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000009; classtype:social-engineering; sid:6000009; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (43 .156 .7 .24/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts .google .com%2F%3F&%3Bifkv=AQMjQ7R3RU9uRsKgwPva2FtOUIg2u42Jvh6lxZEImmqrg78zMB78lA2h8R0plQ3O7gHZcj5aMizPlw&%3Bpassive=1209600&%3Bxrealip=107 .178 .200 .220&continue=https%3A%2F%2Faccounts .google .com%2F%3F&xrealip=138 .197 .91 .206&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2Pavj4_djjqeQGj0s7jDhdE43N6ksOmNAoM11zlKXHEHoKUpLyu_4qrZTxdQ2dv5VyhgFE3mgjQ&dsh=S-567168735%3A1778382722976118)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts.google.com%2F%3F&%3Bifkv=AQMjQ7R3RU9uRsKgwPva2FtOUIg2u42Jvh6lxZEImmqrg78zMB78lA2h8R0plQ3O7gHZcj5aMizPlw&%3Bpassive=1209600&%3Bxrealip=107.178.200.220&continue=https%3A%2F%2Faccounts.google.com%2F%3F&xrealip=138.197.91.206&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2Pavj4_djjqeQGj0s7jDhdE43N6ksOmNAoM11zlKXHEHoKUpLyu_4qrZTxdQ2dv5VyhgFE3mgjQ&dsh=S-567168735%3A1778382722976118"; startswith; fast_pattern; http.host; content:"43.156.7.24"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000010; classtype:social-engineering; sid:6000010; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro .po823902-12 .lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.po823902-12.lat"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000011; classtype:social-engineering; sid:6000011; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (43 .156 .0 .130/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts .google .com%2F&%3Bifkv=AaSxoQyQ_ZSuXpSvue0UfKrOXnU6mQAuN0RcLmvWGTqSCzhKlOsPyDT7wQQH6ra2Rhdw1PE87iTB&%3Bpassive=1209600&continue=https%3A%2F%2Faccounts .google .com%2F&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2PascutWXoup5bw52pd_4EGvh3-Yme6QV5nxP4snN-QobXseYgih9mxtRFDsT25d0hObT3ty-4A&dsh=S1528442115%3A1778382985730338)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts.google.com%2F&%3Bifkv=AaSxoQyQ_ZSuXpSvue0UfKrOXnU6mQAuN0RcLmvWGTqSCzhKlOsPyDT7wQQH6ra2Rhdw1PE87iTB&%3Bpassive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2PascutWXoup5bw52pd_4EGvh3-Yme6QV5nxP4snN-QobXseYgih9mxtRFDsT25d0hObT3ty-4A&dsh=S1528442115%3A1778382985730338"; startswith; fast_pattern; http.host; content:"43.156.0.130"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000012; classtype:social-engineering; sid:6000012; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (microsoft761login .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"microsoft761login.weebly.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000013; classtype:social-engineering; sid:6000013; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (43 .159 .37 .67/v3/signin/identifier?amp%3Bcontinue=https%3A%2F%2Faccounts .google .com%2F%3F&%3Bfollowup=https%3A%2F%2Faccounts .google .com%2F%3F&%3Bxrealip=107 .178 .237 .10&dsh=S252333957%3A1778382830062800&passive=1209600&xrealip=138 .197 .91 .206&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2PatfoUApcCMx3elfFp9nIfgpvx69SGo8I1fN-DsEoy34AGTqdauDaOZSpUFOUj53nRoCv-bMXA)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?amp%3Bcontinue=https%3A%2F%2Faccounts.google.com%2F%3F&%3Bfollowup=https%3A%2F%2Faccounts.google.com%2F%3F&%3Bxrealip=107.178.237.10&dsh=S252333957%3A1778382830062800&passive=1209600&xrealip=138.197.91.206&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2PatfoUApcCMx3elfFp9nIfgpvx69SGo8I1fN-DsEoy34AGTqdauDaOZSpUFOUj53nRoCv-bMXA"; startswith; fast_pattern; http.host; content:"43.159.37.67"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000014; classtype:social-engineering; sid:6000014; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (43 .159 .37 .67/v3/signin/identifier?amp%3Bcontinue=https%3A%2F%2Faccounts .google .com%2F%3F&%3Bfollowup=https%3A%2F%2Faccounts .google .com%2F%3F&%3Bxrealip=35 .203 .245 .179&dsh=S-1943207600%3A1778381078527604&passive=1209600&xrealip=138 .197 .91 .206&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2Pavof7v66M-Tk6taNn-kCPJiPXAgnY-WBuxIlUz9GLnmxIuVBVKGOJ66rZkUsno-P9hWp-oH2g)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?amp%3Bcontinue=https%3A%2F%2Faccounts.google.com%2F%3F&%3Bfollowup=https%3A%2F%2Faccounts.google.com%2F%3F&%3Bxrealip=35.203.245.179&dsh=S-1943207600%3A1778381078527604&passive=1209600&xrealip=138.197.91.206&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2Pavof7v66M-Tk6taNn-kCPJiPXAgnY-WBuxIlUz9GLnmxIuVBVKGOJ66rZkUsno-P9hWp-oH2g"; startswith; fast_pattern; http.host; content:"43.159.37.67"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000015; classtype:social-engineering; sid:6000015; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crejizo .auction/lxR2jtTWdKz92f!YltbA/)"; flow:established,to_server; http.uri; content:"/lxR2jtTWdKz92f!YltbA/"; startswith; fast_pattern; http.host; content:"crejizo.auction"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000016; classtype:social-engineering; sid:6000016; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mystical-garden .com/verify-update/)"; flow:established,to_server; http.uri; content:"/verify-update/"; startswith; fast_pattern; http.host; content:"mystical-garden.com"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000017; classtype:social-engineering; sid:6000017; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (recaptcha .cloud/?template=cpg&server=198 .251 .89 .144&ip=138 .197 .91 .206&http=&host=swiftsecurebnk .com&real_ip=&proto=&url=/home/)"; flow:established,to_server; http.uri; content:"/?template=cpg&server=198.251.89.144&ip=138.197.91.206&http=&host=swiftsecurebnk.com&real_ip=&proto=&url=/home/"; startswith; fast_pattern; http.host; content:"recaptcha.cloud"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000018; classtype:social-engineering; sid:6000018; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gfgfgvfvdesigloginjfhfh .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gfgfgvfvdesigloginjfhfh.weebly.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000019; classtype:social-engineering; sid:6000019; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .fgxscvx .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fgxscvx.weebly.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000020; classtype:social-engineering; sid:6000020; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-wallet-ledger-live-login-cd-five .vercel .app/ledger%20form/verify .html)"; flow:established,to_server; http.uri; content:"/ledger%20form/verify.html"; startswith; fast_pattern; http.host; content:"support-wallet-ledger-live-login-cd-five.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000021; classtype:social-engineering; sid:6000021; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nnewsdana-lyanindonx .safaather .biz .id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nnewsdana-lyanindonx.safaather.biz.id"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000022; classtype:social-engineering; sid:6000022; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rilvax-biz-kantor-1425 .pages .dev/form_submit_appeal/)"; flow:established,to_server; http.uri; content:"/form_submit_appeal/"; startswith; fast_pattern; http.host; content:"rilvax-biz-kantor-1425.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000023; classtype:social-engineering; sid:6000023; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreibwsnxxk4m4ekdloenmjbzyt2r6hj4hkkyt6qh2x4bvsjj4pbmlpe .ipfs .dweb .link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreibwsnxxk4m4ekdloenmjbzyt2r6hj4hkkyt6qh2x4bvsjj4pbmlpe.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000024; classtype:social-engineering; sid:6000024; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tiktokshop101ng-sketch .github .io/tok)"; flow:established,to_server; http.uri; content:"/tok"; startswith; fast_pattern; http.host; content:"tiktokshop101ng-sketch.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000025; classtype:social-engineering; sid:6000025; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f .digitalmaillane .com/igit/4/1e7swd5Wr719y6p0gaW5hrWbfpt80aW4dfWbc4Wn0WgW9)"; flow:established,to_server; http.uri; content:"/igit/4/1e7swd5Wr719y6p0gaW5hrWbfpt80aW4dfWbc4Wn0WgW9"; startswith; fast_pattern; http.host; content:"f.digitalmaillane.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000026; classtype:social-engineering; sid:6000026; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (assistgrowth-aidpush-q2z4u6 .pages .dev/business .html/)"; flow:established,to_server; http.uri; content:"/business.html/"; startswith; fast_pattern; http.host; content:"assistgrowth-aidpush-q2z4u6.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000027; classtype:social-engineering; sid:6000027; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sreedevz .github .io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"sreedevz.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000028; classtype:social-engineering; sid:6000028; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .help-ledger-live-loginwallet-suppor .vercel .app/ledger%20form/verify .html)"; flow:established,to_server; http.uri; content:"/ledger%20form/verify.html"; startswith; fast_pattern; http.host; content:"www.help-ledger-live-loginwallet-suppor.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000029; classtype:social-engineering; sid:6000029; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sammyjay239 .github .io/AIRBNB-PROJECT/otherhtmlpages/beach .html)"; flow:established,to_server; http.uri; content:"/AIRBNB-PROJECT/otherhtmlpages/beach.html"; startswith; fast_pattern; http.host; content:"sammyjay239.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000030; classtype:social-engineering; sid:6000030; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (identifiez-vous9910 .godaddysites .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"identifiez-vous9910.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000031; classtype:social-engineering; sid:6000031; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro .oef10943920 .shop/lokalnie/?id=3Q8k0x8h9E6P3y0I5u0Y8l4f7M3B5E5Y)"; flow:established,to_server; http.uri; content:"/lokalnie/?id=3Q8k0x8h9E6P3y0I5u0Y8l4f7M3B5E5Y"; startswith; fast_pattern; http.host; content:"allegro.oef10943920.shop"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000032; classtype:social-engineering; sid:6000032; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-billing .bussines-partner-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-billing.bussines-partner-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000033; classtype:social-engineering; sid:6000033; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customer-sp-brantison1 .pages .dev/help/contact/326334055910889)"; flow:established,to_server; http.uri; content:"/help/contact/326334055910889"; startswith; fast_pattern; http.host; content:"customer-sp-brantison1.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000034; classtype:social-engineering; sid:6000034; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .robiox .com .py/users/146417613437/profile)"; flow:established,to_server; http.uri; content:"/users/146417613437/profile"; startswith; fast_pattern; http.host; content:"www.robiox.com.py"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000035; classtype:social-engineering; sid:6000035; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mike7418 .github .io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"mike7418.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000036; classtype:social-engineering; sid:6000036; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aicc108-demo .pages .dev/title/80104198 .html)"; flow:established,to_server; http.uri; content:"/title/80104198.html"; startswith; fast_pattern; http.host; content:"aicc108-demo.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000037; classtype:social-engineering; sid:6000037; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aicc108-demo .pages .dev/title/80035684 .html)"; flow:established,to_server; http.uri; content:"/title/80035684.html"; startswith; fast_pattern; http.host; content:"aicc108-demo.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000038; classtype:social-engineering; sid:6000038; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wallet-landing-near .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wallet-landing-near.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000039; classtype:social-engineering; sid:6000039; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paololuck .github .io/appleofficial)"; flow:established,to_server; http.uri; content:"/appleofficial"; startswith; fast_pattern; http.host; content:"paololuck.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000040; classtype:social-engineering; sid:6000040; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (microsoftspain .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"microsoftspain.weebly.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000041; classtype:social-engineering; sid:6000041; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pkcu .pages .dev/appeal_case_ID/)"; flow:established,to_server; http.uri; content:"/appeal_case_ID/"; startswith; fast_pattern; http.host; content:"pkcu.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000042; classtype:social-engineering; sid:6000042; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aicc108-demo .pages .dev/www .netflix .com/cl/login .html)"; flow:established,to_server; http.uri; content:"/www.netflix.com/cl/login.html"; startswith; fast_pattern; http.host; content:"aicc108-demo.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000043; classtype:social-engineering; sid:6000043; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s3 .dualstack .us-east-1 .amazonaws .com/rtsrtgfsgvhgvjhsd5211gvvxtcj .069 .udjhss .jnxjnnjn/index .html)"; flow:established,to_server; http.uri; content:"/rtsrtgfsgvhgvjhsd5211gvvxtcj.069.udjhss.jnxjnnjn/index.html"; startswith; fast_pattern; http.host; content:"s3.dualstack.us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000044; classtype:social-engineering; sid:6000044; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abdullah23890 .github .io/E-commerce-frontend/)"; flow:established,to_server; http.uri; content:"/E-commerce-frontend/"; startswith; fast_pattern; http.host; content:"abdullah23890.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000045; classtype:social-engineering; sid:6000045; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xpj9809 .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xpj9809.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000046; classtype:social-engineering; sid:6000046; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vanshjaiswal-dev .github .io/Netflix)"; flow:established,to_server; http.uri; content:"/Netflix"; startswith; fast_pattern; http.host; content:"vanshjaiswal-dev.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000047; classtype:social-engineering; sid:6000047; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customer-sp-brantison1 .pages .dev/help/contact/6983929450291)"; flow:established,to_server; http.uri; content:"/help/contact/6983929450291"; startswith; fast_pattern; http.host; content:"customer-sp-brantison1.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000048; classtype:social-engineering; sid:6000048; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-active .bussines-partner-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-active.bussines-partner-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000049; classtype:social-engineering; sid:6000049; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aicc108-demo .pages .dev/www .netflix .com/cl/login)"; flow:established,to_server; http.uri; content:"/www.netflix.com/cl/login"; startswith; fast_pattern; http.host; content:"aicc108-demo.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000050; classtype:social-engineering; sid:6000050; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (snae-a5b7crbvb7akdtcc .z03 .azurefd .net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"snae-a5b7crbvb7akdtcc.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000051; classtype:social-engineering; sid:6000051; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customer-sp-brantison1 .pages .dev/help/contact/678967077354235)"; flow:established,to_server; http.uri; content:"/help/contact/678967077354235"; startswith; fast_pattern; http.host; content:"customer-sp-brantison1.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000052; classtype:social-engineering; sid:6000052; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (satyamgupta121 .github .io/stake-prediction/)"; flow:established,to_server; http.uri; content:"/stake-prediction/"; startswith; fast_pattern; http.host; content:"satyamgupta121.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000053; classtype:social-engineering; sid:6000053; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f .digitalmaillane .com/igit/4/6z5e5sez308nnj0brlz4c2zc5vf2pz1wqzmnfzybzrzk)"; flow:established,to_server; http.uri; content:"/igit/4/6z5e5sez308nnj0brlz4c2zc5vf2pz1wqzmnfzybzrzk"; startswith; fast_pattern; http.host; content:"f.digitalmaillane.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000054; classtype:social-engineering; sid:6000054; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aniket354 .github .io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"aniket354.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000055; classtype:social-engineering; sid:6000055; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nogllo .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nogllo.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000056; classtype:social-engineering; sid:6000056; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eugeniewun72-englichs302 .pages .dev/help/contact/743498979642437/)"; flow:established,to_server; http.uri; content:"/help/contact/743498979642437/"; startswith; fast_pattern; http.host; content:"eugeniewun72-englichs302.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000057; classtype:social-engineering; sid:6000057; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .web-git-erin-update-numericalinputs-uniswap .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.web-git-erin-update-numericalinputs-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000058; classtype:social-engineering; sid:6000058; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webctkkpn-3gla .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webctkkpn-3gla.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000059; classtype:social-engineering; sid:6000059; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .robiox .com .py/users/244226404304/profile)"; flow:established,to_server; http.uri; content:"/users/244226404304/profile"; startswith; fast_pattern; http.host; content:"www.robiox.com.py"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000060; classtype:social-engineering; sid:6000060; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inner .website/x01770e170b9d04350u82b95e65qd63b2c8c .html)"; flow:established,to_server; http.uri; content:"/x01770e170b9d04350u82b95e65qd63b2c8c.html"; startswith; fast_pattern; http.host; content:"inner.website"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000061; classtype:social-engineering; sid:6000061; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danaa-iindonesiaa .onn .my .id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danaa-iindonesiaa.onn.my.id"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000062; classtype:social-engineering; sid:6000062; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customer-sp-brantison1 .pages .dev/help/contact/390346491305421)"; flow:established,to_server; http.uri; content:"/help/contact/390346491305421"; startswith; fast_pattern; http.host; content:"customer-sp-brantison1.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000063; classtype:social-engineering; sid:6000063; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .robiox .com .py/users/368711310405/profile)"; flow:established,to_server; http.uri; content:"/users/368711310405/profile"; startswith; fast_pattern; http.host; content:"www.robiox.com.py"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000064; classtype:social-engineering; sid:6000064; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (client028 .business-agency-partners .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"client028.business-agency-partners.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000065; classtype:social-engineering; sid:6000065; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .auto-exchange-mail-npfs .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.auto-exchange-mail-npfs.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000066; classtype:social-engineering; sid:6000066; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klj .gangaoadmin .cyou/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"klj.gangaoadmin.cyou"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000067; classtype:social-engineering; sid:6000067; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (opnsea0penseamint46 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"opnsea0penseamint46.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000068; classtype:social-engineering; sid:6000068; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (teach .link/HTTPS-WWW-ROBLOX-COM)"; flow:established,to_server; http.uri; content:"/HTTPS-WWW-ROBLOX-COM"; startswith; fast_pattern; http.host; content:"teach.link"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000069; classtype:social-engineering; sid:6000069; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jexi-bank .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jexi-bank.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000070; classtype:social-engineering; sid:6000070; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uniglobalaccountsupportty .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uniglobalaccountsupportty.weebly.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000071; classtype:social-engineering; sid:6000071; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .microsoft761login .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.microsoft761login.weebly.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000072; classtype:social-engineering; sid:6000072; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (parakalanandhini .github .io/js/)"; flow:established,to_server; http.uri; content:"/js/"; startswith; fast_pattern; http.host; content:"parakalanandhini.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000073; classtype:social-engineering; sid:6000073; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (carloseletro .site .cineuai .xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"carloseletro.site.cineuai.xyz"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000074; classtype:social-engineering; sid:6000074; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sarvo-rixan-biz-paxru-zxgt22526r-pravix .pages .dev/system_violation_notification/)"; flow:established,to_server; http.uri; content:"/system_violation_notification/"; startswith; fast_pattern; http.host; content:"sarvo-rixan-biz-paxru-zxgt22526r-pravix.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000075; classtype:social-engineering; sid:6000075; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b222 .me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b222.me"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000076; classtype:social-engineering; sid:6000076; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newsbwebmail .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"newsbwebmail.weebly.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000077; classtype:social-engineering; sid:6000077; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (morva-xanor-biz-dexra-zxhe22526d-glorix .pages .dev/system_violation_notification/)"; flow:established,to_server; http.uri; content:"/system_violation_notification/"; startswith; fast_pattern; http.host; content:"morva-xanor-biz-dexra-zxhe22526d-glorix.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000078; classtype:social-engineering; sid:6000078; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yimrbiz .shop/pdf/d%25/0/1/adb .html?msg=debtcounselling@)"; flow:established,to_server; http.uri; content:"/pdf/d%25/0/1/adb.html?msg=debtcounselling@"; startswith; fast_pattern; http.host; content:"yimrbiz.shop"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000079; classtype:social-engineering; sid:6000079; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (promotions .ppsmotors .co .in/file/drive/index .php)"; flow:established,to_server; http.uri; content:"/file/drive/index.php"; startswith; fast_pattern; http.host; content:"promotions.ppsmotors.co.in"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000080; classtype:social-engineering; sid:6000080; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .web-git-thomas-revertdd-uniswap .vercel .app/explore)"; flow:established,to_server; http.uri; content:"/explore"; startswith; fast_pattern; http.host; content:"www.web-git-thomas-revertdd-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000081; classtype:social-engineering; sid:6000081; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (digitalprocurements .com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"digitalprocurements.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000082; classtype:social-engineering; sid:6000082; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .ledger-live-login-e7-en-us-cdn .vercel .app/ledger%20form/verify .html)"; flow:established,to_server; http.uri; content:"/ledger%20form/verify.html"; startswith; fast_pattern; http.host; content:"www.ledger-live-login-e7-en-us-cdn.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000083; classtype:social-engineering; sid:6000083; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-fbf3a87d05664d999912dfd2bd8b8dcc .r2 .dev/index .html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-fbf3a87d05664d999912dfd2bd8b8dcc.r2.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000084; classtype:social-engineering; sid:6000084; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inner .website/x6230c4290de194d93u84c15c8eqaf23f8fb .html)"; flow:established,to_server; http.uri; content:"/x6230c4290de194d93u84c15c8eqaf23f8fb.html"; startswith; fast_pattern; http.host; content:"inner.website"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000085; classtype:social-engineering; sid:6000085; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamkzlgano .gitbook .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metamkzlgano.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000086; classtype:social-engineering; sid:6000086; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sammyjay239 .github .io/AIRBNB-PROJECT/otherhtmlpages/amazingpool .html)"; flow:established,to_server; http.uri; content:"/AIRBNB-PROJECT/otherhtmlpages/amazingpool.html"; startswith; fast_pattern; http.host; content:"sammyjay239.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000087; classtype:social-engineering; sid:6000087; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portail-dsi .fr/?rid=u0DAzZD)"; flow:established,to_server; http.uri; content:"/?rid=u0DAzZD"; startswith; fast_pattern; http.host; content:"portail-dsi.fr"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000088; classtype:social-engineering; sid:6000088; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .newsbwebmail .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.newsbwebmail.weebly.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000089; classtype:social-engineering; sid:6000089; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trust-wallet-0xbce9a2c916bw .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trust-wallet-0xbce9a2c916bw.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000090; classtype:social-engineering; sid:6000090; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .uniglobalaccountsupportty .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.uniglobalaccountsupportty.weebly.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000091; classtype:social-engineering; sid:6000091; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kukoenvee-idd .gitbook .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kukoenvee-idd.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000092; classtype:social-engineering; sid:6000092; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (joyfullmint-drop3 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"joyfullmint-drop3.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000093; classtype:social-engineering; sid:6000093; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .web-git-thomas-revertdd-uniswap .vercel .app/swap)"; flow:established,to_server; http.uri; content:"/swap"; startswith; fast_pattern; http.host; content:"www.web-git-thomas-revertdd-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000094; classtype:social-engineering; sid:6000094; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aicc108-demo .pages .dev/title/70143836 .html)"; flow:established,to_server; http.uri; content:"/title/70143836.html"; startswith; fast_pattern; http.host; content:"aicc108-demo.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000095; classtype:social-engineering; sid:6000095; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acceso-ya1 .webcindario .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"acceso-ya1.webcindario.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000096; classtype:social-engineering; sid:6000096; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .roblox .et/games/106375311448069/Chat-with-AI-Emiko?privateServerLinkCode=36528982249207831634559611416587)"; flow:established,to_server; http.uri; content:"/games/106375311448069/Chat-with-AI-Emiko?privateServerLinkCode=36528982249207831634559611416587"; startswith; fast_pattern; http.host; content:"www.roblox.et"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000097; classtype:social-engineering; sid:6000097; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .kdmwj .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kdmwj.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000098; classtype:social-engineering; sid:6000098; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox .com .kz/users/334614924/profile)"; flow:established,to_server; http.uri; content:"/users/334614924/profile"; startswith; fast_pattern; http.host; content:"roblox.com.kz"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000099; classtype:social-engineering; sid:6000099; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (makershfc73621423 .github .io/Instagram-login/)"; flow:established,to_server; http.uri; content:"/Instagram-login/"; startswith; fast_pattern; http.host; content:"makershfc73621423.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000100; classtype:social-engineering; sid:6000100; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login-ledgger-load-io-queue .vercel .app/ledger%20form/device .html)"; flow:established,to_server; http.uri; content:"/ledger%20form/device.html"; startswith; fast_pattern; http.host; content:"login-ledgger-load-io-queue.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000101; classtype:social-engineering; sid:6000101; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aicc108-demo .pages .dev/title/80036140 .html)"; flow:established,to_server; http.uri; content:"/title/80036140.html"; startswith; fast_pattern; http.host; content:"aicc108-demo.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000102; classtype:social-engineering; sid:6000102; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .robiox .com .py/users/444337147691/profile)"; flow:established,to_server; http.uri; content:"/users/444337147691/profile"; startswith; fast_pattern; http.host; content:"www.robiox.com.py"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000103; classtype:social-engineering; sid:6000103; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .roblox .et/users/345217144/profile)"; flow:established,to_server; http.uri; content:"/users/345217144/profile"; startswith; fast_pattern; http.host; content:"www.roblox.et"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000104; classtype:social-engineering; sid:6000104; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .robiox .com .py/users/373199291273/profile)"; flow:established,to_server; http.uri; content:"/users/373199291273/profile"; startswith; fast_pattern; http.host; content:"www.robiox.com.py"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000105; classtype:social-engineering; sid:6000105; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customer-sp-brantison1 .pages .dev/help/contact/170854986895580)"; flow:established,to_server; http.uri; content:"/help/contact/170854986895580"; startswith; fast_pattern; http.host; content:"customer-sp-brantison1.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000106; classtype:social-engineering; sid:6000106; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (microsoft .account .trustedentity .com/http:/microsoft .authorised-support .com/new-account/EOzAFbYj1bjLmgufSIlKJJR9Kpvsy5kc3UkY=3Ag==5WFxWR1pGWlNBallaUlxbakJcQV1qRVRGRkJaR1E=/6Xx5KG1mKRNjeU3rSnC8diFTM7R4V1de/)"; flow:established,to_server; http.uri; content:"/http:/microsoft.authorised-support.com/new-account/EOzAFbYj1bjLmgufSIlKJJR9Kpvsy5kc3UkY=3Ag==5WFxWR1pGWlNBallaUlxbakJcQV1qRVRGRkJaR1E=/6Xx5KG1mKRNjeU3rSnC8diFTM7R4V1de/"; startswith; fast_pattern; http.host; content:"microsoft.account.trustedentity.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000107; classtype:social-engineering; sid:6000107; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamkzlgano .gitbook .io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"metamkzlgano.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000108; classtype:social-engineering; sid:6000108; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pnckswqpwks .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pnckswqpwks.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000109; classtype:social-engineering; sid:6000109; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .is .gd/Pex2mf/)"; flow:established,to_server; http.uri; content:"/Pex2mf/"; startswith; fast_pattern; http.host; content:"www.is.gd"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000110; classtype:social-engineering; sid:6000110; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .robiox .com .py/users/286671128158/profile)"; flow:established,to_server; http.uri; content:"/users/286671128158/profile"; startswith; fast_pattern; http.host; content:"www.robiox.com.py"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000111; classtype:social-engineering; sid:6000111; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aps-abesfreshie .github .io/Aps-abesfreshiep .github .io/)"; flow:established,to_server; http.uri; content:"/Aps-abesfreshiep.github.io/"; startswith; fast_pattern; http.host; content:"aps-abesfreshie.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000112; classtype:social-engineering; sid:6000112; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chalaalbretch-challa1 .pages .dev/help/contact/2572367898914052606:4700:310c%25 . . .)"; flow:established,to_server; http.uri; content:"/help/contact/2572367898914052606:4700:310c%25..."; startswith; fast_pattern; http.host; content:"chalaalbretch-challa1.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000113; classtype:social-engineering; sid:6000113; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aicc108-demo .pages .dev/title/81002370 .html)"; flow:established,to_server; http.uri; content:"/title/81002370.html"; startswith; fast_pattern; http.host; content:"aicc108-demo.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000114; classtype:social-engineering; sid:6000114; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt .flcbcs .help/track/it/)"; flow:established,to_server; http.uri; content:"/track/it/"; startswith; fast_pattern; http.host; content:"brt.flcbcs.help"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000115; classtype:social-engineering; sid:6000115; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiifkan-payllaterrs4 .from-resmi3 .my .id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiifkan-payllaterrs4.from-resmi3.my.id"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000116; classtype:social-engineering; sid:6000116; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd .malortrix .cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.malortrix.cfd"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000117; classtype:social-engineering; sid:6000117; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (david-houston3855463331 .pages .dev/help/contact/138288885999823/)"; flow:established,to_server; http.uri; content:"/help/contact/138288885999823/"; startswith; fast_pattern; http.host; content:"david-houston3855463331.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000118; classtype:social-engineering; sid:6000118; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customer-sp-brantison1 .pages .dev/help/contact/111098134764485)"; flow:established,to_server; http.uri; content:"/help/contact/111098134764485"; startswith; fast_pattern; http.host; content:"customer-sp-brantison1.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000119; classtype:social-engineering; sid:6000119; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inner .website/104e0f6021ac9941affa1a9f3f1f3b57ef70 .html)"; flow:established,to_server; http.uri; content:"/104e0f6021ac9941affa1a9f3f1f3b57ef70.html"; startswith; fast_pattern; http.host; content:"inner.website"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000120; classtype:social-engineering; sid:6000120; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (norva-kelra-biz-sunor-zxha22526z-glanex .pages .dev/heartily_welcome?id=103892392070173&page_name=Monica%20A%20Garcia/)"; flow:established,to_server; http.uri; content:"/heartily_welcome?id=103892392070173&page_name=Monica%20A%20Garcia/"; startswith; fast_pattern; http.host; content:"norva-kelra-biz-sunor-zxha22526z-glanex.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000121; classtype:social-engineering; sid:6000121; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (command-cloud .space/whatsapp/)"; flow:established,to_server; http.uri; content:"/whatsapp/"; startswith; fast_pattern; http.host; content:"command-cloud.space"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000122; classtype:social-engineering; sid:6000122; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .web-git-thomas-revertdd-uniswap .vercel .app/positions)"; flow:established,to_server; http.uri; content:"/positions"; startswith; fast_pattern; http.host; content:"www.web-git-thomas-revertdd-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000123; classtype:social-engineering; sid:6000123; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aicc108-demo .pages .dev/title/81613903 .html)"; flow:established,to_server; http.uri; content:"/title/81613903.html"; startswith; fast_pattern; http.host; content:"aicc108-demo.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000124; classtype:social-engineering; sid:6000124; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aicc108-demo .pages .dev/title/70155584 .html)"; flow:established,to_server; http.uri; content:"/title/70155584.html"; startswith; fast_pattern; http.host; content:"aicc108-demo.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000125; classtype:social-engineering; sid:6000125; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (case0405twrqpm .syncpath-connectsrv .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"case0405twrqpm.syncpath-connectsrv.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000126; classtype:social-engineering; sid:6000126; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s3 .dualstack .us-east-1 .amazonaws .com/rtsrtgfsgvhgvjhsd5211gvvxtcj .067 .udjhss .jnxjnnjn/index .html)"; flow:established,to_server; http.uri; content:"/rtsrtgfsgvhgvjhsd5211gvvxtcj.067.udjhss.jnxjnnjn/index.html"; startswith; fast_pattern; http.host; content:"s3.dualstack.us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000127; classtype:social-engineering; sid:6000127; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robnhodlogox .gitbook .io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"robnhodlogox.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000128; classtype:social-engineering; sid:6000128; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inner .website/74cb3b21cy8412457a8a7db33d6kc97065ca .html)"; flow:established,to_server; http.uri; content:"/74cb3b21cy8412457a8a7db33d6kc97065ca.html"; startswith; fast_pattern; http.host; content:"inner.website"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000129; classtype:social-engineering; sid:6000129; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maisaumentoparavoce .s3 .us-east-005 .backblazeb2 .com/aumento .html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"maisaumentoparavoce.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000130; classtype:social-engineering; sid:6000130; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .solutionfun .info/landingpage/cf1a9771-107e-471b-986d-361ea44c2f10/xsk53psqbrcsbx3tbjydsemzmjllzd0jtppsqfgavio)"; flow:established,to_server; http.uri; content:"/landingpage/cf1a9771-107e-471b-986d-361ea44c2f10/xsk53psqbrcsbx3tbjydsemzmjllzd0jtppsqfgavio"; startswith; fast_pattern; http.host; content:"www.solutionfun.info"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000131; classtype:social-engineering; sid:6000131; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreibyljmt5scyuoccu3ucintoqyfi33tvk6gvwng4pniq3pnoahrva4 .ipfs .dweb .link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreibyljmt5scyuoccu3ucintoqyfi33tvk6gvwng4pniq3pnoahrva4.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000132; classtype:social-engineering; sid:6000132; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox .et/communities/1109850503/KawaiPinkyCutes-Group)"; flow:established,to_server; http.uri; content:"/communities/1109850503/KawaiPinkyCutes-Group"; startswith; fast_pattern; http.host; content:"roblox.et"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000133; classtype:social-engineering; sid:6000133; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sarvo-rixan-biz-paxru-zxid22526e-glanex .pages .dev/system_violation_notification/)"; flow:established,to_server; http.uri; content:"/system_violation_notification/"; startswith; fast_pattern; http.host; content:"sarvo-rixan-biz-paxru-zxid22526e-glanex.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000134; classtype:social-engineering; sid:6000134; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater .cdd .my .id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.cdd.my.id"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000135; classtype:social-engineering; sid:6000135; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fgxscvx .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fgxscvx.weebly.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000136; classtype:social-engineering; sid:6000136; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreihlqg7ney64hr6afams2d3aqwt7q7xh4l2tv6orjnzkaqa5bgbwb4 .ipfs .dweb .link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreihlqg7ney64hr6afams2d3aqwt7q7xh4l2tv6orjnzkaqa5bgbwb4.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000137; classtype:social-engineering; sid:6000137; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inner .website/x7e80386c0c9da4ac1uafba38ebq5e615e09 .html)"; flow:established,to_server; http.uri; content:"/x7e80386c0c9da4ac1uafba38ebq5e615e09.html"; startswith; fast_pattern; http.host; content:"inner.website"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000138; classtype:social-engineering; sid:6000138; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .robiox .com .ua/communities/6265103876/Xilo-Main)"; flow:established,to_server; http.uri; content:"/communities/6265103876/Xilo-Main"; startswith; fast_pattern; http.host; content:"www.robiox.com.ua"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000139; classtype:social-engineering; sid:6000139; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-enabled .bussines-partner-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-enabled.bussines-partner-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000140; classtype:social-engineering; sid:6000140; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (priyanshu-pandey97 .github .io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"priyanshu-pandey97.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000141; classtype:social-engineering; sid:6000141; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inner .website/x5118c60102cbd498cu89dc2773q5e7571b4 .html)"; flow:established,to_server; http.uri; content:"/x5118c60102cbd498cu89dc2773q5e7571b4.html"; startswith; fast_pattern; http.host; content:"inner.website"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000142; classtype:social-engineering; sid:6000142; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ninjafoux .github .io/Roblos/)"; flow:established,to_server; http.uri; content:"/Roblos/"; startswith; fast_pattern; http.host; content:"ninjafoux.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000143; classtype:social-engineering; sid:6000143; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sammyjay239 .github .io/AIRBNB-PROJECT/otherhtmlpages/rooms .html)"; flow:established,to_server; http.uri; content:"/AIRBNB-PROJECT/otherhtmlpages/rooms.html"; startswith; fast_pattern; http.host; content:"sammyjay239.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000144; classtype:social-engineering; sid:6000144; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (grp-atoiner-kalev .pages .dev/help/contact/140611966531816)"; flow:established,to_server; http.uri; content:"/help/contact/140611966531816"; startswith; fast_pattern; http.host; content:"grp-atoiner-kalev.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000145; classtype:social-engineering; sid:6000145; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-advertising .bussines-partner-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-advertising.bussines-partner-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000146; classtype:social-engineering; sid:6000146; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creatlnlclestl355sn .iceiy .com/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"creatlnlclestl355sn.iceiy.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000147; classtype:social-engineering; sid:6000147; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dd1 .qzz .io/dana/7j6ha/0h/)"; flow:established,to_server; http.uri; content:"/dana/7j6ha/0h/"; startswith; fast_pattern; http.host; content:"dd1.qzz.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000148; classtype:social-engineering; sid:6000148; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .battery-support-ledger-livelogin-e7 .vercel .app/ledger%20form/verify .html)"; flow:established,to_server; http.uri; content:"/ledger%20form/verify.html"; startswith; fast_pattern; http.host; content:"www.battery-support-ledger-livelogin-e7.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000149; classtype:social-engineering; sid:6000149; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spotifylogin-pha5m9wlk-gasstontorres .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spotifylogin-pha5m9wlk-gasstontorres.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000150; classtype:social-engineering; sid:6000150; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .robiox .com .py/users/248474341917/profile)"; flow:established,to_server; http.uri; content:"/users/248474341917/profile"; startswith; fast_pattern; http.host; content:"www.robiox.com.py"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000151; classtype:social-engineering; sid:6000151; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sarvo-drixa-biz-paxru-zxhq22526q-pravix .pages .dev/heartily_welcome?id=103892392070173&page_name=Monica%20A%20Garcia/)"; flow:established,to_server; http.uri; content:"/heartily_welcome?id=103892392070173&page_name=Monica%20A%20Garcia/"; startswith; fast_pattern; http.host; content:"sarvo-drixa-biz-paxru-zxhq22526q-pravix.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000152; classtype:social-engineering; sid:6000152; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-git-05-08-trystagingbutprobwillfailbcunauthe-c7b77b-uniswap .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-git-05-08-trystagingbutprobwillfailbcunauthe-c7b77b-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000153; classtype:social-engineering; sid:6000153; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customer-sp-brantison1 .pages .dev/help/contact/883627422209385)"; flow:established,to_server; http.uri; content:"/help/contact/883627422209385"; startswith; fast_pattern; http.host; content:"customer-sp-brantison1.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000154; classtype:social-engineering; sid:6000154; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inner .website/j08ab4aa07e6964ca16b41083f675b13955b .html)"; flow:established,to_server; http.uri; content:"/j08ab4aa07e6964ca16b41083f675b13955b.html"; startswith; fast_pattern; http.host; content:"inner.website"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000155; classtype:social-engineering; sid:6000155; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-setup .bussines-partner-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-setup.bussines-partner-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000156; classtype:social-engineering; sid:6000156; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (geva58375 .github .io/xf/)"; flow:established,to_server; http.uri; content:"/xf/"; startswith; fast_pattern; http.host; content:"geva58375.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000157; classtype:social-engineering; sid:6000157; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inner .website/xa13e26f80592247c3u8dc699a6qdbea4a99 .html)"; flow:established,to_server; http.uri; content:"/xa13e26f80592247c3u8dc699a6qdbea4a99.html"; startswith; fast_pattern; http.host; content:"inner.website"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000158; classtype:social-engineering; sid:6000158; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-doc-trezor-suite .gitbook .io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"help-doc-trezor-suite.gitbook.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000159; classtype:social-engineering; sid:6000159; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f .digitalmaillane .com/igit/4/2l9ligwtvjxaifw7nht08ytptp1sxhtxsmtljbtu7tntg)"; flow:established,to_server; http.uri; content:"/igit/4/2l9ligwtvjxaifw7nht08ytptp1sxhtxsmtljbtu7tntg"; startswith; fast_pattern; http.host; content:"f.digitalmaillane.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000160; classtype:social-engineering; sid:6000160; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .wells-fargo .cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.wells-fargo.cc"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000161; classtype:social-engineering; sid:6000161; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (application-meta .accounts-admin-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"application-meta.accounts-admin-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000162; classtype:social-engineering; sid:6000162; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mmsnverificationserver .weebly .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mmsnverificationserver.weebly.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000163; classtype:social-engineering; sid:6000163; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accessportal-credentials02 .buddyl .workers .dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"accessportal-credentials02.buddyl.workers.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000164; classtype:social-engineering; sid:6000164; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ayanaanonaeem .github .io/Netflix/)"; flow:established,to_server; http.uri; content:"/Netflix/"; startswith; fast_pattern; http.host; content:"ayanaanonaeem.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000165; classtype:social-engineering; sid:6000165; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c .4qw .nl/hy9zL99KGLitGx1U2x85mtKDNsPgf7HV/)"; flow:established,to_server; http.uri; content:"/hy9zL99KGLitGx1U2x85mtKDNsPgf7HV/"; startswith; fast_pattern; http.host; content:"c.4qw.nl"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000166; classtype:social-engineering; sid:6000166; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ashton564 .github .io/BT .html)"; flow:established,to_server; http.uri; content:"/BT.html"; startswith; fast_pattern; http.host; content:"ashton564.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000167; classtype:social-engineering; sid:6000167; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rva .ann .mybluehost .me/\;frfr/758e91f87bd6bd88d563/nkl-log .php)"; flow:established,to_server; http.uri; content:"/|3b|frfr/758e91f87bd6bd88d563/nkl-log.php"; startswith; fast_pattern; http.host; content:"rva.ann.mybluehost.me"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000168; classtype:social-engineering; sid:6000168; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-git-thomas-revertdd-uniswap .vercel .app/positions/create/v4)"; flow:established,to_server; http.uri; content:"/positions/create/v4"; startswith; fast_pattern; http.host; content:"web-git-thomas-revertdd-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000169; classtype:social-engineering; sid:6000169; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amanalpha001-tech .github .io/Fb-Log-in-page/)"; flow:established,to_server; http.uri; content:"/Fb-Log-in-page/"; startswith; fast_pattern; http.host; content:"amanalpha001-tech.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000170; classtype:social-engineering; sid:6000170; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s3-external-2 .amazonaws .com/rtsrtgfsgvhgvjhsd5211gvvxtcj .068 .udjhss .jnxjnnjn/index .html)"; flow:established,to_server; http.uri; content:"/rtsrtgfsgvhgvjhsd5211gvvxtcj.068.udjhss.jnxjnnjn/index.html"; startswith; fast_pattern; http.host; content:"s3-external-2.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000171; classtype:social-engineering; sid:6000171; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .vjusqe .shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.vjusqe.shop"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000172; classtype:social-engineering; sid:6000172; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xcosttumer-indodnan .stormiexyz .my .id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xcosttumer-indodnan.stormiexyz.my.id"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000173; classtype:social-engineering; sid:6000173; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-authorized .bussines-partner-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-authorized.bussines-partner-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000174; classtype:social-engineering; sid:6000174; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (votre .espacereservationlbc .info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"votre.espacereservationlbc.info"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000175; classtype:social-engineering; sid:6000175; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox .com .kz/users/1106943092/profilec)"; flow:established,to_server; http.uri; content:"/users/1106943092/profilec"; startswith; fast_pattern; http.host; content:"roblox.com.kz"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000176; classtype:social-engineering; sid:6000176; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .abnbrent-website .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.abnbrent-website.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000177; classtype:social-engineering; sid:6000177; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .roblox .com .bn/users/178585097306/profile)"; flow:established,to_server; http.uri; content:"/users/178585097306/profile"; startswith; fast_pattern; http.host; content:"www.roblox.com.bn"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000178; classtype:social-engineering; sid:6000178; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aicc108-demo .pages .dev/title/70155590 .html)"; flow:established,to_server; http.uri; content:"/title/70155590.html"; startswith; fast_pattern; http.host; content:"aicc108-demo.pages.dev"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000179; classtype:social-engineering; sid:6000179; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .roblox .com .bi/games/17625359962/-RIVALS?privateServerLinkCode=47815123988921703605395428994914)"; flow:established,to_server; http.uri; content:"/games/17625359962/-RIVALS?privateServerLinkCode=47815123988921703605395428994914"; startswith; fast_pattern; http.host; content:"www.roblox.com.bi"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000180; classtype:social-engineering; sid:6000180; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .robiox .com .py/users/179401810451/profile)"; flow:established,to_server; http.uri; content:"/users/179401810451/profile"; startswith; fast_pattern; http.host; content:"www.robiox.com.py"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000181; classtype:social-engineering; sid:6000181; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (member001 .business-ad-agency .com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"member001.business-ad-agency.com"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000182; classtype:social-engineering; sid:6000182; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .joyfullmint-drop3 .vercel .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.joyfullmint-drop3.vercel.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000183; classtype:social-engineering; sid:6000183; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (69faf1f96e16da18b0206fec--chimerical-custard-0c06e1 .netlify .app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"69faf1f96e16da18b0206fec--chimerical-custard-0c06e1.netlify.app"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000184; classtype:social-engineering; sid:6000184; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www .robiox .com .py/users/285605283867/profile)"; flow:established,to_server; http.uri; content:"/users/285605283867/profile"; startswith; fast_pattern; http.host; content:"www.robiox.com.py"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000185; classtype:social-engineering; sid:6000185; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (veyra34 .github .io/Netflix-Ui-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Ui-Clone/"; startswith; fast_pattern; http.host; content:"veyra34.github.io"; endswith; reference:url,openphish.com; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000186; classtype:social-engineering; sid:6000186; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (49 .51 .43 .12/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts .google .com&%3Bifkv=AWnogHe_pDujLaO-hl3d_3DQFjS6PW6JGM3LRrD13mxmiaQWTJuHz9b6nwmaSIh76M5SMOelnJex7g&%3Bpassive=1209600&continue=https%3A%2F%2Faccounts .google .com%2F&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2Pav4a5xoguuXZ6e9hTNmmZY1TsU4p8yfdfgL3ZFGkdYyazY9GZ7HWCwc_rPmUAIRlzJ1o40ggQ&dsh=S1963348150%3A1778385692872888)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts.google.com&%3Bifkv=AWnogHe_pDujLaO-hl3d_3DQFjS6PW6JGM3LRrD13mxmiaQWTJuHz9b6nwmaSIh76M5SMOelnJex7g&%3Bpassive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2Pav4a5xoguuXZ6e9hTNmmZY1TsU4p8yfdfgL3ZFGkdYyazY9GZ7HWCwc_rPmUAIRlzJ1o40ggQ&dsh=S1963348150%3A1778385692872888"; startswith; fast_pattern; http.host; content:"49.51.43.12"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000187; classtype:social-engineering; sid:6000187; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (43 .134 .178 .58/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts .google .com%2F%3F&%3Bpassive=1209600&%3Bxrealip=107 .178 .231 .253&continue=https%3A%2F%2Faccounts .google .com%2F%3F&dsh=S1245160496%3A1778384330204826&xrealip=138 .197 .91 .206&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2Pas-_xLXUcHwvQNUxNV9CBv5leyqmzepQhOcwNysbl6RjVdZhoUBuUPYYpS3aGT_dkamBaWroQ)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts.google.com%2F%3F&%3Bpassive=1209600&%3Bxrealip=107.178.231.253&continue=https%3A%2F%2Faccounts.google.com%2F%3F&dsh=S1245160496%3A1778384330204826&xrealip=138.197.91.206&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2Pas-_xLXUcHwvQNUxNV9CBv5leyqmzepQhOcwNysbl6RjVdZhoUBuUPYYpS3aGT_dkamBaWroQ"; startswith; fast_pattern; http.host; content:"43.134.178.58"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000188; classtype:social-engineering; sid:6000188; rev:2; metadata: signature_severity Major, created_et 2026_05_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (23 .254 .227 .236/doc/kcupdate .html)"; flow:established,to_server; http.uri; content:"/doc/kcupdate.html"; startswith; fast_pattern; http.host; content:"23.254.227.236"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000189; classtype:social-engineering; sid:6000189; rev:2; metadata: signature_severity Major, created_et 2026_05_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (165 .154 .231 .146/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"165.154.231.146"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000190; classtype:social-engineering; sid:6000190; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (43 .153 .186 .198/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"43.153.186.198"; endswith; reference:url,phishstats.info; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000191; classtype:social-engineering; sid:6000191; rev:2; metadata: signature_severity Major, created_et 2026_05_12, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fbkjmq.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fbkjmq.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000192; classtype:social-engineering; sid:6000192; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mi-rushang.github.io/instagram.com/)"; flow:established,to_server; http.uri; content:"/instagram.com/"; startswith; fast_pattern; http.host; content:"mi-rushang.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000193; classtype:social-engineering; sid:6000193; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qtvndf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qtvndf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000194; classtype:social-engineering; sid:6000194; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.euvwkf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.euvwkf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000195; classtype:social-engineering; sid:6000195; rev:1; metadata: signature_severity Major, created_et 2026_05_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (renouveilement-sante.com/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"renouveilement-sante.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000196; classtype:social-engineering; sid:6000196; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cliente.gruppobper.cfd/it/auth/index1.php)"; flow:established,to_server; http.uri; content:"/it/auth/index1.php"; startswith; fast_pattern; http.host; content:"cliente.gruppobper.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000197; classtype:social-engineering; sid:6000197; rev:1; metadata: signature_severity Major, created_et 2026_05_18, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (haberglobal44.shop/auth)"; flow:established,to_server; http.uri; content:"/auth"; startswith; fast_pattern; http.host; content:"haberglobal44.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000198; classtype:social-engineering; sid:6000198; rev:1; metadata: signature_severity Major, created_et 2026_05_20, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gokul-unni93.github.io/Facebook-login-signup/)"; flow:established,to_server; http.uri; content:"/Facebook-login-signup/"; startswith; fast_pattern; http.host; content:"gokul-unni93.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000199; classtype:social-engineering; sid:6000199; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nl-web-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nl-web-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000200; classtype:social-engineering; sid:6000200; rev:1; metadata: signature_severity Major, created_et 2026_05_21, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (connect-bridgge.wixstudio.com/hub-io)"; flow:established,to_server; http.uri; content:"/hub-io"; startswith; fast_pattern; http.host; content:"connect-bridgge.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000201; classtype:social-engineering; sid:6000201; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kleinanzeigen.wlrsj.com/41921064?mail=W0FOQUZFTUFd&meta=rlWjMKWwLJ50LJqyVwb1YPWhLJ1yVwbvKUIxBQAxKUIxLmN5VRShLJMyoJRvYPWwnTS0K2yxVwbgZGNjZmH4ZQHmZwVmBFjvp2IlqzywMFV6VzgfMJyhLJ56MJyaMJ4vYPW0rKOyVwbvLJ5uMzIgLI9gLJyfVa0%3D)"; flow:established,to_server; http.uri; content:"/41921064?mail=W0FOQUZFTUFd&meta=rlWjMKWwLJ50LJqyVwb1YPWhLJ1yVwbvKUIxBQAxKUIxLmN5VRShLJMyoJRvYPWwnTS0K2yxVwbgZGNjZmH4ZQHmZwVmBFjvp2IlqzywMFV6VzgfMJyhLJ56MJyaMJ4vYPW0rKOyVwbvLJ5uMzIgLI9gLJyfVa0%3D"; startswith; fast_pattern; http.host; content:"kleinanzeigen.wlrsj.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000202; classtype:social-engineering; sid:6000202; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.otbqew.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.otbqew.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000203; classtype:social-engineering; sid:6000203; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yifsxa.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.yifsxa.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000204; classtype:social-engineering; sid:6000204; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yejdgc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.yejdgc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000205; classtype:social-engineering; sid:6000205; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (linkedin.comunicazioni-sicure.it/actionrequired?rid=RwQSixi)"; flow:established,to_server; http.uri; content:"/actionrequired?rid=RwQSixi"; startswith; fast_pattern; http.host; content:"linkedin.comunicazioni-sicure.it"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000206; classtype:social-engineering; sid:6000206; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yjasur039-cyber.github.io/instagram-main)"; flow:established,to_server; http.uri; content:"/instagram-main"; startswith; fast_pattern; http.host; content:"yjasur039-cyber.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000207; classtype:social-engineering; sid:6000207; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (new-rabbyy.wixstudio.com/wallet)"; flow:established,to_server; http.uri; content:"/wallet"; startswith; fast_pattern; http.host; content:"new-rabbyy.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000208; classtype:social-engineering; sid:6000208; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sim-app.info/WhS)"; flow:established,to_server; http.uri; content:"/WhS"; startswith; fast_pattern; http.host; content:"sim-app.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000209; classtype:social-engineering; sid:6000209; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kumariritu21.github.io/netflix_homepage_clone/)"; flow:established,to_server; http.uri; content:"/netflix_homepage_clone/"; startswith; fast_pattern; http.host; content:"kumariritu21.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000210; classtype:social-engineering; sid:6000210; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (girope.hu/doc/)"; flow:established,to_server; http.uri; content:"/doc/"; startswith; fast_pattern; http.host; content:"girope.hu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000211; classtype:social-engineering; sid:6000211; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (piyush-bytes.github.io/AMAZON_CLONE/)"; flow:established,to_server; http.uri; content:"/AMAZON_CLONE/"; startswith; fast_pattern; http.host; content:"piyush-bytes.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000212; classtype:social-engineering; sid:6000212; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chloewnavalcert.wasmer.app/billandmelindagatesfoundation)"; flow:established,to_server; http.uri; content:"/billandmelindagatesfoundation"; startswith; fast_pattern; http.host; content:"chloewnavalcert.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000213; classtype:social-engineering; sid:6000213; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-orders-payment.pro/work/new-orders)"; flow:established,to_server; http.uri; content:"/work/new-orders"; startswith; fast_pattern; http.host; content:"fiverr-orders-payment.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000214; classtype:social-engineering; sid:6000214; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ofertassemanais.vercel.app/ofertas/)"; flow:established,to_server; http.uri; content:"/ofertas/"; startswith; fast_pattern; http.host; content:"ofertassemanais.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000215; classtype:social-engineering; sid:6000215; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customeraccountservice.themosthauntedforum.com/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"customeraccountservice.themosthauntedforum.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000216; classtype:social-engineering; sid:6000216; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f.digital-sending.com/igit/4/79iei6yLen46eglvb5LdprLpuaj9w5Lp6cL46zLivLbL4)"; flow:established,to_server; http.uri; content:"/igit/4/79iei6yLen46eglvb5LdprLpuaj9w5Lp6cL46zLivLbL4"; startswith; fast_pattern; http.host; content:"f.digital-sending.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000217; classtype:social-engineering; sid:6000217; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucouinlogie.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kucouinlogie.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000218; classtype:social-engineering; sid:6000218; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ww-brasilrodovias.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ww-brasilrodovias.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000219; classtype:social-engineering; sid:6000219; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.lootcentral.com.br/voice/)"; flow:established,to_server; http.uri; content:"/voice/"; startswith; fast_pattern; http.host; content:"www.lootcentral.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000220; classtype:social-engineering; sid:6000220; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (on-pedagiobrasil.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"on-pedagiobrasil.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000221; classtype:social-engineering; sid:6000221; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pemenangshopee389.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pemenangshopee389.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000222; classtype:social-engineering; sid:6000222; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pabmos.com/dcs/)"; flow:established,to_server; http.uri; content:"/dcs/"; startswith; fast_pattern; http.host; content:"pabmos.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000223; classtype:social-engineering; sid:6000223; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ar-enel.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ar-enel.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000224; classtype:social-engineering; sid:6000224; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (starting-trezo-docs.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"starting-trezo-docs.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000225; classtype:social-engineering; sid:6000225; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nithiksathyan.github.io/NetFlix)"; flow:established,to_server; http.uri; content:"/NetFlix"; startswith; fast_pattern; http.host; content:"nithiksathyan.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000226; classtype:social-engineering; sid:6000226; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (saishankar1430.github.io/amazonproject/)"; flow:established,to_server; http.uri; content:"/amazonproject/"; startswith; fast_pattern; http.host; content:"saishankar1430.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000227; classtype:social-engineering; sid:6000227; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4jw.d29.mytemp.website/mijnabnaa/app-vernieuwen/)"; flow:established,to_server; http.uri; content:"/mijnabnaa/app-vernieuwen/"; startswith; fast_pattern; http.host; content:"4jw.d29.mytemp.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000228; classtype:social-engineering; sid:6000228; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moises.cl/feisbuc-234435564)"; flow:established,to_server; http.uri; content:"/feisbuc-234435564"; startswith; fast_pattern; http.host; content:"moises.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000229; classtype:social-engineering; sid:6000229; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedagioff.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedagioff.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000230; classtype:social-engineering; sid:6000230; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fnlocker.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fnlocker.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000231; classtype:social-engineering; sid:6000231; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netfilx.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netfilx.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000232; classtype:social-engineering; sid:6000232; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgerlikeapp.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgerlikeapp.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000233; classtype:social-engineering; sid:6000233; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrg.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingrg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000234; classtype:social-engineering; sid:6000234; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-delta-hazel.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-delta-hazel.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000235; classtype:social-engineering; sid:6000235; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (entregas-ze-delivery.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"entregas-ze-delivery.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000236; classtype:social-engineering; sid:6000236; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crm.relis.co.ke/vendor/meta-fb-page/login/)"; flow:established,to_server; http.uri; content:"/vendor/meta-fb-page/login/"; startswith; fast_pattern; http.host; content:"crm.relis.co.ke"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000237; classtype:social-engineering; sid:6000237; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-trezoor-suite-cdn.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info-trezoor-suite-cdn.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000238; classtype:social-engineering; sid:6000238; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whapptr6.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whapptr6.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000239; classtype:social-engineering; sid:6000239; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja94.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja94.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000240; classtype:social-engineering; sid:6000240; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (siddharth-abesec.github.io/Amazon-ECE-1/)"; flow:established,to_server; http.uri; content:"/Amazon-ECE-1/"; startswith; fast_pattern; http.host; content:"siddharth-abesec.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000241; classtype:social-engineering; sid:6000241; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ecocashloans.online.techjeisolutions.co.ke/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ecocashloans.online.techjeisolutions.co.ke"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000242; classtype:social-engineering; sid:6000242; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingra.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingra.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000243; classtype:social-engineering; sid:6000243; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-pedidos24h-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-pedidos24h-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000244; classtype:social-engineering; sid:6000244; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comparable-beige-ghqsab8y.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comparable-beige-ghqsab8y.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000245; classtype:social-engineering; sid:6000245; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedir-adega24h-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedir-adega24h-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000246; classtype:social-engineering; sid:6000246; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ghotkshop.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ghotkshop.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000247; classtype:social-engineering; sid:6000247; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fedexx-blue.vercel.app/Privacy%20&%20Security.html)"; flow:established,to_server; http.uri; content:"/Privacy%20&%20Security.html"; startswith; fast_pattern; http.host; content:"fedexx-blue.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000248; classtype:social-engineering; sid:6000248; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ovtv-b9jc-vs6z.admin-boltsigns-com-s-account.workers.dev/?q=a)"; flow:established,to_server; http.uri; content:"/?q=a"; startswith; fast_pattern; http.host; content:"ovtv-b9jc-vs6z.admin-boltsigns-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000249; classtype:social-engineering; sid:6000249; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bombardiha.framer.photos/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bombardiha.framer.photos"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000250; classtype:social-engineering; sid:6000250; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enfermeriacanaria.com/112/NRD/1b1fd37/Sign_in.php)"; flow:established,to_server; http.uri; content:"/112/NRD/1b1fd37/Sign_in.php"; startswith; fast_pattern; http.host; content:"enfermeriacanaria.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000251; classtype:social-engineering; sid:6000251; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrx.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingrx.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000252; classtype:social-engineering; sid:6000252; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newcomer-courgette-121562.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"newcomer-courgette-121562.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000253; classtype:social-engineering; sid:6000253; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whapptr8.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whapptr8.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000254; classtype:social-engineering; sid:6000254; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtu.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingtu.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000255; classtype:social-engineering; sid:6000255; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adega-24h-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"adega-24h-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000256; classtype:social-engineering; sid:6000256; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maakmaghdouche.org/av-intel-order)"; flow:established,to_server; http.uri; content:"/av-intel-order"; startswith; fast_pattern; http.host; content:"maakmaghdouche.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000257; classtype:social-engineering; sid:6000257; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtg.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingtg.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000258; classtype:social-engineering; sid:6000258; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtr.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingtr.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000259; classtype:social-engineering; sid:6000259; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtp.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingtp.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000260; classtype:social-engineering; sid:6000260; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-pedidos48h-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-pedidos48h-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000261; classtype:social-engineering; sid:6000261; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anandyadav2007.github.io/Task-04/)"; flow:established,to_server; http.uri; content:"/Task-04/"; startswith; fast_pattern; http.host; content:"anandyadav2007.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000262; classtype:social-engineering; sid:6000262; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shalusinghal4563-ops.github.io/project_amazon_clone/)"; flow:established,to_server; http.uri; content:"/project_amazon_clone/"; startswith; fast_pattern; http.host; content:"shalusinghal4563-ops.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000263; classtype:social-engineering; sid:6000263; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreig3jc74ivzarf5ztajoezlzdfd6asq3shweqb6phzxt4obly3ig3i.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreig3jc74ivzarf5ztajoezlzdfd6asq3shweqb6phzxt4obly3ig3i.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000264; classtype:social-engineering; sid:6000264; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtk.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingtk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000265; classtype:social-engineering; sid:6000265; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingto.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingto.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000266; classtype:social-engineering; sid:6000266; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uphold-login----apps.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uphold-login----apps.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000267; classtype:social-engineering; sid:6000267; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-pedidos-ze24h.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-pedidos-ze24h.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000268; classtype:social-engineering; sid:6000268; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (talktalk-101540.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"talktalk-101540.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000269; classtype:social-engineering; sid:6000269; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bexo-df6s-8jlw.george-vandevorde-smithinsurancellc-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bexo-df6s-8jlw.george-vandevorde-smithinsurancellc-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000270; classtype:social-engineering; sid:6000270; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.86365z.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.86365z.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000271; classtype:social-engineering; sid:6000271; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-pedidosze-24h.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-pedidosze-24h.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000272; classtype:social-engineering; sid:6000272; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (glowshiya.com/script.html)"; flow:established,to_server; http.uri; content:"/script.html"; startswith; fast_pattern; http.host; content:"glowshiya.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000273; classtype:social-engineering; sid:6000273; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedir-delivery-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedir-delivery-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000274; classtype:social-engineering; sid:6000274; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maxisopk.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"maxisopk.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000275; classtype:social-engineering; sid:6000275; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stutiiag.github.io/Amazon.github.io)"; flow:established,to_server; http.uri; content:"/Amazon.github.io"; startswith; fast_pattern; http.host; content:"stutiiag.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000276; classtype:social-engineering; sid:6000276; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecommerce-website-nine-hazel.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ecommerce-website-nine-hazel.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000277; classtype:social-engineering; sid:6000277; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-entregas-ze24h.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-entregas-ze24h.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000278; classtype:social-engineering; sid:6000278; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (notewortha.sa.com/reviewhome/)"; flow:established,to_server; http.uri; content:"/reviewhome/"; startswith; fast_pattern; http.host; content:"notewortha.sa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000279; classtype:social-engineering; sid:6000279; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrx.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingrx.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000280; classtype:social-engineering; sid:6000280; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecocashloans.online.techjeisolutions.co.ke/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ecocashloans.online.techjeisolutions.co.ke"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000281; classtype:social-engineering; sid:6000281; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lc-kraken-social-8cbe.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lc-kraken-social-8cbe.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000282; classtype:social-engineering; sid:6000282; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faq-public-trzor-suit.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faq-public-trzor-suit.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000283; classtype:social-engineering; sid:6000283; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (get-io-trez-or-st-art.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"get-io-trez-or-st-art.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000284; classtype:social-engineering; sid:6000284; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dilkashalam.github.io/Microsoft-Clone/)"; flow:established,to_server; http.uri; content:"/Microsoft-Clone/"; startswith; fast_pattern; http.host; content:"dilkashalam.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000285; classtype:social-engineering; sid:6000285; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-72186365-4338-4462-ad6b-9b797bd9b486.cleverapps.io/ANTAI/am/paiement.php/)"; flow:established,to_server; http.uri; content:"/ANTAI/am/paiement.php/"; startswith; fast_pattern; http.host; content:"app-72186365-4338-4462-ad6b-9b797bd9b486.cleverapps.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000286; classtype:social-engineering; sid:6000286; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whapptr1.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whapptr1.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000287; classtype:social-engineering; sid:6000287; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (basithalikp.github.io/netflix-frontend)"; flow:established,to_server; http.uri; content:"/netflix-frontend"; startswith; fast_pattern; http.host; content:"basithalikp.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000288; classtype:social-engineering; sid:6000288; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-pedido-ze24h.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-pedido-ze24h.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000289; classtype:social-engineering; sid:6000289; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.5157111.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.5157111.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000290; classtype:social-engineering; sid:6000290; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (copacomlimitedecampeao11.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"copacomlimitedecampeao11.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000291; classtype:social-engineering; sid:6000291; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (updatesnotified.com/concluded.php?k=4885483ce5ec713cba5cb60376f5c757f2bce4aa)"; flow:established,to_server; http.uri; content:"/concluded.php?k=4885483ce5ec713cba5cb60376f5c757f2bce4aa"; startswith; fast_pattern; http.host; content:"updatesnotified.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000292; classtype:social-engineering; sid:6000292; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fuv.jbw.temporary.site/112/NRD/1364f3c/Sign_in.php)"; flow:established,to_server; http.uri; content:"/112/NRD/1364f3c/Sign_in.php"; startswith; fast_pattern; http.host; content:"fuv.jbw.temporary.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000293; classtype:social-engineering; sid:6000293; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kijiji-autos-int.sm360.ca/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kijiji-autos-int.sm360.ca"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000294; classtype:social-engineering; sid:6000294; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (langley-speedway.com/particulier-societegenerale/societe/sg/login/fr/login.php/)"; flow:established,to_server; http.uri; content:"/particulier-societegenerale/societe/sg/login/fr/login.php/"; startswith; fast_pattern; http.host; content:"langley-speedway.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000295; classtype:social-engineering; sid:6000295; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whapptr2.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whapptr2.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000296; classtype:social-engineering; sid:6000296; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (minadeengajamento.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"minadeengajamento.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000297; classtype:social-engineering; sid:6000297; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toplukonut0054975248.vercel.app/giris.html)"; flow:established,to_server; http.uri; content:"/giris.html"; startswith; fast_pattern; http.host; content:"toplukonut0054975248.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000298; classtype:social-engineering; sid:6000298; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.3vg.de/sfvds/)"; flow:established,to_server; http.uri; content:"/sfvds/"; startswith; fast_pattern; http.host; content:"www.3vg.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000299; classtype:social-engineering; sid:6000299; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.behbudlabs.com/Technical_Specification/docusign/Windows/utility.php/download/index.php/download/index.php)"; flow:established,to_server; http.uri; content:"/Technical_Specification/docusign/Windows/utility.php/download/index.php/download/index.php"; startswith; fast_pattern; http.host; content:"www.behbudlabs.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000300; classtype:social-engineering; sid:6000300; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enjoyvacationnow.net/pages/ebf1c435-ec5b-41b4-b8b7-ebb693f86d29/c0b28e53dee347f2722ca1860e067549ea7617841950c6c9c371c53d4ae83e51259ba2dad4d2ce056f72b37a522e00bd86986edf12f658bf7233feb908c4bc37)"; flow:established,to_server; http.uri; content:"/pages/ebf1c435-ec5b-41b4-b8b7-ebb693f86d29/c0b28e53dee347f2722ca1860e067549ea7617841950c6c9c371c53d4ae83e51259ba2dad4d2ce056f72b37a522e00bd86986edf12f658bf7233feb908c4bc37"; startswith; fast_pattern; http.host; content:"enjoyvacationnow.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000301; classtype:social-engineering; sid:6000301; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrv.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingrv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000302; classtype:social-engineering; sid:6000302; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hg8088.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hg8088.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000303; classtype:social-engineering; sid:6000303; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fly-the-skies.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fly-the-skies.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000304; classtype:social-engineering; sid:6000304; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bellnetca.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bellnetca.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000305; classtype:social-engineering; sid:6000305; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nh638720-cmd.github.io/facebook/)"; flow:established,to_server; http.uri; content:"/facebook/"; startswith; fast_pattern; http.host; content:"nh638720-cmd.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000306; classtype:social-engineering; sid:6000306; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whapptr4.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whapptr4.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000307; classtype:social-engineering; sid:6000307; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pmisdemo.socioon.com/pdf/pd/f/)"; flow:established,to_server; http.uri; content:"/pdf/pd/f/"; startswith; fast_pattern; http.host; content:"pmisdemo.socioon.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000308; classtype:social-engineering; sid:6000308; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrd.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingrd.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000309; classtype:social-engineering; sid:6000309; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1xlite-24510.bar/en/block?tag=d_224327m_45857c_%5B%5DMS%5B%5Dnull%5B%5Dnull%5B%5Dreg%5B%5D10853324_d28985_l259589_clickunder)"; flow:established,to_server; http.uri; content:"/en/block?tag=d_224327m_45857c_%5B%5DMS%5B%5Dnull%5B%5Dnull%5B%5Dreg%5B%5D10853324_d28985_l259589_clickunder"; startswith; fast_pattern; http.host; content:"1xlite-24510.bar"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000310; classtype:social-engineering; sid:6000310; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (50058c.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"50058c.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000311; classtype:social-engineering; sid:6000311; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pu.ihwlipc.com/best/indexs.html)"; flow:established,to_server; http.uri; content:"/best/indexs.html"; startswith; fast_pattern; http.host; content:"pu.ihwlipc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000312; classtype:social-engineering; sid:6000312; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.familydine.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.familydine.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000313; classtype:social-engineering; sid:6000313; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrc.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingrc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000314; classtype:social-engineering; sid:6000314; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingty.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingty.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000315; classtype:social-engineering; sid:6000315; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dao1-6em8.vercel.app/capcha.html)"; flow:established,to_server; http.uri; content:"/capcha.html"; startswith; fast_pattern; http.host; content:"dao1-6em8.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000316; classtype:social-engineering; sid:6000316; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ze-itens-24h.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ze-itens-24h.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000317; classtype:social-engineering; sid:6000317; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (juliaince.com/pierrepaulturgeon/multifamilyinvestingcanadaopendocaccess.html)"; flow:established,to_server; http.uri; content:"/pierrepaulturgeon/multifamilyinvestingcanadaopendocaccess.html"; startswith; fast_pattern; http.host; content:"juliaince.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000318; classtype:social-engineering; sid:6000318; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.desiaustralia.com/news/)"; flow:established,to_server; http.uri; content:"/news/"; startswith; fast_pattern; http.host; content:"www.desiaustralia.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000319; classtype:social-engineering; sid:6000319; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shivamyadav1031.github.io/Amazon-ECE-1)"; flow:established,to_server; http.uri; content:"/Amazon-ECE-1"; startswith; fast_pattern; http.host; content:"shivamyadav1031.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000320; classtype:social-engineering; sid:6000320; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docuflow-2br.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"docuflow-2br.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000321; classtype:social-engineering; sid:6000321; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faqs-auth-trzor-sso.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faqs-auth-trzor-sso.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000322; classtype:social-engineering; sid:6000322; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whapptr5.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whapptr5.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000323; classtype:social-engineering; sid:6000323; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (boafiles.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"boafiles.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000324; classtype:social-engineering; sid:6000324; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bigshopee597.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.bigshopee597.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000325; classtype:social-engineering; sid:6000325; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customeraccessmembershipmovie.65-98-5-17.cpanel.site/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"customeraccessmembershipmovie.65-98-5-17.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000326; classtype:social-engineering; sid:6000326; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (soulful-reflect-310128.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"soulful-reflect-310128.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000327; classtype:social-engineering; sid:6000327; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (golr3795-sudo.github.io/Soporte/)"; flow:established,to_server; http.uri; content:"/Soporte/"; startswith; fast_pattern; http.host; content:"golr3795-sudo.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000328; classtype:social-engineering; sid:6000328; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (victino2005.github.io/Netflix/)"; flow:established,to_server; http.uri; content:"/Netflix/"; startswith; fast_pattern; http.host; content:"victino2005.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000329; classtype:social-engineering; sid:6000329; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mahendradhang.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"mahendradhang.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000330; classtype:social-engineering; sid:6000330; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.myphone-app.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.myphone-app.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000331; classtype:social-engineering; sid:6000331; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flndmedevice.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"flndmedevice.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000332; classtype:social-engineering; sid:6000332; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paylap.uber.space/.uk/css/?token=)"; flow:established,to_server; http.uri; content:"/.uk/css/?token="; startswith; fast_pattern; http.host; content:"paylap.uber.space"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000333; classtype:social-engineering; sid:6000333; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cloud-lostdevice.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"cloud-lostdevice.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000334; classtype:social-engineering; sid:6000334; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingyz.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingyz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000335; classtype:social-engineering; sid:6000335; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myphone-app.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"myphone-app.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000336; classtype:social-engineering; sid:6000336; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloud-mapsphonehl.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"icloud-mapsphonehl.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000337; classtype:social-engineering; sid:6000337; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (livewalletsvalidationsync.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"livewalletsvalidationsync.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000338; classtype:social-engineering; sid:6000338; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.location-iclouds.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.location-iclouds.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000339; classtype:social-engineering; sid:6000339; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1-lcloud-l-com.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"1-lcloud-l-com.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000340; classtype:social-engineering; sid:6000340; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (devicelocate.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"devicelocate.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000341; classtype:social-engineering; sid:6000341; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365okvip2.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"365okvip2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000342; classtype:social-engineering; sid:6000342; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (memberunion04apr.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"memberunion04apr.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000343; classtype:social-engineering; sid:6000343; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.myfindphone.help/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.myfindphone.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000344; classtype:social-engineering; sid:6000344; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aanya900.github.io/Amazon-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-Clone"; startswith; fast_pattern; http.host; content:"aanya900.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000345; classtype:social-engineering; sid:6000345; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cccm.jsdaweb.my.id/dana/)"; flow:established,to_server; http.uri; content:"/dana/"; startswith; fast_pattern; http.host; content:"cccm.jsdaweb.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000346; classtype:social-engineering; sid:6000346; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.location-fmdl.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.location-fmdl.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000347; classtype:social-engineering; sid:6000347; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee-tbk888.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee-tbk888.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000348; classtype:social-engineering; sid:6000348; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (urlvanish.com/3ccce1a7)"; flow:established,to_server; http.uri; content:"/3ccce1a7"; startswith; fast_pattern; http.host; content:"urlvanish.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000349; classtype:social-engineering; sid:6000349; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (soporte-mapas.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"soporte-mapas.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000350; classtype:social-engineering; sid:6000350; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brantico.com/generator/amazongiftcard.html)"; flow:established,to_server; http.uri; content:"/generator/amazongiftcard.html"; startswith; fast_pattern; http.host; content:"brantico.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000351; classtype:social-engineering; sid:6000351; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (akash-b2005.github.io/static-clone-netflix/)"; flow:established,to_server; http.uri; content:"/static-clone-netflix/"; startswith; fast_pattern; http.host; content:"akash-b2005.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000352; classtype:social-engineering; sid:6000352; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mdkaif-eng.github.io/Spotify-clone)"; flow:established,to_server; http.uri; content:"/Spotify-clone"; startswith; fast_pattern; http.host; content:"mdkaif-eng.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000353; classtype:social-engineering; sid:6000353; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (detect-device.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"detect-device.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000354; classtype:social-engineering; sid:6000354; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ifindphonemy.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"ifindphonemy.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000355; classtype:social-engineering; sid:6000355; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreifgarbo26xb5vntfmedqcyosjpeqi4otz6lpk2g3mbvhdmovpb55m.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreifgarbo26xb5vntfmedqcyosjpeqi4otz6lpk2g3mbvhdmovpb55m.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000356; classtype:social-engineering; sid:6000356; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebooksuporteolaine.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebooksuporteolaine.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000357; classtype:social-engineering; sid:6000357; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abrahamjosephaykkaraa-ship-it.github.io/airbnb)"; flow:established,to_server; http.uri; content:"/airbnb"; startswith; fast_pattern; http.host; content:"abrahamjosephaykkaraa-ship-it.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000358; classtype:social-engineering; sid:6000358; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloud-myfind.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"icloud-myfind.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000359; classtype:social-engineering; sid:6000359; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.awzxfu.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.awzxfu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000360; classtype:social-engineering; sid:6000360; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sibaprasadsahu410-cpu.github.io/NETFLIX-CLONE/)"; flow:established,to_server; http.uri; content:"/NETFLIX-CLONE/"; startswith; fast_pattern; http.host; content:"sibaprasadsahu410-cpu.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000361; classtype:social-engineering; sid:6000361; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lomfi-lotra-biz-rentra-dokli-sp19ct3bur.pages.dev/heartily_welcome?welcome=1804942259817696&id=1804942259817696&page_name=Everman%20ISD/)"; flow:established,to_server; http.uri; content:"/heartily_welcome?welcome=1804942259817696&id=1804942259817696&page_name=Everman%20ISD/"; startswith; fast_pattern; http.host; content:"lomfi-lotra-biz-rentra-dokli-sp19ct3bur.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000362; classtype:social-engineering; sid:6000362; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deepak2006ez-ship-it.github.io/netflix-clone)"; flow:established,to_server; http.uri; content:"/netflix-clone"; startswith; fast_pattern; http.host; content:"deepak2006ez-ship-it.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000363; classtype:social-engineering; sid:6000363; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.findmy-supportjl.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.findmy-supportjl.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000364; classtype:social-engineering; sid:6000364; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (redirect.me/r/yhejge)"; flow:established,to_server; http.uri; content:"/r/yhejge"; startswith; fast_pattern; http.host; content:"redirect.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000365; classtype:social-engineering; sid:6000365; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xzpbmk.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.xzpbmk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000366; classtype:social-engineering; sid:6000366; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.mydevice-support.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.mydevice-support.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000367; classtype:social-engineering; sid:6000367; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danaa-iindonesiaa.ckk.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danaa-iindonesiaa.ckk.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000368; classtype:social-engineering; sid:6000368; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.serch-finds.life/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.serch-finds.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000369; classtype:social-engineering; sid:6000369; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mozdesign.com.br/454618e5/gmail/)"; flow:established,to_server; http.uri; content:"/454618e5/gmail/"; startswith; fast_pattern; http.host; content:"mozdesign.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000370; classtype:social-engineering; sid:6000370; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eniotrezor.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eniotrezor.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000371; classtype:social-engineering; sid:6000371; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-rescuedevice.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"support-rescuedevice.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000372; classtype:social-engineering; sid:6000372; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeejkt195.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopeejkt195.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000373; classtype:social-engineering; sid:6000373; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-iapple-lost.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"my-iapple-lost.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000374; classtype:social-engineering; sid:6000374; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apple-icloud.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"apple-icloud.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000375; classtype:social-engineering; sid:6000375; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ingeminandina.cl/mover/pages/login.php)"; flow:established,to_server; http.uri; content:"/mover/pages/login.php"; startswith; fast_pattern; http.host; content:"www.ingeminandina.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000376; classtype:social-engineering; sid:6000376; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xffinnittyy.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xffinnittyy.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000377; classtype:social-engineering; sid:6000377; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (consulta-oferta.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"consulta-oferta.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000378; classtype:social-engineering; sid:6000378; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en--start-tr-zor-cdn.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en--start-tr-zor-cdn.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000379; classtype:social-engineering; sid:6000379; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kuyzcoinlogin.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kuyzcoinlogin.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000380; classtype:social-engineering; sid:6000380; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (officia-jiangnan.com/?BoardBrief&SeoeuSHsnK/=)"; flow:established,to_server; http.uri; content:"/?BoardBrief&SeoeuSHsnK/="; startswith; fast_pattern; http.host; content:"officia-jiangnan.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000381; classtype:social-engineering; sid:6000381; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kavyaaggrawal27-cell.github.io/netflix.clone/)"; flow:established,to_server; http.uri; content:"/netflix.clone/"; startswith; fast_pattern; http.host; content:"kavyaaggrawal27-cell.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000382; classtype:social-engineering; sid:6000382; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qvubyk.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.qvubyk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000383; classtype:social-engineering; sid:6000383; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.findmy-mapslcp.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.findmy-mapslcp.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000384; classtype:social-engineering; sid:6000384; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m-facebookk.com.vn/mt7gh5euhec)"; flow:established,to_server; http.uri; content:"/mt7gh5euhec"; startswith; fast_pattern; http.host; content:"m-facebookk.com.vn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000385; classtype:social-engineering; sid:6000385; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (findmy-supportjl.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"findmy-supportjl.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000386; classtype:social-engineering; sid:6000386; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tight-butterfly-24b3.dcctavjjrwonaqe.workers.dev/facebook.com-1027275509)"; flow:established,to_server; http.uri; content:"/facebook.com-1027275509"; startswith; fast_pattern; http.host; content:"tight-butterfly-24b3.dcctavjjrwonaqe.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000387; classtype:social-engineering; sid:6000387; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (humorous-stack-874003.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"humorous-stack-874003.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000388; classtype:social-engineering; sid:6000388; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (encontrar-my-iphone.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"encontrar-my-iphone.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000389; classtype:social-engineering; sid:6000389; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (devices-ifind.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"devices-ifind.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000390; classtype:social-engineering; sid:6000390; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.soporte-mapas.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.soporte-mapas.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000391; classtype:social-engineering; sid:6000391; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (device-ifind.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"device-ifind.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000392; classtype:social-engineering; sid:6000392; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.icloud-localizado.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.icloud-localizado.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000393; classtype:social-engineering; sid:6000393; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.supportefind.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.supportefind.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000394; classtype:social-engineering; sid:6000394; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.1-lcloud-l-com.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.1-lcloud-l-com.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000395; classtype:social-engineering; sid:6000395; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (findmy-support1.com/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"findmy-support1.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000396; classtype:social-engineering; sid:6000396; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adityab9990.github.io/MicroSoft_store)"; flow:established,to_server; http.uri; content:"/MicroSoft_store"; startswith; fast_pattern; http.host; content:"adityab9990.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000397; classtype:social-engineering; sid:6000397; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.detect-device.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.detect-device.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000398; classtype:social-engineering; sid:6000398; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.icloud-mapsphonehl.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.icloud-mapsphonehl.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000399; classtype:social-engineering; sid:6000399; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spiky-days-709346.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spiky-days-709346.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000400; classtype:social-engineering; sid:6000400; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sawanpanchal.github.io/Netflix.co/)"; flow:established,to_server; http.uri; content:"/Netflix.co/"; startswith; fast_pattern; http.host; content:"sawanpanchal.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000401; classtype:social-engineering; sid:6000401; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pratham-matrix.github.io/Amazon-clone-site/)"; flow:established,to_server; http.uri; content:"/Amazon-clone-site/"; startswith; fast_pattern; http.host; content:"pratham-matrix.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000402; classtype:social-engineering; sid:6000402; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (satyam-v3.github.io/Netflix_clone/)"; flow:established,to_server; http.uri; content:"/Netflix_clone/"; startswith; fast_pattern; http.host; content:"satyam-v3.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000403; classtype:social-engineering; sid:6000403; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.support-locationjfls.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.support-locationjfls.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000404; classtype:social-engineering; sid:6000404; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiax55d5bmxagbpknmkwh72r33zxhddshkqwrxzpuljn3g365b2ohu.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiax55d5bmxagbpknmkwh72r33zxhddshkqwrxzpuljn3g365b2ohu.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000405; classtype:social-engineering; sid:6000405; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-icloudfinds.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"support-icloudfinds.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000406; classtype:social-engineering; sid:6000406; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.devices-ifind.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.devices-ifind.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000407; classtype:social-engineering; sid:6000407; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.jsupport-myclouds.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.jsupport-myclouds.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000408; classtype:social-engineering; sid:6000408; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (entreeprises-sg-fr.com/icdeweb/web/login.php/)"; flow:established,to_server; http.uri; content:"/icdeweb/web/login.php/"; startswith; fast_pattern; http.host; content:"entreeprises-sg-fr.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000409; classtype:social-engineering; sid:6000409; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lambruchona.com/-8d4NWe)"; flow:established,to_server; http.uri; content:"/-8d4NWe"; startswith; fast_pattern; http.host; content:"lambruchona.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000410; classtype:social-engineering; sid:6000410; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (encontrarmaps.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"encontrarmaps.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000411; classtype:social-engineering; sid:6000411; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (phone-mapslop.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"phone-mapslop.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000412; classtype:social-engineering; sid:6000412; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.serchphone7.life/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.serchphone7.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000413; classtype:social-engineering; sid:6000413; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-login-page-kappa.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-login-page-kappa.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000414; classtype:social-engineering; sid:6000414; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucoinwlogn.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kucoinwlogn.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000415; classtype:social-engineering; sid:6000415; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.cloud-lostdevice.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.cloud-lostdevice.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000416; classtype:social-engineering; sid:6000416; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingyl.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingyl.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000417; classtype:social-engineering; sid:6000417; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloud-longin.com/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"icloud-longin.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000418; classtype:social-engineering; sid:6000418; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (raorizwan-125.github.io/Facebook-login-page/)"; flow:established,to_server; http.uri; content:"/Facebook-login-page/"; startswith; fast_pattern; http.host; content:"raorizwan-125.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000419; classtype:social-engineering; sid:6000419; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee-tbk777.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee-tbk777.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000420; classtype:social-engineering; sid:6000420; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.encontratmiiphone.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.encontratmiiphone.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000421; classtype:social-engineering; sid:6000421; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arshtiwari940-collab.github.io/NetflixClone/)"; flow:established,to_server; http.uri; content:"/NetflixClone/"; startswith; fast_pattern; http.host; content:"arshtiwari940-collab.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000422; classtype:social-engineering; sid:6000422; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (idcloud-lost.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"idcloud-lost.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000423; classtype:social-engineering; sid:6000423; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apple-col.com/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"apple-col.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000424; classtype:social-engineering; sid:6000424; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (device-iphone.life/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"device-iphone.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000425; classtype:social-engineering; sid:6000425; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (locations-findmy.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"locations-findmy.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000426; classtype:social-engineering; sid:6000426; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (demolasthotmail.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"demolasthotmail.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000427; classtype:social-engineering; sid:6000427; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.idcloud-lost.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.idcloud-lost.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000428; classtype:social-engineering; sid:6000428; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (khushikushwaha826.github.io/KHUSHI-KUSHWAHA/)"; flow:established,to_server; http.uri; content:"/KHUSHI-KUSHWAHA/"; startswith; fast_pattern; http.host; content:"khushikushwaha826.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000429; classtype:social-engineering; sid:6000429; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (raj-hans-hub.github.io/netflix/)"; flow:established,to_server; http.uri; content:"/netflix/"; startswith; fast_pattern; http.host; content:"raj-hans-hub.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000430; classtype:social-engineering; sid:6000430; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (started-trezrio.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"started-trezrio.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000431; classtype:social-engineering; sid:6000431; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (securepdffile1.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"securepdffile1.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000432; classtype:social-engineering; sid:6000432; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fr-relay-tracking.com/en/login/)"; flow:established,to_server; http.uri; content:"/en/login/"; startswith; fast_pattern; http.host; content:"fr-relay-tracking.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000433; classtype:social-engineering; sid:6000433; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.long-icloud.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.long-icloud.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000434; classtype:social-engineering; sid:6000434; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (learn-trezrostart.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"learn-trezrostart.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000435; classtype:social-engineering; sid:6000435; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-locationjfls.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"support-locationjfls.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000436; classtype:social-engineering; sid:6000436; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.zkk.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.zkk.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000437; classtype:social-engineering; sid:6000437; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.apple-icloud.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.apple-icloud.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000438; classtype:social-engineering; sid:6000438; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.encontrar-my-iphone.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.encontrar-my-iphone.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000439; classtype:social-engineering; sid:6000439; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (serchphone7.life/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"serchphone7.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000440; classtype:social-engineering; sid:6000440; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sd.unep-city-rating.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sd.unep-city-rating.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000441; classtype:social-engineering; sid:6000441; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.my-iapple-lost.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.my-iapple-lost.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000442; classtype:social-engineering; sid:6000442; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.id-mycloud.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.id-mycloud.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000443; classtype:social-engineering; sid:6000443; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastwebma.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastwebma.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000444; classtype:social-engineering; sid:6000444; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail-pt-lu.github.io/webmail-todo-logout/)"; flow:established,to_server; http.uri; content:"/webmail-todo-logout/"; startswith; fast_pattern; http.host; content:"webmail-pt-lu.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000445; classtype:social-engineering; sid:6000445; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anas-spotify-clone.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"anas-spotify-clone.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000446; classtype:social-engineering; sid:6000446; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-login-page-kappa.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-login-page-kappa.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000447; classtype:social-engineering; sid:6000447; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.accounts-findmy.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.accounts-findmy.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000448; classtype:social-engineering; sid:6000448; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee-tbk888.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee-tbk888.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000449; classtype:social-engineering; sid:6000449; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spotifyclonefirst.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spotifyclonefirst.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000450; classtype:social-engineering; sid:6000450; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (melodious-manatee-c2a637.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"melodious-manatee-c2a637.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000451; classtype:social-engineering; sid:6000451; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flndme-com.info/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"flndme-com.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000452; classtype:social-engineering; sid:6000452; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.encontrarmaps.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.encontrarmaps.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000453; classtype:social-engineering; sid:6000453; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (infohadiahtbk299.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"infohadiahtbk299.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000454; classtype:social-engineering; sid:6000454; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mydevice-support.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mydevice-support.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000455; classtype:social-engineering; sid:6000455; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p9dtufdd67v.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p9dtufdd67v.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000456; classtype:social-engineering; sid:6000456; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (habeeiiyy.github.io/Netflix/)"; flow:established,to_server; http.uri; content:"/Netflix/"; startswith; fast_pattern; http.host; content:"habeeiiyy.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000457; classtype:social-engineering; sid:6000457; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (patrickmortensen986-star.github.io/roblox)"; flow:established,to_server; http.uri; content:"/roblox"; startswith; fast_pattern; http.host; content:"patrickmortensen986-star.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000458; classtype:social-engineering; sid:6000458; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (grumczak.github.io/Phishing/)"; flow:established,to_server; http.uri; content:"/Phishing/"; startswith; fast_pattern; http.host; content:"grumczak.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000459; classtype:social-engineering; sid:6000459; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kukoociinlogon.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kukoociinlogon.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000460; classtype:social-engineering; sid:6000460; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mycomcastnet.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mycomcastnet.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000461; classtype:social-engineering; sid:6000461; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (find-phone-location.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"find-phone-location.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000462; classtype:social-engineering; sid:6000462; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.www4-findmy-lostapple.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.www4-findmy-lostapple.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000463; classtype:social-engineering; sid:6000463; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cloud-trzors.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cloud-trzors.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000464; classtype:social-engineering; sid:6000464; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (serch-finds.life/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"serch-finds.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000465; classtype:social-engineering; sid:6000465; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeejkt195.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopeejkt195.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000466; classtype:social-engineering; sid:6000466; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (device-detect.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"device-detect.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000467; classtype:social-engineering; sid:6000467; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supportaccount-info.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"supportaccount-info.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000468; classtype:social-engineering; sid:6000468; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.idmyfindphone.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.idmyfindphone.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000469; classtype:social-engineering; sid:6000469; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dev-goswami.github.io/dev1Project/)"; flow:established,to_server; http.uri; content:"/dev1Project/"; startswith; fast_pattern; http.host; content:"dev-goswami.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000470; classtype:social-engineering; sid:6000470; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.supportscloud.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.supportscloud.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000471; classtype:social-engineering; sid:6000471; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.applefind.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.applefind.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000472; classtype:social-engineering; sid:6000472; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (leafleafy28-design.github.io/AMAZON-CLONE/)"; flow:established,to_server; http.uri; content:"/AMAZON-CLONE/"; startswith; fast_pattern; http.host; content:"leafleafy28-design.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000473; classtype:social-engineering; sid:6000473; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (encontratmiiphone.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"encontratmiiphone.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000474; classtype:social-engineering; sid:6000474; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.device-ifind.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.device-ifind.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000475; classtype:social-engineering; sid:6000475; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.supportaccount-info.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.supportaccount-info.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000476; classtype:social-engineering; sid:6000476; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crespaydnnslaterx.zxfrbg.web.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"crespaydnnslaterx.zxfrbg.web.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000477; classtype:social-engineering; sid:6000477; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (applefind.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"applefind.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000478; classtype:social-engineering; sid:6000478; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gingersnapsok.com/hx_R5FM)"; flow:established,to_server; http.uri; content:"/hx_R5FM"; startswith; fast_pattern; http.host; content:"gingersnapsok.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000479; classtype:social-engineering; sid:6000479; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.maps-icloudmy1.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.maps-icloudmy1.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000480; classtype:social-engineering; sid:6000480; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.find-phone-location.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.find-phone-location.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000481; classtype:social-engineering; sid:6000481; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (naaie.com/ap/signin)"; flow:established,to_server; http.uri; content:"/ap/signin"; startswith; fast_pattern; http.host; content:"naaie.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000482; classtype:social-engineering; sid:6000482; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rccghopehall.com/m/index.html)"; flow:established,to_server; http.uri; content:"/m/index.html"; startswith; fast_pattern; http.host; content:"rccghopehall.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000483; classtype:social-engineering; sid:6000483; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortprice.pics/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortprice.pics"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000484; classtype:social-engineering; sid:6000484; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kellylongbooks.com/m/index.html)"; flow:established,to_server; http.uri; content:"/m/index.html"; startswith; fast_pattern; http.host; content:"kellylongbooks.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000485; classtype:social-engineering; sid:6000485; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tjshar.github.io/PROJECT-Basic_Amazon_Clone/)"; flow:established,to_server; http.uri; content:"/PROJECT-Basic_Amazon_Clone/"; startswith; fast_pattern; http.host; content:"tjshar.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000486; classtype:social-engineering; sid:6000486; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi819.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"info-resmi819.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000487; classtype:social-engineering; sid:6000487; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.soporte-apple.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.soporte-apple.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000488; classtype:social-engineering; sid:6000488; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (muhammad-rehan126.github.io/Amazon-website)"; flow:established,to_server; http.uri; content:"/Amazon-website"; startswith; fast_pattern; http.host; content:"muhammad-rehan126.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000489; classtype:social-engineering; sid:6000489; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bybitget.com/bybit-meigu.html)"; flow:established,to_server; http.uri; content:"/bybit-meigu.html"; startswith; fast_pattern; http.host; content:"www.bybitget.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000490; classtype:social-engineering; sid:6000490; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.flndme-com.info/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.flndme-com.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000491; classtype:social-engineering; sid:6000491; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (soporte-apple.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"soporte-apple.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000492; classtype:social-engineering; sid:6000492; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shahmeerkhan0724-netizen.github.io/firebase/login.html)"; flow:established,to_server; http.uri; content:"/firebase/login.html"; startswith; fast_pattern; http.host; content:"shahmeerkhan0724-netizen.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000493; classtype:social-engineering; sid:6000493; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (location-iclouds.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"location-iclouds.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000494; classtype:social-engineering; sid:6000494; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hasnainmurtaza265.github.io/Amazone-clone)"; flow:established,to_server; http.uri; content:"/Amazone-clone"; startswith; fast_pattern; http.host; content:"hasnainmurtaza265.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000495; classtype:social-engineering; sid:6000495; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tiny-subtasks-309073.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tiny-subtasks-309073.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000496; classtype:social-engineering; sid:6000496; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kleinanzeigen.gerkaufde.icu/order/aJxbdNaMW400/?plg=catchme)"; flow:established,to_server; http.uri; content:"/order/aJxbdNaMW400/?plg=catchme"; startswith; fast_pattern; http.host; content:"kleinanzeigen.gerkaufde.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000497; classtype:social-engineering; sid:6000497; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (io-trzor-enghelp.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"io-trzor-enghelp.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000498; classtype:social-engineering; sid:6000498; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faq-starttrezrio.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faq-starttrezrio.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000499; classtype:social-engineering; sid:6000499; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (global-tracking-package.vercel.app/landing)"; flow:established,to_server; http.uri; content:"/landing"; startswith; fast_pattern; http.host; content:"global-tracking-package.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000500; classtype:social-engineering; sid:6000500; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (location-mapsflp.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"location-mapsflp.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000501; classtype:social-engineering; sid:6000501; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.locations-findmy.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.locations-findmy.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000502; classtype:social-engineering; sid:6000502; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.phone-mapslop.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.phone-mapslop.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000503; classtype:social-engineering; sid:6000503; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (praveen25-codes.github.io/responsive-amazon-clone)"; flow:established,to_server; http.uri; content:"/responsive-amazon-clone"; startswith; fast_pattern; http.host; content:"praveen25-codes.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000504; classtype:social-engineering; sid:6000504; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth-spectrum-net-login.framer.ai/?referer=urlvanish.com%2F3ccce1a7)"; flow:established,to_server; http.uri; content:"/?referer=urlvanish.com%2F3ccce1a7"; startswith; fast_pattern; http.host; content:"auth-spectrum-net-login.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000505; classtype:social-engineering; sid:6000505; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (workshops-glock18.shop/appdata/design/skin/balance/)"; flow:established,to_server; http.uri; content:"/appdata/design/skin/balance/"; startswith; fast_pattern; http.host; content:"workshops-glock18.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000506; classtype:social-engineering; sid:6000506; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.redhencrafts.com/m/index.html)"; flow:established,to_server; http.uri; content:"/m/index.html"; startswith; fast_pattern; http.host; content:"m.redhencrafts.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000507; classtype:social-engineering; sid:6000507; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.flndmedevice.us/ICL264)"; flow:established,to_server; http.uri; content:"/ICL264"; startswith; fast_pattern; http.host; content:"mail.flndmedevice.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000508; classtype:social-engineering; sid:6000508; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fgcdzu.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.fgcdzu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000509; classtype:social-engineering; sid:6000509; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.noah-scheurer.de/BradySandahl/)"; flow:established,to_server; http.uri; content:"/BradySandahl/"; startswith; fast_pattern; http.host; content:"www.noah-scheurer.de"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000510; classtype:social-engineering; sid:6000510; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ze-deliveryonline.vercel.app/funil)"; flow:established,to_server; http.uri; content:"/funil"; startswith; fast_pattern; http.host; content:"ze-deliveryonline.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000511; classtype:social-engineering; sid:6000511; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uivasortepremiacoes.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uivasortepremiacoes.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000512; classtype:social-engineering; sid:6000512; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (23.95.173.128/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"23.95.173.128"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000513; classtype:social-engineering; sid:6000513; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s-1s10hnb.s3.us-east-2.amazonaws.com/LogMeInResolve_Unattended.msi)"; flow:established,to_server; http.uri; content:"/LogMeInResolve_Unattended.msi"; startswith; fast_pattern; http.host; content:"s-1s10hnb.s3.us-east-2.amazonaws.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000514; classtype:social-engineering; sid:6000514; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (89465167.lat/ca-government-alberta)"; flow:established,to_server; http.uri; content:"/ca-government-alberta"; startswith; fast_pattern; http.host; content:"89465167.lat"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000515; classtype:social-engineering; sid:6000515; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seagateinternational.com/ftx/)"; flow:established,to_server; http.uri; content:"/ftx/"; startswith; fast_pattern; http.host; content:"seagateinternational.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000516; classtype:social-engineering; sid:6000516; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (odpsodo.biz/verification-bqp9b82dprek8ss1)"; flow:established,to_server; http.uri; content:"/verification-bqp9b82dprek8ss1"; startswith; fast_pattern; http.host; content:"odpsodo.biz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000517; classtype:social-engineering; sid:6000517; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (send-usdt-05.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"send-usdt-05.netlify.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000518; classtype:social-engineering; sid:6000518; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365haodeng.com/home)"; flow:established,to_server; http.uri; content:"/home"; startswith; fast_pattern; http.host; content:"www.365haodeng.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000519; classtype:social-engineering; sid:6000519; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fyliu.com/bsTzNCnR/)"; flow:established,to_server; http.uri; content:"/bsTzNCnR/"; startswith; fast_pattern; http.host; content:"fyliu.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000520; classtype:social-engineering; sid:6000520; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (104.21.54.96/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"104.21.54.96"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000521; classtype:social-engineering; sid:6000521; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (buddhaindustries.screenconnect.com/Bin/ScreenConnect.ClientSetup.msi)"; flow:established,to_server; http.uri; content:"/Bin/ScreenConnect.ClientSetup.msi"; startswith; fast_pattern; http.host; content:"buddhaindustries.screenconnect.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000522; classtype:social-engineering; sid:6000522; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (172.67.137.188/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"172.67.137.188"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000523; classtype:social-engineering; sid:6000523; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3cud-je09-uln1.accounting-coralridgetowerssouth-com-s-account.workers.dev/90886377e8e56786)"; flow:established,to_server; http.uri; content:"/90886377e8e56786"; startswith; fast_pattern; http.host; content:"3cud-je09-uln1.accounting-coralridgetowerssouth-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000524; classtype:social-engineering; sid:6000524; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mauliksisodia.github.io/Netflix-Clone-Project/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone-Project/"; startswith; fast_pattern; http.host; content:"mauliksisodia.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000525; classtype:social-engineering; sid:6000525; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sikandarmaurya.github.io/Netflix/)"; flow:established,to_server; http.uri; content:"/Netflix/"; startswith; fast_pattern; http.host; content:"sikandarmaurya.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000526; classtype:social-engineering; sid:6000526; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (beratozer34.github.io/instagram/)"; flow:established,to_server; http.uri; content:"/instagram/"; startswith; fast_pattern; http.host; content:"beratozer34.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000527; classtype:social-engineering; sid:6000527; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (joshi7890-creator.github.io/amazonclone/)"; flow:established,to_server; http.uri; content:"/amazonclone/"; startswith; fast_pattern; http.host; content:"joshi7890-creator.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000528; classtype:social-engineering; sid:6000528; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.aumentatucupbancol.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.aumentatucupbancol.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000529; classtype:social-engineering; sid:6000529; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mall.fadostore.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mall.fadostore.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000530; classtype:social-engineering; sid:6000530; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (itskelvinking1-cell.github.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"itskelvinking1-cell.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000531; classtype:social-engineering; sid:6000531; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.b3520.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.b3520.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000532; classtype:social-engineering; sid:6000532; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (confirmationportal.com/28e15578-07cb-4487-8a93-db005a781f64/a/850dd652-420c-4a90-98ec-4b86aa56d3ed/ccp?lid=ee68c3bb-830a-4a2f-87cf-c7022382654c)"; flow:established,to_server; http.uri; content:"/28e15578-07cb-4487-8a93-db005a781f64/a/850dd652-420c-4a90-98ec-4b86aa56d3ed/ccp?lid=ee68c3bb-830a-4a2f-87cf-c7022382654c"; startswith; fast_pattern; http.host; content:"confirmationportal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000533; classtype:social-engineering; sid:6000533; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwwmaxski.top/4G)"; flow:established,to_server; http.uri; content:"/4G"; startswith; fast_pattern; http.host; content:"wwwmaxski.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000534; classtype:social-engineering; sid:6000534; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wrio021.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wrio021.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000535; classtype:social-engineering; sid:6000535; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.barwatson.com/newpo/login.php)"; flow:established,to_server; http.uri; content:"/newpo/login.php"; startswith; fast_pattern; http.host; content:"www.barwatson.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000536; classtype:social-engineering; sid:6000536; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (humorous-zebra-189284.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"humorous-zebra-189284.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000537; classtype:social-engineering; sid:6000537; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pickup-track.info/pages/ban.php)"; flow:established,to_server; http.uri; content:"/pages/ban.php"; startswith; fast_pattern; http.host; content:"pickup-track.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000538; classtype:social-engineering; sid:6000538; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (movie-watching-platform.netlify.app/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"movie-watching-platform.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000539; classtype:social-engineering; sid:6000539; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shiwang11.github.io/AMAZON.github.io/)"; flow:established,to_server; http.uri; content:"/AMAZON.github.io/"; startswith; fast_pattern; http.host; content:"shiwang11.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000540; classtype:social-engineering; sid:6000540; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ynlendirdstmkrkmayav.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ynlendirdstmkrkmayav.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000541; classtype:social-engineering; sid:6000541; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hawkfs.icu/snx/pr/)"; flow:established,to_server; http.uri; content:"/snx/pr/"; startswith; fast_pattern; http.host; content:"hawkfs.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000542; classtype:social-engineering; sid:6000542; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (springboardpools.com/wp-content/McCarthy_Holdings_Inc)"; flow:established,to_server; http.uri; content:"/wp-content/McCarthy_Holdings_Inc"; startswith; fast_pattern; http.host; content:"springboardpools.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000543; classtype:social-engineering; sid:6000543; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (neha-0858.github.io/final-first-year-project)"; flow:established,to_server; http.uri; content:"/final-first-year-project"; startswith; fast_pattern; http.host; content:"neha-0858.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000544; classtype:social-engineering; sid:6000544; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sslink.one/uo8m0Y?k=108ce071693577f7)"; flow:established,to_server; http.uri; content:"/uo8m0Y?k=108ce071693577f7"; startswith; fast_pattern; http.host; content:"sslink.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000545; classtype:social-engineering; sid:6000545; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deft-melomakarona-39ea10.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"deft-melomakarona-39ea10.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000546; classtype:social-engineering; sid:6000546; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trc20z.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trc20z.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000547; classtype:social-engineering; sid:6000547; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bry.hpj.mybluehost.me/wp-includes/NwKorea.html)"; flow:established,to_server; http.uri; content:"/wp-includes/NwKorea.html"; startswith; fast_pattern; http.host; content:"bry.hpj.mybluehost.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000548; classtype:social-engineering; sid:6000548; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dienst-k.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dienst-k.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000549; classtype:social-engineering; sid:6000549; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-yo3crc8m9.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-yo3crc8m9.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000550; classtype:social-engineering; sid:6000550; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verificarcuentae2026kkks.fwh.is/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"verificarcuentae2026kkks.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000551; classtype:social-engineering; sid:6000551; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qarzdeals.com/steve/netflix)"; flow:established,to_server; http.uri; content:"/steve/netflix"; startswith; fast_pattern; http.host; content:"qarzdeals.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000552; classtype:social-engineering; sid:6000552; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wrio012.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wrio012.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000553; classtype:social-engineering; sid:6000553; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yte-kurds.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yte-kurds.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000554; classtype:social-engineering; sid:6000554; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tezway.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tezway.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000555; classtype:social-engineering; sid:6000555; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.by22271.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.by22271.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000556; classtype:social-engineering; sid:6000556; rev:1; metadata: signature_severity Major, created_et 2026_06_23, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (103.23.172.117/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"103.23.172.117"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000557; classtype:social-engineering; sid:6000557; rev:1; metadata: signature_severity Major, created_et 2026_07_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (104.21.49.195/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"104.21.49.195"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000558; classtype:social-engineering; sid:6000558; rev:1; metadata: signature_severity Major, created_et 2026_07_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (172.67.166.149/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"172.67.166.149"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000559; classtype:social-engineering; sid:6000559; rev:1; metadata: signature_severity Major, created_et 2026_07_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (modfj.info/160042)"; flow:established,to_server; http.uri; content:"/160042"; startswith; fast_pattern; http.host; content:"modfj.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000560; classtype:social-engineering; sid:6000560; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2nd2n.com/wp-admin/ams/mxo.html)"; flow:established,to_server; http.uri; content:"/wp-admin/ams/mxo.html"; startswith; fast_pattern; http.host; content:"2nd2n.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000561; classtype:social-engineering; sid:6000561; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (biahjaimosteamworkspace.myclickfunnels.com/bahouch)"; flow:established,to_server; http.uri; content:"/bahouch"; startswith; fast_pattern; http.host; content:"biahjaimosteamworkspace.myclickfunnels.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000562; classtype:social-engineering; sid:6000562; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.designskou.com/msxlmr/turnstile-check)"; flow:established,to_server; http.uri; content:"/msxlmr/turnstile-check"; startswith; fast_pattern; http.host; content:"www.designskou.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000563; classtype:social-engineering; sid:6000563; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chobanlokan.com/1.php)"; flow:established,to_server; http.uri; content:"/1.php"; startswith; fast_pattern; http.host; content:"chobanlokan.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000564; classtype:social-engineering; sid:6000564; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (antiguaweb.lumartic.com/wp-includes/PHPMailer/php/ghytestopp/index.php)"; flow:established,to_server; http.uri; content:"/wp-includes/PHPMailer/php/ghytestopp/index.php"; startswith; fast_pattern; http.host; content:"antiguaweb.lumartic.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000565; classtype:social-engineering; sid:6000565; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gswlrc.com/?94Zqshjv4JqAKPvre0M0ml21)"; flow:established,to_server; http.uri; content:"/?94Zqshjv4JqAKPvre0M0ml21"; startswith; fast_pattern; http.host; content:"www.gswlrc.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000566; classtype:social-engineering; sid:6000566; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.pl-oferta04842855.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.pl-oferta04842855.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000567; classtype:social-engineering; sid:6000567; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (safra.gerenciamentoempresas.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"safra.gerenciamentoempresas.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000568; classtype:social-engineering; sid:6000568; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bigshopee24.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bigshopee24.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000569; classtype:social-engineering; sid:6000569; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iphone.map-location.ru.com/sYs)"; flow:established,to_server; http.uri; content:"/sYs"; startswith; fast_pattern; http.host; content:"iphone.map-location.ru.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000570; classtype:social-engineering; sid:6000570; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lavanya-jalla.github.io/-Netflixclone/)"; flow:established,to_server; http.uri; content:"/-Netflixclone/"; startswith; fast_pattern; http.host; content:"lavanya-jalla.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000571; classtype:social-engineering; sid:6000571; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (encontrar-mapsdfksl.info/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"encontrar-mapsdfksl.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000572; classtype:social-engineering; sid:6000572; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.moonpay-commerce-git-feat-com2-2323-manual-crypto-send-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.moonpay-commerce-git-feat-com2-2323-manual-crypto-send-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000573; classtype:social-engineering; sid:6000573; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (10thys5jkoo3.swjaxonfivs.xyz/FhvjM2zXMkEATKpf6tUI)"; flow:established,to_server; http.uri; content:"/FhvjM2zXMkEATKpf6tUI"; startswith; fast_pattern; http.host; content:"10thys5jkoo3.swjaxonfivs.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000574; classtype:social-engineering; sid:6000574; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (personasenlinea.eu/logon/)"; flow:established,to_server; http.uri; content:"/logon/"; startswith; fast_pattern; http.host; content:"personasenlinea.eu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000575; classtype:social-engineering; sid:6000575; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsappbrnoticias.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsappbrnoticias.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000576; classtype:social-engineering; sid:6000576; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1f-icloud.com/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"1f-icloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000577; classtype:social-engineering; sid:6000577; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cool-concha-3432a2.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cool-concha-3432a2.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000578; classtype:social-engineering; sid:6000578; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (riyasanodariya777.github.io/Spotify-clone-project)"; flow:established,to_server; http.uri; content:"/Spotify-clone-project"; startswith; fast_pattern; http.host; content:"riyasanodariya777.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000579; classtype:social-engineering; sid:6000579; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-lemon.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-lemon.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000580; classtype:social-engineering; sid:6000580; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct-lunor-biz8-kemar-vosil.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct-lunor-biz8-kemar-vosil.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000581; classtype:social-engineering; sid:6000581; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (persiasysco.ir/post/post/en.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=dHV5ZXR2dEBzYWlnb25uZXdwb3J0LmNvbS52bg==&.rand=13InboxLight.aspx?n=1774256418&fid=4)"; flow:established,to_server; http.uri; content:"/post/post/en.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=dHV5ZXR2dEBzYWlnb25uZXdwb3J0LmNvbS52bg==&.rand=13InboxLight.aspx?n=1774256418&fid=4"; startswith; fast_pattern; http.host; content:"persiasysco.ir"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000582; classtype:social-engineering; sid:6000582; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (raiffiesen.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"raiffiesen.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000583; classtype:social-engineering; sid:6000583; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.maps-findme.us/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.maps-findme.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000584; classtype:social-engineering; sid:6000584; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-palmurex-biz8-korel-dafix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-palmurex-biz8-korel-dafix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000585; classtype:social-engineering; sid:6000585; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (website-info.biz.id/4a.lol/Formulir-pembatalan-dan-pengajuan-paylater)"; flow:established,to_server; http.uri; content:"/4a.lol/Formulir-pembatalan-dan-pengajuan-paylater"; startswith; fast_pattern; http.host; content:"website-info.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000586; classtype:social-engineering; sid:6000586; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (standard-bank-limited-group.onrender.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"standard-bank-limited-group.onrender.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000587; classtype:social-engineering; sid:6000587; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gemiinilugennn.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gemiinilugennn.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000588; classtype:social-engineering; sid:6000588; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xf.aafwzq.com/fogmaster/fogmaster.html)"; flow:established,to_server; http.uri; content:"/fogmaster/fogmaster.html"; startswith; fast_pattern; http.host; content:"xf.aafwzq.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000589; classtype:social-engineering; sid:6000589; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (french75apparel.com/Xc/diff.html)"; flow:established,to_server; http.uri; content:"/Xc/diff.html"; startswith; fast_pattern; http.host; content:"french75apparel.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000590; classtype:social-engineering; sid:6000590; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (avantikacodes30.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"avantikacodes30.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000591; classtype:social-engineering; sid:6000591; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (calm-kataifi-c7f44b.netlify.app/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"calm-kataifi-c7f44b.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000592; classtype:social-engineering; sid:6000592; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aramex.com-ftlqv.life/a)"; flow:established,to_server; http.uri; content:"/a"; startswith; fast_pattern; http.host; content:"aramex.com-ftlqv.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000593; classtype:social-engineering; sid:6000593; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lokeshmalik404.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"lokeshmalik404.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000594; classtype:social-engineering; sid:6000594; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebookk.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebookk.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000595; classtype:social-engineering; sid:6000595; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ldzr-strt.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ldzr-strt.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000596; classtype:social-engineering; sid:6000596; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (harmonious-crisp-7a7de0.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"harmonious-crisp-7a7de0.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000597; classtype:social-engineering; sid:6000597; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (disc0rdl0gin.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"disc0rdl0gin.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000598; classtype:social-engineering; sid:6000598; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (samirzz.github.io/facebook_clone/)"; flow:established,to_server; http.uri; content:"/facebook_clone/"; startswith; fast_pattern; http.host; content:"samirzz.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000599; classtype:social-engineering; sid:6000599; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fbmetammku-fbcasefb433096.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fbmetammku-fbcasefb433096.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000600; classtype:social-engineering; sid:6000600; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shivani2k5.github.io/Netflix-Clone)"; flow:established,to_server; http.uri; content:"/Netflix-Clone"; startswith; fast_pattern; http.host; content:"shivani2k5.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000601; classtype:social-engineering; sid:6000601; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook.de-vitrine.be/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook.de-vitrine.be"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000602; classtype:social-engineering; sid:6000602; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.actualiza.great-site.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.actualiza.great-site.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000603; classtype:social-engineering; sid:6000603; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (farmanafri.github.io/NetfliX-Website--------Date-30-07-2026/)"; flow:established,to_server; http.uri; content:"/NetfliX-Website--------Date-30-07-2026/"; startswith; fast_pattern; http.host; content:"farmanafri.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000604; classtype:social-engineering; sid:6000604; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agenciatributariaoopd.eu.cc/es)"; flow:established,to_server; http.uri; content:"/es"; startswith; fast_pattern; http.host; content:"agenciatributariaoopd.eu.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000605; classtype:social-engineering; sid:6000605; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.meta8a31-noticefb344166.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.meta8a31-noticefb344166.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000606; classtype:social-engineering; sid:6000606; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shraddhaacharya777.github.io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"shraddhaacharya777.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000607; classtype:social-engineering; sid:6000607; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bridge-terezar-us.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bridge-terezar-us.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000608; classtype:social-engineering; sid:6000608; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-1jap5gmnw-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-1jap5gmnw-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000609; classtype:social-engineering; sid:6000609; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gkjpmcbocb1myc0wejoemucm1owhrc5q09yjvcsf4-h28s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gkjpmcbocb1myc0wejoemucm1owhrc5q09yjvcsf4-h28s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000610; classtype:social-engineering; sid:6000610; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hgf-vfdw.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hgf-vfdw.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000611; classtype:social-engineering; sid:6000611; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telbell.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telbell.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000612; classtype:social-engineering; sid:6000612; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zesty-phoenix-4e802f.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zesty-phoenix-4e802f.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000613; classtype:social-engineering; sid:6000613; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-corvurin-biz8-lurem-kasix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-corvurin-biz8-lurem-kasix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000614; classtype:social-engineering; sid:6000614; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rittikbanerjee.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"rittikbanerjee.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000615; classtype:social-engineering; sid:6000615; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bdo-ip.com/ph)"; flow:established,to_server; http.uri; content:"/ph"; startswith; fast_pattern; http.host; content:"bdo-ip.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000616; classtype:social-engineering; sid:6000616; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (baddiehub.com.co/~netcentrixco/intesasanpaolo/login-page.html)"; flow:established,to_server; http.uri; content:"/~netcentrixco/intesasanpaolo/login-page.html"; startswith; fast_pattern; http.host; content:"baddiehub.com.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000617; classtype:social-engineering; sid:6000617; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rococo-sable-86b95a.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rococo-sable-86b95a.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000618; classtype:social-engineering; sid:6000618; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jdbp606-cq9.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jdbp606-cq9.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000619; classtype:social-engineering; sid:6000619; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mydevicemaps.site/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mydevicemaps.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000620; classtype:social-engineering; sid:6000620; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cp686951.tw1.ru/WAF/waf-challenge.php)"; flow:established,to_server; http.uri; content:"/WAF/waf-challenge.php"; startswith; fast_pattern; http.host; content:"cp686951.tw1.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000621; classtype:social-engineering; sid:6000621; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledagrrwwltte.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledagrrwwltte.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000622; classtype:social-engineering; sid:6000622; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-git-feat-com2-2319-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-git-feat-com2-2319-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000623; classtype:social-engineering; sid:6000623; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gizzimeramz.strangled.net/ap/signin?c_ds_na=Ku5X47XB2XxxTNlIAg0ASuE8jvhIgkcbORweOZEsAT&c_ds_no=%2A%2F%2A)"; flow:established,to_server; http.uri; content:"/ap/signin?c_ds_na=Ku5X47XB2XxxTNlIAg0ASuE8jvhIgkcbORweOZEsAT&c_ds_no=%2A%2F%2A"; startswith; fast_pattern; http.host; content:"gizzimeramz.strangled.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000624; classtype:social-engineering; sid:6000624; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.support-icloudmyjhhs.info/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.support-icloudmyjhhs.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000625; classtype:social-engineering; sid:6000625; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cyan-ice-675590.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cyan-ice-675590.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000626; classtype:social-engineering; sid:6000626; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-f9a9gwoyq-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-f9a9gwoyq-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000627; classtype:social-engineering; sid:6000627; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook1019key.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"facebook1019key.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000628; classtype:social-engineering; sid:6000628; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (158-158-1-61.cprapid.com/pl/update.php)"; flow:established,to_server; http.uri; content:"/pl/update.php"; startswith; fast_pattern; http.host; content:"158-158-1-61.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000629; classtype:social-engineering; sid:6000629; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (macshix.us.cc/5g/home.html)"; flow:established,to_server; http.uri; content:"/5g/home.html"; startswith; fast_pattern; http.host; content:"macshix.us.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000630; classtype:social-engineering; sid:6000630; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kconnlogoc.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kconnlogoc.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000631; classtype:social-engineering; sid:6000631; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.accountsupport-info.us/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.accountsupport-info.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000632; classtype:social-engineering; sid:6000632; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-page-builder--stevedentltds.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-page-builder--stevedentltds.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000633; classtype:social-engineering; sid:6000633; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct-lovek-biz8-hurem-farix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct-lovek-biz8-hurem-farix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000634; classtype:social-engineering; sid:6000634; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (asfmvcxk.eu.cc/es)"; flow:established,to_server; http.uri; content:"/es"; startswith; fast_pattern; http.host; content:"asfmvcxk.eu.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000635; classtype:social-engineering; sid:6000635; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-kelmorin-biz8-zorex-falun.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-kelmorin-biz8-zorex-falun.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000636; classtype:social-engineering; sid:6000636; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (systemallianceinnovation.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"systemallianceinnovation.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000637; classtype:social-engineering; sid:6000637; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-git-henryharris-com2-2322-light-e25621-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-git-henryharris-com2-2322-light-e25621-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000638; classtype:social-engineering; sid:6000638; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jolly-fairy-3a8904.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jolly-fairy-3a8904.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000639; classtype:social-engineering; sid:6000639; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (frolicking-cannoli-62ddbc.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"frolicking-cannoli-62ddbc.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000640; classtype:social-engineering; sid:6000640; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebookahla.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebookahla.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000641; classtype:social-engineering; sid:6000641; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (phone-locateshgkln.info/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"phone-locateshgkln.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000642; classtype:social-engineering; sid:6000642; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.metacase314490-fbm96q.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.metacase314490-fbm96q.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000643; classtype:social-engineering; sid:6000643; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fbmetad7kp-fbcasefb625781.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fbmetad7kp-fbcasefb625781.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000644; classtype:social-engineering; sid:6000644; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-page-builder--leahgreene806a3.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-page-builder--leahgreene806a3.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000645; classtype:social-engineering; sid:6000645; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (set-ledger-live.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"set-ledger-live.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000646; classtype:social-engineering; sid:6000646; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagramsnp.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"instagramsnp.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000647; classtype:social-engineering; sid:6000647; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cryptofinal-nine.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cryptofinal-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000648; classtype:social-engineering; sid:6000648; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4ww-umb.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4ww-umb.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000649; classtype:social-engineering; sid:6000649; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.lost-devices.online/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.lost-devices.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000650; classtype:social-engineering; sid:6000650; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nooruz.net/808/)"; flow:established,to_server; http.uri; content:"/808/"; startswith; fast_pattern; http.host; content:"nooruz.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000651; classtype:social-engineering; sid:6000651; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8v6786v8.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8v6786v8.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000652; classtype:social-engineering; sid:6000652; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uaeuptodate.com/wp/domain.html)"; flow:established,to_server; http.uri; content:"/wp/domain.html"; startswith; fast_pattern; http.host; content:"uaeuptodate.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000653; classtype:social-engineering; sid:6000653; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (muhammedfirooz77-stack.github.io/Spotify-clone/)"; flow:established,to_server; http.uri; content:"/Spotify-clone/"; startswith; fast_pattern; http.host; content:"muhammedfirooz77-stack.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000654; classtype:social-engineering; sid:6000654; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-r5fqezbru-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-r5fqezbru-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000655; classtype:social-engineering; sid:6000655; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (quiet-tulip-244862.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"quiet-tulip-244862.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000656; classtype:social-engineering; sid:6000656; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aramex.com-dqkof.life/a)"; flow:established,to_server; http.uri; content:"/a"; startswith; fast_pattern; http.host; content:"aramex.com-dqkof.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000657; classtype:social-engineering; sid:6000657; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fbmeta6ewb-fbcasefb392979.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fbmeta6ewb-fbcasefb392979.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000658; classtype:social-engineering; sid:6000658; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflixl.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflixl.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000659; classtype:social-engineering; sid:6000659; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitymaiilaccount.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitymaiilaccount.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000660; classtype:social-engineering; sid:6000660; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adventurous-phone-453873.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"adventurous-phone-453873.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000661; classtype:social-engineering; sid:6000661; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.moonpay-commerce-git-henryharris-com2-2322-light-e25621-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.moonpay-commerce-git-henryharris-com2-2322-light-e25621-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000662; classtype:social-engineering; sid:6000662; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7wn6ms-tusx-5dku-9t0y-ltxj10.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7wn6ms-tusx-5dku-9t0y-ltxj10.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000663; classtype:social-engineering; sid:6000663; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metacase628892-fb5vu7.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metacase628892-fb5vu7.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000664; classtype:social-engineering; sid:6000664; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (magnificent-arithmetic-3b7216.netlify.app/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"magnificent-arithmetic-3b7216.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000665; classtype:social-engineering; sid:6000665; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-icloudmyjhhs.info/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"support-icloudmyjhhs.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000666; classtype:social-engineering; sid:6000666; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danaapayllteridz.lucior.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danaapayllteridz.lucior.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000667; classtype:social-engineering; sid:6000667; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (31k-ozd-pyiu1-3hf43-ldkz15.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"31k-ozd-pyiu1-3hf43-ldkz15.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000668; classtype:social-engineering; sid:6000668; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agenciatributariaoopa.eu.cc/es)"; flow:established,to_server; http.uri; content:"/es"; startswith; fast_pattern; http.host; content:"agenciatributariaoopa.eu.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000669; classtype:social-engineering; sid:6000669; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fairuzfaiyaz.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"fairuzfaiyaz.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000670; classtype:social-engineering; sid:6000670; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-git-feat-com2-1450-com2-1448-de-7eae46-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-git-feat-com2-1450-com2-1448-de-7eae46-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000671; classtype:social-engineering; sid:6000671; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wajihashafiq24.github.io/amazone-website-clone)"; flow:established,to_server; http.uri; content:"/amazone-website-clone"; startswith; fast_pattern; http.host; content:"wajihashafiq24.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000672; classtype:social-engineering; sid:6000672; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (endearing-starship-3f3aa4.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"endearing-starship-3f3aa4.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000673; classtype:social-engineering; sid:6000673; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.msg-whatapp.hk.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.msg-whatapp.hk.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000674; classtype:social-engineering; sid:6000674; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lost-devices.online/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"lost-devices.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000675; classtype:social-engineering; sid:6000675; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (codwithlov.github.io/booking-user)"; flow:established,to_server; http.uri; content:"/booking-user"; startswith; fast_pattern; http.host; content:"codwithlov.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000676; classtype:social-engineering; sid:6000676; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (65.jj38336.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"65.jj38336.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000677; classtype:social-engineering; sid:6000677; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ntfclon.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ntfclon.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000678; classtype:social-engineering; sid:6000678; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (didishort.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"didishort.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000679; classtype:social-engineering; sid:6000679; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coenbzaisecolagihfg.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coenbzaisecolagihfg.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000680; classtype:social-engineering; sid:6000680; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (afj5-qi87-u2kv.saras-burnabynh-ca-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"afj5-qi87-u2kv.saras-burnabynh-ca-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000681; classtype:social-engineering; sid:6000681; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.metacase027126-fbo84p.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.metacase027126-fbo84p.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000682; classtype:social-engineering; sid:6000682; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nupurchoudhary21.github.io/netflix-website-clone/)"; flow:established,to_server; http.uri; content:"/netflix-website-clone/"; startswith; fast_pattern; http.host; content:"nupurchoudhary21.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000683; classtype:social-engineering; sid:6000683; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1oblox.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1oblox.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000684; classtype:social-engineering; sid:6000684; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (studioixografiseon.gr/ok/)"; flow:established,to_server; http.uri; content:"/ok/"; startswith; fast_pattern; http.host; content:"studioixografiseon.gr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000685; classtype:social-engineering; sid:6000685; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (berqumi-gld-lormeta-a2x5hk83.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"berqumi-gld-lormeta-a2x5hk83.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000686; classtype:social-engineering; sid:6000686; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robloxcondos.my.id/sppnp5)"; flow:established,to_server; http.uri; content:"/sppnp5"; startswith; fast_pattern; http.host; content:"robloxcondos.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000687; classtype:social-engineering; sid:6000687; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.moonpay-commerce-git-feat-com2-2321-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.moonpay-commerce-git-feat-com2-2321-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000688; classtype:social-engineering; sid:6000688; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ksjkhgjunomailjkdgvbjkg26.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ksjkhgjunomailjkdgvbjkg26.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000689; classtype:social-engineering; sid:6000689; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (talaria.eu.com/~netcentrixco/intesasanpaolo/login-page.html)"; flow:established,to_server; http.uri; content:"/~netcentrixco/intesasanpaolo/login-page.html"; startswith; fast_pattern; http.host; content:"talaria.eu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000690; classtype:social-engineering; sid:6000690; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xelquna-gld-belxora-c9x2fq47.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xelquna-gld-belxora-c9x2fq47.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000691; classtype:social-engineering; sid:6000691; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t82a.top/m/)"; flow:established,to_server; http.uri; content:"/m/"; startswith; fast_pattern; http.host; content:"t82a.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000692; classtype:social-engineering; sid:6000692; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netfliclonebyrohit.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netfliclonebyrohit.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000693; classtype:social-engineering; sid:6000693; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wjnhf16m-blpqr82zfnr-3e9a-lxp51k.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wjnhf16m-blpqr82zfnr-3e9a-lxp51k.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000694; classtype:social-engineering; sid:6000694; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mercadolibre.com.uy/gz/account-verification?go=https%3A%2F%2Fwww.mercadolibre.com.uy%2Fp%2FMLU36443739%2F&tid=638a89fc-be84-448d-99f5-2cc2ac3c16e8)"; flow:established,to_server; http.uri; content:"/gz/account-verification?go=https%3A%2F%2Fwww.mercadolibre.com.uy%2Fp%2FMLU36443739%2F&tid=638a89fc-be84-448d-99f5-2cc2ac3c16e8"; startswith; fast_pattern; http.host; content:"www.mercadolibre.com.uy"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000695; classtype:social-engineering; sid:6000695; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.earn-cash.click/plans/)"; flow:established,to_server; http.uri; content:"/plans/"; startswith; fast_pattern; http.host; content:"www.earn-cash.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000696; classtype:social-engineering; sid:6000696; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docs-io-bridge-doc-pagee.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"docs-io-bridge-doc-pagee.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000697; classtype:social-engineering; sid:6000697; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accountsupport-info.us/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"accountsupport-info.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000698; classtype:social-engineering; sid:6000698; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (talktalknetwor.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"talktalknetwor.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000699; classtype:social-engineering; sid:6000699; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mydevicesfind.site/FL26)"; flow:established,to_server; http.uri; content:"/FL26"; startswith; fast_pattern; http.host; content:"mydevicesfind.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000700; classtype:social-engineering; sid:6000700; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vidhiparmar28.github.io/Amazon-Website-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-Website-Clone"; startswith; fast_pattern; http.host; content:"vidhiparmar28.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000701; classtype:social-engineering; sid:6000701; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (peaceful-copy-420603.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"peaceful-copy-420603.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000702; classtype:social-engineering; sid:6000702; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coderr-ecru.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coderr-ecru.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000703; classtype:social-engineering; sid:6000703; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflixpaymentportal.credit/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflixpaymentportal.credit"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000704; classtype:social-engineering; sid:6000704; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsappzoeiras.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsappzoeiras.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000705; classtype:social-engineering; sid:6000705; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (65.jj38390.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"65.jj38390.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000706; classtype:social-engineering; sid:6000706; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bz.jemuyba.net/kkddf/page/)"; flow:established,to_server; http.uri; content:"/kkddf/page/"; startswith; fast_pattern; http.host; content:"bz.jemuyba.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000707; classtype:social-engineering; sid:6000707; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.moonpay-commerce-git-feat-com2-2319-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.moonpay-commerce-git-feat-com2-2319-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000708; classtype:social-engineering; sid:6000708; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fbmetaporc-fbcasefb214792.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fbmetaporc-fbcasefb214792.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000709; classtype:social-engineering; sid:6000709; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.1f-icloud.com/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.1f-icloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000710; classtype:social-engineering; sid:6000710; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aneeqbaba.github.io/demowebsite)"; flow:established,to_server; http.uri; content:"/demowebsite"; startswith; fast_pattern; http.host; content:"aneeqbaba.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000711; classtype:social-engineering; sid:6000711; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.padisahbet-guncel-giris1.cam/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.padisahbet-guncel-giris1.cam"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000712; classtype:social-engineering; sid:6000712; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dynamicfacebook.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"dynamicfacebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000713; classtype:social-engineering; sid:6000713; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qernavi-gld-lormita-c8x6dq57.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qernavi-gld-lormita-c8x6dq57.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000714; classtype:social-engineering; sid:6000714; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bid-fri2d-diner.s3.us-east-2.amazonaws.com/vopps0-tr_014.70/en/index.html)"; flow:established,to_server; http.uri; content:"/vopps0-tr_014.70/en/index.html"; startswith; fast_pattern; http.host; content:"bid-fri2d-diner.s3.us-east-2.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000715; classtype:social-engineering; sid:6000715; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fuz.za.com/metalworkservice/index.php)"; flow:established,to_server; http.uri; content:"/metalworkservice/index.php"; startswith; fast_pattern; http.host; content:"fuz.za.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000716; classtype:social-engineering; sid:6000716; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-using-nextjs-1o67.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-using-nextjs-1o67.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000717; classtype:social-engineering; sid:6000717; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cashapp-liart.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cashapp-liart.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000718; classtype:social-engineering; sid:6000718; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supportmyphone.site/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"supportmyphone.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000719; classtype:social-engineering; sid:6000719; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (serene-tools-866048.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"serene-tools-866048.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000720; classtype:social-engineering; sid:6000720; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.francecombi.net/redirect/)"; flow:established,to_server; http.uri; content:"/redirect/"; startswith; fast_pattern; http.host; content:"www.francecombi.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000721; classtype:social-engineering; sid:6000721; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wallllttt---uphllddd----howww.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wallllttt---uphllddd----howww.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000722; classtype:social-engineering; sid:6000722; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.moonpay-commerce-git-fix-com2-1865-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.moonpay-commerce-git-fix-com2-1865-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000723; classtype:social-engineering; sid:6000723; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure.everytime.dpdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure.everytime.dpdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000724; classtype:social-engineering; sid:6000724; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agenciatributariaoops.eu.cc/es)"; flow:established,to_server; http.uri; content:"/es"; startswith; fast_pattern; http.host; content:"agenciatributariaoops.eu.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000725; classtype:social-engineering; sid:6000725; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pages-trzrsuites.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pages-trzrsuites.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000726; classtype:social-engineering; sid:6000726; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fastdeploy-project.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fastdeploy-project.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000727; classtype:social-engineering; sid:6000727; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.addqe.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.addqe.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000728; classtype:social-engineering; sid:6000728; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app2new.gleantap.com/Campaign/emailPreviewABTesting/6a6ac763b3713ab5df004d17)"; flow:established,to_server; http.uri; content:"/Campaign/emailPreviewABTesting/6a6ac763b3713ab5df004d17"; startswith; fast_pattern; http.host; content:"app2new.gleantap.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000729; classtype:social-engineering; sid:6000729; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-8ics8t062-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-8ics8t062-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000730; classtype:social-engineering; sid:6000730; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.meta8wkx-noticefb241754.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.meta8wkx-noticefb241754.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000731; classtype:social-engineering; sid:6000731; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (asfmvcxksts.eu.cc/es)"; flow:established,to_server; http.uri; content:"/es"; startswith; fast_pattern; http.host; content:"asfmvcxksts.eu.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000732; classtype:social-engineering; sid:6000732; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-git-fix-com2-1089-disabled-netw-b80dff-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-git-fix-com2-1089-disabled-netw-b80dff-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000733; classtype:social-engineering; sid:6000733; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.encontrar-mapsdfksl.info/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.encontrar-mapsdfksl.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000734; classtype:social-engineering; sid:6000734; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home.aureate.shop/AAS/mnx/?naps)"; flow:established,to_server; http.uri; content:"/AAS/mnx/?naps"; startswith; fast_pattern; http.host; content:"home.aureate.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000735; classtype:social-engineering; sid:6000735; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iin.dreamhosters.com/sws/sw)"; flow:established,to_server; http.uri; content:"/sws/sw"; startswith; fast_pattern; http.host; content:"iin.dreamhosters.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000736; classtype:social-engineering; sid:6000736; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct-gamex-biz8-hurev-lonik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct-gamex-biz8-hurev-lonik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000737; classtype:social-engineering; sid:6000737; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (formstea.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"formstea.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000738; classtype:social-engineering; sid:6000738; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xvm-9vj3-3l05x-wbge-7lgv7.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xvm-9vj3-3l05x-wbge-7lgv7.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000739; classtype:social-engineering; sid:6000739; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maps-findme.us/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"maps-findme.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000740; classtype:social-engineering; sid:6000740; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-dal47mq58-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-dal47mq58-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000741; classtype:social-engineering; sid:6000741; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j19qi1.github.io/index.html/)"; flow:established,to_server; http.uri; content:"/index.html/"; startswith; fast_pattern; http.host; content:"j19qi1.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000742; classtype:social-engineering; sid:6000742; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.moonpay-commerce-git-feat-com2-1450-com2-1448-de-7eae46-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.moonpay-commerce-git-feat-com2-1450-com2-1448-de-7eae46-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000743; classtype:social-engineering; sid:6000743; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-zormik-biz-fandel-kresor.pages.dev/rtyu-iopj-qewr-thjm/)"; flow:established,to_server; http.uri; content:"/rtyu-iopj-qewr-thjm/"; startswith; fast_pattern; http.host; content:"sp12ct-zormik-biz-fandel-kresor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000744; classtype:social-engineering; sid:6000744; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hrndumssn.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hrndumssn.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000745; classtype:social-engineering; sid:6000745; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (palcay.de/sapps/)"; flow:established,to_server; http.uri; content:"/sapps/"; startswith; fast_pattern; http.host; content:"palcay.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000746; classtype:social-engineering; sid:6000746; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mohandasbodke.github.io/spotify-frontend-clone)"; flow:established,to_server; http.uri; content:"/spotify-frontend-clone"; startswith; fast_pattern; http.host; content:"mohandasbodke.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000747; classtype:social-engineering; sid:6000747; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (letgethnd.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"letgethnd.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000748; classtype:social-engineering; sid:6000748; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (big-shop45.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"big-shop45.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000749; classtype:social-engineering; sid:6000749; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (com-legr-desktop.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"com-legr-desktop.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000750; classtype:social-engineering; sid:6000750; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-git-feat-com2-2323-manual-crypto-send-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-git-feat-com2-2323-manual-crypto-send-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000751; classtype:social-engineering; sid:6000751; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (securechaseonline.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"securechaseonline.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000752; classtype:social-engineering; sid:6000752; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loginfacebook3.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"loginfacebook3.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000753; classtype:social-engineering; sid:6000753; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-git-fix-com2-1865-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-git-fix-com2-1865-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000754; classtype:social-engineering; sid:6000754; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezrstartnew.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezrstartnew.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000755; classtype:social-engineering; sid:6000755; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (codesbysahil-dev.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"codesbysahil-dev.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000756; classtype:social-engineering; sid:6000756; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.supportmyphone.site/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.supportmyphone.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000757; classtype:social-engineering; sid:6000757; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-bqurjatch.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-bqurjatch.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000758; classtype:social-engineering; sid:6000758; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-57n1p29nc-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-57n1p29nc-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000759; classtype:social-engineering; sid:6000759; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1818.cl/jipoggh.html?eta=)"; flow:established,to_server; http.uri; content:"/jipoggh.html?eta="; startswith; fast_pattern; http.host; content:"1818.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000760; classtype:social-engineering; sid:6000760; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.phone-locateshgkln.info/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.phone-locateshgkln.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000761; classtype:social-engineering; sid:6000761; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fayzres.hxcreat.web.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fayzres.hxcreat.web.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000762; classtype:social-engineering; sid:6000762; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (offers.integritycleaningsystems.info/wp-admin/Serveraktivie-rutehend/htm.html)"; flow:established,to_server; http.uri; content:"/wp-admin/Serveraktivie-rutehend/htm.html"; startswith; fast_pattern; http.host; content:"offers.integritycleaningsystems.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000763; classtype:social-engineering; sid:6000763; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityajsj-pao.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinityajsj-pao.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000764; classtype:social-engineering; sid:6000764; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.mydevicesfind.site/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.mydevicesfind.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000765; classtype:social-engineering; sid:6000765; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-user.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"verify-user.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000766; classtype:social-engineering; sid:6000766; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c3.asurahosting.com/~netcentrixco/intesasanpaolo/SMS.html)"; flow:established,to_server; http.uri; content:"/~netcentrixco/intesasanpaolo/SMS.html"; startswith; fast_pattern; http.host; content:"c3.asurahosting.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000767; classtype:social-engineering; sid:6000767; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (geastweq.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"geastweq.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000768; classtype:social-engineering; sid:6000768; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.buzz-whatapp.hk.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.buzz-whatapp.hk.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000769; classtype:social-engineering; sid:6000769; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tsngtfvfr.eu.cc/es)"; flow:established,to_server; http.uri; content:"/es"; startswith; fast_pattern; http.host; content:"tsngtfvfr.eu.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000770; classtype:social-engineering; sid:6000770; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (googleformteacherreviewsjdbfksbviuslu.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"googleformteacherreviewsjdbfksbviuslu.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000771; classtype:social-engineering; sid:6000771; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-git-fix-com2-2219-theme-page-forms-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-git-fix-com2-2219-theme-page-forms-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000772; classtype:social-engineering; sid:6000772; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.moonpay-commerce-git-henryharris-com2-2325-excha-6f0ba4-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.moonpay-commerce-git-henryharris-com2-2325-excha-6f0ba4-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000773; classtype:social-engineering; sid:6000773; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-source.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-source.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000774; classtype:social-engineering; sid:6000774; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.moonpay-commerce-git-fix-com2-1089-disabled-netw-b80dff-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.moonpay-commerce-git-fix-com2-1089-disabled-netw-b80dff-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000775; classtype:social-engineering; sid:6000775; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-authorization.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-authorization.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000776; classtype:social-engineering; sid:6000776; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-926l5f3gd-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-926l5f3gd-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000777; classtype:social-engineering; sid:6000777; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (65.jj37799.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"65.jj37799.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000778; classtype:social-engineering; sid:6000778; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (api.allegrostatus.pl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"api.allegrostatus.pl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000779; classtype:social-engineering; sid:6000779; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sxca-exfwedh5azaac7h9.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sxca-exfwedh5azaac7h9.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000780; classtype:social-engineering; sid:6000780; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (basharaboali.github.io/instagram-phishing-demo)"; flow:established,to_server; http.uri; content:"/instagram-phishing-demo"; startswith; fast_pattern; http.host; content:"basharaboali.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000781; classtype:social-engineering; sid:6000781; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bjsggitane.live/bolt/daou.htm)"; flow:established,to_server; http.uri; content:"/bolt/daou.htm"; startswith; fast_pattern; http.host; content:"bjsggitane.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000782; classtype:social-engineering; sid:6000782; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (php-web-server--franz1095.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"php-web-server--franz1095.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000783; classtype:social-engineering; sid:6000783; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-git-feat-com2-2321-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-git-feat-com2-2321-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000784; classtype:social-engineering; sid:6000784; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moustikit.com/amendes-antai-gouv/FR/redirect)"; flow:established,to_server; http.uri; content:"/amendes-antai-gouv/FR/redirect"; startswith; fast_pattern; http.host; content:"moustikit.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000785; classtype:social-engineering; sid:6000785; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (transporteslakes.cl/desktop/)"; flow:established,to_server; http.uri; content:"/desktop/"; startswith; fast_pattern; http.host; content:"transporteslakes.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000786; classtype:social-engineering; sid:6000786; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.metaogye-noticefb851233.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.metaogye-noticefb851233.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000787; classtype:social-engineering; sid:6000787; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-kucoiins-us-en.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"help-kucoiins-us-en.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000788; classtype:social-engineering; sid:6000788; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail-slposta-sk-owa.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webmail-slposta-sk-owa.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000789; classtype:social-engineering; sid:6000789; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledglive-m-auth.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledglive-m-auth.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000790; classtype:social-engineering; sid:6000790; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.moonpay-commerce-git-fix-com2-2219-theme-page-forms-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.moonpay-commerce-git-fix-com2-2219-theme-page-forms-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000791; classtype:social-engineering; sid:6000791; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fbmetammku-fbcasefb433096.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fbmetammku-fbcasefb433096.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000792; classtype:social-engineering; sid:6000792; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (glowing-gibbon-300775.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"glowing-gibbon-300775.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000793; classtype:social-engineering; sid:6000793; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jenniferpearlham-lang.github.io/legendary-octo-waffle/DHL%20Receipt.html)"; flow:established,to_server; http.uri; content:"/legendary-octo-waffle/DHL%20Receipt.html"; startswith; fast_pattern; http.host; content:"jenniferpearlham-lang.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000794; classtype:social-engineering; sid:6000794; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.70383.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.70383.xyz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000795; classtype:social-engineering; sid:6000795; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dccrsorgi1gov.github.io/in.crs.verifyCertificate.id-TMJ8JyK8uGBBVCuqLhWA8HRA-3D-3D/)"; flow:established,to_server; http.uri; content:"/in.crs.verifyCertificate.id-TMJ8JyK8uGBBVCuqLhWA8HRA-3D-3D/"; startswith; fast_pattern; http.host; content:"dccrsorgi1gov.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000796; classtype:social-engineering; sid:6000796; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamsakslogem-us.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metamsakslogem-us.gitbook.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000797; classtype:social-engineering; sid:6000797; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (exosued-web.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"exosued-web.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000798; classtype:social-engineering; sid:6000798; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (server-index-page--lezzuzh.replit.app/?email=delix8@3550ff480be5732be6c37155b12166014e72.com)"; flow:established,to_server; http.uri; content:"/?email=delix8@3550ff480be5732be6c37155b12166014e72.com"; startswith; fast_pattern; http.host; content:"server-index-page--lezzuzh.replit.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000799; classtype:social-engineering; sid:6000799; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cwngs36nhw-pxqzvlpw-9b2a0d-cwn79c-acc.pages.dev/welcome_aboard?welcome=1000045790640960&token248=1000045790640960&name_token136=Casa%20Christabel%20y%20Casa%20Annabel)"; flow:established,to_server; http.uri; content:"/welcome_aboard?welcome=1000045790640960&token248=1000045790640960&name_token136=Casa%20Christabel%20y%20Casa%20Annabel"; startswith; fast_pattern; http.host; content:"cwngs36nhw-pxqzvlpw-9b2a0d-cwn79c-acc.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000800; classtype:social-engineering; sid:6000800; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapper.leadball.ru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapper.leadball.ru"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000801; classtype:social-engineering; sid:6000801; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox.et/games/136609432705944/Bubble-Battles?privateServerLinkCode=52094747329170980456014687661179)"; flow:established,to_server; http.uri; content:"/games/136609432705944/Bubble-Battles?privateServerLinkCode=52094747329170980456014687661179"; startswith; fast_pattern; http.host; content:"www.roblox.et"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000802; classtype:social-engineering; sid:6000802; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (warmhearted-gazelle-836856.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"warmhearted-gazelle-836856.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000803; classtype:social-engineering; sid:6000803; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7c7-dpjx2x-mij8-cp3-aqsbny.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7c7-dpjx2x-mij8-cp3-aqsbny.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000804; classtype:social-engineering; sid:6000804; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (startphntum.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"startphntum.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000805; classtype:social-engineering; sid:6000805; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mailteam653.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mailteam653.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000806; classtype:social-engineering; sid:6000806; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.jnn.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.jnn.my.id"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000807; classtype:social-engineering; sid:6000807; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta8wkx-noticefb241754.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta8wkx-noticefb241754.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000808; classtype:social-engineering; sid:6000808; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4v4v3v34v3.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4v4v3v34v3.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000809; classtype:social-engineering; sid:6000809; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (talknetformhrir57757571.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"talknetformhrir57757571.weeblysite.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000810; classtype:social-engineering; sid:6000810; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth-trzurr-io-suit.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auth-trzurr-io-suit.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000811; classtype:social-engineering; sid:6000811; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (twxpl2fdranxl-zjstr87olpw-8a9b6c-vro3a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"twxpl2fdranxl-zjstr87olpw-8a9b6c-vro3a.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000812; classtype:social-engineering; sid:6000812; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prosperous-breakfast-387603.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"prosperous-breakfast-387603.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000813; classtype:social-engineering; sid:6000813; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jengbetieleajantiele.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jengbetieleajantiele.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000814; classtype:social-engineering; sid:6000814; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (desktop-eng-ledgre.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"desktop-eng-ledgre.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000815; classtype:social-engineering; sid:6000815; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aqua-millions-761930.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aqua-millions-761930.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000816; classtype:social-engineering; sid:6000816; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-s---ndax---io-auth.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso-s---ndax---io-auth.webflow.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000817; classtype:social-engineering; sid:6000817; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7ufn-bu7q-m1ik-3dd5h.b-cdn.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7ufn-bu7q-m1ik-3dd5h.b-cdn.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000818; classtype:social-engineering; sid:6000818; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-carevik-biz8-dolan-furex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-carevik-biz8-dolan-furex.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000819; classtype:social-engineering; sid:6000819; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pylter-dana.pages.dev/expire-check.php)"; flow:established,to_server; http.uri; content:"/expire-check.php"; startswith; fast_pattern; http.host; content:"pylter-dana.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000820; classtype:social-engineering; sid:6000820; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox.com.mu/users/5392150789/profile)"; flow:established,to_server; http.uri; content:"/users/5392150789/profile"; startswith; fast_pattern; http.host; content:"roblox.com.mu"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000821; classtype:social-engineering; sid:6000821; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fbmeta6ewb-fbcasefb392979.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fbmeta6ewb-fbcasefb392979.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000822; classtype:social-engineering; sid:6000822; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (r.oblox.com.et/users/2661706558/profile)"; flow:established,to_server; http.uri; content:"/users/2661706558/profile"; startswith; fast_pattern; http.host; content:"r.oblox.com.et"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000823; classtype:social-engineering; sid:6000823; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.robiox.com.py/users/378449445836/profile)"; flow:established,to_server; http.uri; content:"/users/378449445836/profile"; startswith; fast_pattern; http.host; content:"www.robiox.com.py"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000824; classtype:social-engineering; sid:6000824; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (i4z-d5ho-wdmkb-j54-zp9lw.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"i4z-d5ho-wdmkb-j54-zp9lw.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000825; classtype:social-engineering; sid:6000825; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telstraawerbmaill.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telstraawerbmaill.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000826; classtype:social-engineering; sid:6000826; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (attwireless-customersupport-center.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"attwireless-customersupport-center.framer.website"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000827; classtype:social-engineering; sid:6000827; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yuiogkmnklkll.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yuiogkmnklkll.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000828; classtype:social-engineering; sid:6000828; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (grey-function-204716.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"grey-function-204716.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000829; classtype:social-engineering; sid:6000829; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (owa-atbahrain-com-bh.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"owa-atbahrain-com-bh.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000830; classtype:social-engineering; sid:6000830; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wsedrft345678iuhygsedrftgye4r5t67ytfrd.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wsedrft345678iuhygsedrftgye4r5t67ytfrd.square.site"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000831; classtype:social-engineering; sid:6000831; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onlinetalktalkmail000.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"onlinetalktalkmail000.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000832; classtype:social-engineering; sid:6000832; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (relaxed-remember-052133.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"relaxed-remember-052133.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000833; classtype:social-engineering; sid:6000833; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhlexpressline.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dhlexpressline.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000834; classtype:social-engineering; sid:6000834; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (away.vk.ru/away.php?rh=3b4edde9-a371-4a86-a53d-d7cf4a8a8046)"; flow:established,to_server; http.uri; content:"/away.php?rh=3b4edde9-a371-4a86-a53d-d7cf4a8a8046"; startswith; fast_pattern; http.host; content:"away.vk.ru"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000835; classtype:social-engineering; sid:6000835; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (customerservice-support-center.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"customerservice-support-center.framer.website"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000836; classtype:social-engineering; sid:6000836; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (attmailserveroginwrexzmmxmzdjjkdjahjkeyeyey.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"attmailserveroginwrexzmmxmzdjjkdjahjkeyeyey.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000837; classtype:social-engineering; sid:6000837; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (azcorpdaaauummmkaoakaoaakaoaoaoaoako.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"azcorpdaaauummmkaoakaoaakaoaoaoaoako.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000838; classtype:social-engineering; sid:6000838; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mytalktalkbroadbandprovider0.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mytalktalkbroadbandprovider0.framer.website"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000839; classtype:social-engineering; sid:6000839; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (leilnhar.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"leilnhar.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000840; classtype:social-engineering; sid:6000840; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail-admin-support44673828992.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webmail-admin-support44673828992.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000841; classtype:social-engineering; sid:6000841; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (busniessoffficeworkryui5rtyui.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"busniessoffficeworkryui5rtyui.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000842; classtype:social-engineering; sid:6000842; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (officebook0033.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"officebook0033.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000843; classtype:social-engineering; sid:6000843; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (talktalkservice01.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"talktalkservice01.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000844; classtype:social-engineering; sid:6000844; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oijhgfrtjhvngtalktalk.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"oijhgfrtjhvngtalktalk.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000845; classtype:social-engineering; sid:6000845; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (autenticacao-ufba-br.framer.wiki/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"autenticacao-ufba-br.framer.wiki"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000846; classtype:social-engineering; sid:6000846; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accountsearthlinkwebmail.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"accountsearthlinkwebmail.framer.website"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000847; classtype:social-engineering; sid:6000847; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfcnms.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfcnms.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000848; classtype:social-engineering; sid:6000848; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (everwlserecoverydesk.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"everwlserecoverydesk.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000849; classtype:social-engineering; sid:6000849; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vast-team-222500.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vast-team-222500.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000850; classtype:social-engineering; sid:6000850; rev:1; metadata: signature_severity Major, created_et 2026_07_21;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eiirririririieeiririrriirr.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eiirririririieeiririrriirr.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000851; classtype:social-engineering; sid:6000851; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portal.yu3.app/public/redirect/?u=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0YXJnZXQiOiJVM0JoYlNCVlVrd2daR1YwWldOMFpXUTZJRk5QUTBsQlRGOUZUa2RKVGtWRlVrbE9Sdz09IiwiZXhwIjoxNzg1Mzg5NzQyLCJpYXQiOjE3ODUzODk2ODJ9.MQq46yXZH21BBh2VOfagiDng2do1InrnhG2gEVcEgBohOC1z3w7pfJeXPJbMQO_TMG6b3UPCPsHIojUpOFQZHKf9jPtOZvP3FHgt_JTdpDdPFTMhvOf3zFBQdHxzSEGt0SdSsFJO0OAot4hfZXNyLIfat1EoqApeTQ-nvxwV3C4idBMHqbdyl_keLKiVGorZbbnTSYQrmwlAfEKShSyNWp10xRJettcYgOWV-Lo2Iogz6K58P1IFRRc-TFxmzVHJE6LDoiBCd7S9oxhQRCsXc2NXWajG9JyrCqo-E6B5f_ZjMARHSgfWVpX0tWlTrWrD0bmjqujRdC1pIEKmeT8bDQ&suspended=true)"; flow:established,to_server; http.uri; content:"/public/redirect/?u=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0YXJnZXQiOiJVM0JoYlNCVlVrd2daR1YwWldOMFpXUTZJRk5QUTBsQlRGOUZUa2RKVGtWRlVrbE9Sdz09IiwiZXhwIjoxNzg1Mzg5NzQyLCJpYXQiOjE3ODUzODk2ODJ9.MQq46yXZH21BBh2VOfagiDng2do1InrnhG2gEVcEgBohOC1z3w7pfJeXPJbMQO_TMG6b3UPCPsHIojUpOFQZHKf9jPtOZvP3FHgt_JTdpDdPFTMhvOf3zFBQdHxzSEGt0SdSsFJO0OAot4hfZXNyLIfat1EoqApeTQ-nvxwV3C4idBMHqbdyl_keLKiVGorZbbnTSYQrmwlAfEKShSyNWp10xRJettcYgOWV-Lo2Iogz6K58P1IFRRc-TFxmzVHJE6LDoiBCd7S9oxhQRCsXc2NXWajG9JyrCqo-E6B5f_ZjMARHSgfWVpX0tWlTrWrD0bmjqujRdC1pIEKmeT8bDQ&suspended=true"; startswith; fast_pattern; http.host; content:"portal.yu3.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000852; classtype:social-engineering; sid:6000852; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ovegetaux.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ovegetaux.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000853; classtype:social-engineering; sid:6000853; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pink-researchers-611047.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pink-researchers-611047.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000854; classtype:social-engineering; sid:6000854; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bodinaicha.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bodinaicha.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000855; classtype:social-engineering; sid:6000855; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pafetik.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pafetik.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000856; classtype:social-engineering; sid:6000856; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (logical-words-764346.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"logical-words-764346.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000857; classtype:social-engineering; sid:6000857; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vercel.com/login?next=%2Fsso-api%3Furl%3Dhttps%253A%252F%252Fitauclientes-nqxep046f-gamero-galons-projects.vercel.app%252F%26nonce%3Ddad1a12b665e18e78d3edc5d1a22d132bc3d8d4fab8d3bb98dcd0eb45a2d7e7a)"; flow:established,to_server; http.uri; content:"/login?next=%2Fsso-api%3Furl%3Dhttps%253A%252F%252Fitauclientes-nqxep046f-gamero-galons-projects.vercel.app%252F%26nonce%3Ddad1a12b665e18e78d3edc5d1a22d132bc3d8d4fab8d3bb98dcd0eb45a2d7e7a"; startswith; fast_pattern; http.host; content:"vercel.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000858; classtype:social-engineering; sid:6000858; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (audit-soft.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"audit-soft.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000859; classtype:social-engineering; sid:6000859; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uvcl.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uvcl.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000860; classtype:social-engineering; sid:6000860; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (000007767555.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"000007767555.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000861; classtype:social-engineering; sid:6000861; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (refreshed-challenge-135573.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"refreshed-challenge-135573.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000862; classtype:social-engineering; sid:6000862; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityupdatedversioncomms.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinityupdatedversioncomms.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000863; classtype:social-engineering; sid:6000863; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (easy-spots-701814.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"easy-spots-701814.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000864; classtype:social-engineering; sid:6000864; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (remaxeedj34.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"remaxeedj34.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000865; classtype:social-engineering; sid:6000865; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitydeskifhfgg.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitydeskifhfgg.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000866; classtype:social-engineering; sid:6000866; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (49.51.43.12/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts.google.com%2F&%3Bifkv=ASKXGp36_CB8HzfrpuLLHTVjXxiUGDwO6Tj8yz4QrsaGyc3I4H4G7NxTTQJtpw0j07g9O5T5Tx4uyQ&%3Bpassive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=Ac50bxsNG2Re46ce8ruKNRRtvpULIjdaiWezib0CeC7yEBLZT5cso6Zo94XYzN5P2bHtgelX7mR19w&dsh=S1981722052%3A1785391344441517)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts.google.com%2F&%3Bifkv=ASKXGp36_CB8HzfrpuLLHTVjXxiUGDwO6Tj8yz4QrsaGyc3I4H4G7NxTTQJtpw0j07g9O5T5Tx4uyQ&%3Bpassive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=Ac50bxsNG2Re46ce8ruKNRRtvpULIjdaiWezib0CeC7yEBLZT5cso6Zo94XYzN5P2bHtgelX7mR19w&dsh=S1981722052%3A1785391344441517"; startswith; fast_pattern; http.host; content:"49.51.43.12"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000867; classtype:social-engineering; sid:6000867; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bluepeakz.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bluepeakz.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000868; classtype:social-engineering; sid:6000868; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instaphotoshootnue.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instaphotoshootnue.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000869; classtype:social-engineering; sid:6000869; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (illuminated-attributes-378864.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"illuminated-attributes-378864.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000870; classtype:social-engineering; sid:6000870; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.activation-pass.com/login_up.php)"; flow:established,to_server; http.uri; content:"/login_up.php"; startswith; fast_pattern; http.host; content:"www.activation-pass.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000871; classtype:social-engineering; sid:6000871; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yuuijkoilkmlvgffd.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yuuijkoilkmlvgffd.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000872; classtype:social-engineering; sid:6000872; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wuejaks-a9s8dja-s9djks-a8skdja.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wuejaks-a9s8dja-s9djks-a8skdja.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000873; classtype:social-engineering; sid:6000873; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (noddo5logineonline.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"noddo5logineonline.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000874; classtype:social-engineering; sid:6000874; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jjpoctzade.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jjpoctzade.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000875; classtype:social-engineering; sid:6000875; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (axcodaaaaauuuuummmmmmm.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"axcodaaaaauuuuummmmmmm.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000876; classtype:social-engineering; sid:6000876; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bluepaek.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bluepaek.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000877; classtype:social-engineering; sid:6000877; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telllstttrrramyyyadmmminn.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telllstttrrramyyyadmmminn.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000878; classtype:social-engineering; sid:6000878; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mdfcomcastnn.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mdfcomcastnn.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000879; classtype:social-engineering; sid:6000879; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (univgrenoblealpes.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"univgrenoblealpes.framer.website"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000880; classtype:social-engineering; sid:6000880; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail-achremittance.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webmail-achremittance.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000881; classtype:social-engineering; sid:6000881; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mytelllstraaaddminnn.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mytelllstraaaddminnn.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000882; classtype:social-engineering; sid:6000882; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitysigncc.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitysigncc.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000883; classtype:social-engineering; sid:6000883; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (silly-studies-327811.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"silly-studies-327811.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000884; classtype:social-engineering; sid:6000884; rev:1; metadata: signature_severity Major, created_et 2026_07_28;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tang36.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tang36.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000885; classtype:social-engineering; sid:6000885; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (multidisciplinary-statuses-616239.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"multidisciplinary-statuses-616239.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000886; classtype:social-engineering; sid:6000886; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.oferta8594304.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.oferta8594304.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000887; classtype:social-engineering; sid:6000887; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cau-ac-kr.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cau-ac-kr.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000888; classtype:social-engineering; sid:6000888; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-update3.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"account-update3.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000889; classtype:social-engineering; sid:6000889; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (luxuryhomedecoruk.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"luxuryhomedecoruk.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000890; classtype:social-engineering; sid:6000890; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (talktalksupp0rt.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"talktalksupp0rt.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000891; classtype:social-engineering; sid:6000891; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail-ntuu-edu-tw.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mail-ntuu-edu-tw.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000892; classtype:social-engineering; sid:6000892; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitydocusign.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitydocusign.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000893; classtype:social-engineering; sid:6000893; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sirentelcom.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sirentelcom.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000894; classtype:social-engineering; sid:6000894; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cooperative-ways-450863.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cooperative-ways-450863.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000895; classtype:social-engineering; sid:6000895; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lakelandw.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lakelandw.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000896; classtype:social-engineering; sid:6000896; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nmdfbueywjsoi.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nmdfbueywjsoi.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000897; classtype:social-engineering; sid:6000897; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (everwisecuclickwebhtt.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"everwisecuclickwebhtt.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000898; classtype:social-engineering; sid:6000898; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.ofera98823882.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.ofera98823882.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000899; classtype:social-engineering; sid:6000899; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (us22.campaign-archive.com/?e=f7a7887e14&i=*%7CITERATION_UNIQUE_ID%7C*&u=d802732fca839bb95201e0ab4&id=fff6c22411)"; flow:established,to_server; http.uri; content:"/?e=f7a7887e14&i=*%7CITERATION_UNIQUE_ID%7C*&u=d802732fca839bb95201e0ab4&id=fff6c22411"; startswith; fast_pattern; http.host; content:"us22.campaign-archive.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000900; classtype:social-engineering; sid:6000900; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fuzzy-baguette-686005.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fuzzy-baguette-686005.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000901; classtype:social-engineering; sid:6000901; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (strategic-group-491986.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"strategic-group-491986.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000902; classtype:social-engineering; sid:6000902; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pageseuc1.actmkt.com/(S(pog2xhcpa2u3lzi3nizhnynv))/l/c5X8MfZz6j9Y7Fto3LAd)"; flow:established,to_server; http.uri; content:"/(S(pog2xhcpa2u3lzi3nizhnynv))/l/c5X8MfZz6j9Y7Fto3LAd"; startswith; fast_pattern; http.host; content:"pageseuc1.actmkt.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000903; classtype:social-engineering; sid:6000903; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (activation-pass.com/login_up.php)"; flow:established,to_server; http.uri; content:"/login_up.php"; startswith; fast_pattern; http.host; content:"activation-pass.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000904; classtype:social-engineering; sid:6000904; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (transparenzregister.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"transparenzregister.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000905; classtype:social-engineering; sid:6000905; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.pl-d-oferta938128374771238281227341.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-d-oferta938128374771238281227341.sbs"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000906; classtype:social-engineering; sid:6000906; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.serverbwll.com/3B6F21F/S5T8TN8/?__rpt=0&__po=18953&__ptid=d84bf80ba5f143e59a7239aa5d4dfc8b&__rpa=1&__rc=1&sub1=5&sub2=&sub3=&sub4=&sub5=&sub6=&sub7=&sub8=&sub9=&sub10=&source_id=&__pcd=2)"; flow:established,to_server; http.uri; content:"/3B6F21F/S5T8TN8/?__rpt=0&__po=18953&__ptid=d84bf80ba5f143e59a7239aa5d4dfc8b&__rpa=1&__rc=1&sub1=5&sub2=&sub3=&sub4=&sub5=&sub6=&sub7=&sub8=&sub9=&sub10=&source_id=&__pcd=2"; startswith; fast_pattern; http.host; content:"www.serverbwll.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000907; classtype:social-engineering; sid:6000907; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fnacspectacle.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fnacspectacle.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000908; classtype:social-engineering; sid:6000908; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ersfilter-my.sharepoint.com/personal/nradonich_ersfilter_com/_layouts/15/doc.aspx?guestaccesstoken=t6T%2FHN1dKbYHlYX%2BeIMbaZufA43rrGZ6%2FaAAewNocDI%3D&docid=1_18168db23429e45f29fdf2e7be120efc4&wdFormId=%7BB9970F62-44C3-4D09-9929-6E1EB652DA57%7D&action=formsubmit&CID=e9ec3af7-5e8a-489c-9d46-0030d25e4db4)"; flow:established,to_server; http.uri; content:"/personal/nradonich_ersfilter_com/_layouts/15/doc.aspx?guestaccesstoken=t6T%2FHN1dKbYHlYX%2BeIMbaZufA43rrGZ6%2FaAAewNocDI%3D&docid=1_18168db23429e45f29fdf2e7be120efc4&wdFormId=%7BB9970F62-44C3-4D09-9929-6E1EB652DA57%7D&action=formsubmit&CID=e9ec3af7-5e8a-489c-9d46-0030d25e4db4"; startswith; fast_pattern; http.host; content:"ersfilter-my.sharepoint.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000909; classtype:social-engineering; sid:6000909; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgecosnmtart.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgecosnmtart.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000910; classtype:social-engineering; sid:6000910; rev:1; metadata: signature_severity Major, created_et 2026_07_29;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (validacaoexpirado.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"validacaoexpirado.click"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000911; classtype:social-engineering; sid:6000911; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mijnnationaleomgevlngg.es/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mijnnationaleomgevlngg.es"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000912; classtype:social-engineering; sid:6000912; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.oferta955649.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.oferta955649.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000913; classtype:social-engineering; sid:6000913; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.pl-d-oferta938128374771238281227341.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.pl-d-oferta938128374771238281227341.sbs"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000914; classtype:social-engineering; sid:6000914; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (058734-dxq3a4rh-dot-mail-identifier002200.uw.r.appspot.com/#Yi5ob3NrYUBjZWxhZG9ubmEubmV0)"; flow:established,to_server; http.uri; content:"/#Yi5ob3NrYUBjZWxhZG9ubmEubmV0"; startswith; fast_pattern; http.host; content:"058734-dxq3a4rh-dot-mail-identifier002200.uw.r.appspot.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000915; classtype:social-engineering; sid:6000915; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sharkspeedserver2.com/transparenzregister/)"; flow:established,to_server; http.uri; content:"/transparenzregister/"; startswith; fast_pattern; http.host; content:"sharkspeedserver2.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000916; classtype:social-engineering; sid:6000916; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.pl-58383.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.pl-58383.sbs"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000917; classtype:social-engineering; sid:6000917; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b8376mghi5d.jp.larksuite.com/share/base/form/shrjpMwk5KEz3wmsdPQjPPcLjqh?auth_token=U7CK1RF-92bge0be-9f13-44b0-af44-f1e527tih92i-NN5W4)"; flow:established,to_server; http.uri; content:"/share/base/form/shrjpMwk5KEz3wmsdPQjPPcLjqh?auth_token=U7CK1RF-92bge0be-9f13-44b0-af44-f1e527tih92i-NN5W4"; startswith; fast_pattern; http.host; content:"b8376mghi5d.jp.larksuite.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000918; classtype:social-engineering; sid:6000918; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yandex.ru/showcaptchafast?d=752144B77E0842C9656E9B7D50A24F917A19B477A051DC31E24AB3B44D6E7E858EAAD74874F8BAC218748AD87F38C7302B58CF5A63&retpath=aHR0cHM6Ly95YW5kZXgucnUvc2VhcmNoP3RleHQ9MjExNjg3MTc%2C_0da48103bf7b41c958987253950084f5&s=3661de7eef7eba49edd9e4bdbfb08bec)"; flow:established,to_server; http.uri; content:"/showcaptchafast?d=752144B77E0842C9656E9B7D50A24F917A19B477A051DC31E24AB3B44D6E7E858EAAD74874F8BAC218748AD87F38C7302B58CF5A63&retpath=aHR0cHM6Ly95YW5kZXgucnUvc2VhcmNoP3RleHQ9MjExNjg3MTc%2C_0da48103bf7b41c958987253950084f5&s=3661de7eef7eba49edd9e4bdbfb08bec"; startswith; fast_pattern; http.host; content:"yandex.ru"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000919; classtype:social-engineering; sid:6000919; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.pl-oferta04842855.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-oferta04842855.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000920; classtype:social-engineering; sid:6000920; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tubdv--bdv-2026.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tubdv--bdv-2026.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000921; classtype:social-engineering; sid:6000921; rev:1; metadata: signature_severity Major, created_et 2026_07_29;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (id.superhuman.com/signin?oauth_client_type=MEDIATED_WEB&correlation_id=rbwZWzcHPIJXlIbJCP5xFw&version=v4&client_id=superhumanDocs)"; flow:established,to_server; http.uri; content:"/signin?oauth_client_type=MEDIATED_WEB&correlation_id=rbwZWzcHPIJXlIbJCP5xFw&version=v4&client_id=superhumanDocs"; startswith; fast_pattern; http.host; content:"id.superhuman.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000922; classtype:social-engineering; sid:6000922; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox.ly/users/1371426575/profile)"; flow:established,to_server; http.uri; content:"/users/1371426575/profile"; startswith; fast_pattern; http.host; content:"roblox.ly"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000923; classtype:social-engineering; sid:6000923; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox.com.bn/games/108972860441201/Winter-Russian-District?privateServerLinkCode=65924314243259842165815914766551&game_id=108972860441201&game_name=Winter-Russian-District)"; flow:established,to_server; http.uri; content:"/games/108972860441201/Winter-Russian-District?privateServerLinkCode=65924314243259842165815914766551&game_id=108972860441201&game_name=Winter-Russian-District"; startswith; fast_pattern; http.host; content:"www.roblox.com.bn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000924; classtype:social-engineering; sid:6000924; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robiox.com.ps/users/6640398912/profile)"; flow:established,to_server; http.uri; content:"/users/6640398912/profile"; startswith; fast_pattern; http.host; content:"robiox.com.ps"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000925; classtype:social-engineering; sid:6000925; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moviereccomendationsystem.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moviereccomendationsystem.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000926; classtype:social-engineering; sid:6000926; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox.com.gr/games/81697530184121/Return-Swing-For-Dandy-World?privateServerLinkCode=26676135374151735703107772519650&game_id=81697530184121&game_name=Return-Swing-For-Dandy-World)"; flow:established,to_server; http.uri; content:"/games/81697530184121/Return-Swing-For-Dandy-World?privateServerLinkCode=26676135374151735703107772519650&game_id=81697530184121&game_name=Return-Swing-For-Dandy-World"; startswith; fast_pattern; http.host; content:"www.roblox.com.gr"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000927; classtype:social-engineering; sid:6000927; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fbmetamdtj-fbcasefb313035.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fbmetamdtj-fbcasefb313035.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000928; classtype:social-engineering; sid:6000928; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (claims.eisen.co/coinbase)"; flow:established,to_server; http.uri; content:"/coinbase"; startswith; fast_pattern; http.host; content:"claims.eisen.co"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000929; classtype:social-engineering; sid:6000929; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (guiaemfoco.com.br/xinfinifix/xinfini/)"; flow:established,to_server; http.uri; content:"/xinfinifix/xinfini/"; startswith; fast_pattern; http.host; content:"guiaemfoco.com.br"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000930; classtype:social-engineering; sid:6000930; rev:1; metadata: signature_severity Major, created_et 2026_06_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nbhgtg67yyh.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nbhgtg67yyh.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000931; classtype:social-engineering; sid:6000931; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.mydevicemaps.site/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.mydevicemaps.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000932; classtype:social-engineering; sid:6000932; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.ee/2XEUVq)"; flow:established,to_server; http.uri; content:"/2XEUVq"; startswith; fast_pattern; http.host; content:"tr.ee"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6000933; classtype:social-engineering; sid:6000933; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (big-shopee52.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"big-shopee52.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000934; classtype:social-engineering; sid:6000934; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.coderr-ecru.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.coderr-ecru.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000935; classtype:social-engineering; sid:6000935; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.site-bqurjatch.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.site-bqurjatch.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000936; classtype:social-engineering; sid:6000936; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (everyservermail.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"everyservermail.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000937; classtype:social-engineering; sid:6000937; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ad25477.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ad25477.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000938; classtype:social-engineering; sid:6000938; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.telsadminnnnnn.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.telsadminnnnnn.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000939; classtype:social-engineering; sid:6000939; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marnavi-gld-belxora-p2t6hk17.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"marnavi-gld-belxora-p2t6hk17.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000940; classtype:social-engineering; sid:6000940; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bt-105831oidfotf.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bt-105831oidfotf.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000941; classtype:social-engineering; sid:6000941; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thr-shopee24.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"thr-shopee24.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000942; classtype:social-engineering; sid:6000942; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.securechaseonline.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.securechaseonline.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000943; classtype:social-engineering; sid:6000943; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.amazon-clone-lemon.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-clone-lemon.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000944; classtype:social-engineering; sid:6000944; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-authorization.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-authorization.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000945; classtype:social-engineering; sid:6000945; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qunfamao.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qunfamao.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000946; classtype:social-engineering; sid:6000946; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bsitf23e04.github.io/ledger-notes-app/)"; flow:established,to_server; http.uri; content:"/ledger-notes-app/"; startswith; fast_pattern; http.host; content:"bsitf23e04.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000947; classtype:social-engineering; sid:6000947; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (niuj-tech.github.io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"niuj-tech.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000948; classtype:social-engineering; sid:6000948; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (illuminated-monstera-424472.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"illuminated-monstera-424472.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000949; classtype:social-engineering; sid:6000949; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (plum-fox-137616.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"plum-fox-137616.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000950; classtype:social-engineering; sid:6000950; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (87b6v87.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"87b6v87.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000951; classtype:social-engineering; sid:6000951; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (solicitudyaumentoagrupoamigo360.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"solicitudyaumentoagrupoamigo360.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000952; classtype:social-engineering; sid:6000952; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cpintermedia-net-controlpanel-login-clienttypewebmail8557576565.s3.eu-north-1.amazonaws.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"cpintermedia-net-controlpanel-login-clienttypewebmail8557576565.s3.eu-north-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000953; classtype:social-engineering; sid:6000953; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.coenbzaisecolagihfg.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.coenbzaisecolagihfg.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000954; classtype:social-engineering; sid:6000954; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xelquna-gld-lormeta-r8t6fc57.pages.dev/thn-yjm-uio-lkh?welcome=613399555181802)"; flow:established,to_server; http.uri; content:"/thn-yjm-uio-lkh?welcome=613399555181802"; startswith; fast_pattern; http.host; content:"xelquna-gld-lormeta-r8t6fc57.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000955; classtype:social-engineering; sid:6000955; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (magenta-pattern-910798.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"magenta-pattern-910798.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000956; classtype:social-engineering; sid:6000956; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (g5.lu/chg2m)"; flow:established,to_server; http.uri; content:"/chg2m"; startswith; fast_pattern; http.host; content:"g5.lu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000957; classtype:social-engineering; sid:6000957; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (full-transportation-630661.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"full-transportation-630661.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000958; classtype:social-engineering; sid:6000958; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail-owa-auth-login-aspx-turbo-garbanzo-production-dc03.up.railway.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mail-owa-auth-login-aspx-turbo-garbanzo-production-dc03.up.railway.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000959; classtype:social-engineering; sid:6000959; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (httpsmybusiness.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"httpsmybusiness.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000960; classtype:social-engineering; sid:6000960; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct-hovek-biz8-lurem-vanix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct-hovek-biz8-lurem-vanix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000961; classtype:social-engineering; sid:6000961; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eassstlinkkksettings.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eassstlinkkksettings.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000962; classtype:social-engineering; sid:6000962; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dashboardaccount-moviepremiumnetfix.129-121-114-233.cpanel.site/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"dashboardaccount-moviepremiumnetfix.129-121-114-233.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000963; classtype:social-engineering; sid:6000963; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lakshnyaadhikari.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"lakshnyaadhikari.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000964; classtype:social-engineering; sid:6000964; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prime-video.club/?token=7d2443fb)"; flow:established,to_server; http.uri; content:"/?token=7d2443fb"; startswith; fast_pattern; http.host; content:"prime-video.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000965; classtype:social-engineering; sid:6000965; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox.ly/login?returnUrl=1920654935196876)"; flow:established,to_server; http.uri; content:"/login?returnUrl=1920654935196876"; startswith; fast_pattern; http.host; content:"www.roblox.ly"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000966; classtype:social-engineering; sid:6000966; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebooknenys.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.facebooknenys.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000967; classtype:social-engineering; sid:6000967; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clone-login-facebook.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clone-login-facebook.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000968; classtype:social-engineering; sid:6000968; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (storied-jelly-94f299.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"storied-jelly-94f299.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000969; classtype:social-engineering; sid:6000969; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j138k.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j138k.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000970; classtype:social-engineering; sid:6000970; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (121gle.senes.at/stakings/?b=YTo0OntzOjU6ImxhYmVsIjtzOjA6IiI7czozOiJ1c3IiO2k6MTY0NDtzOjQ6Im5vcGQiO3M6MTQ6InJzczIuc2F5bGVyLmF0IjtzOjE6Im8iO2k6MTEzNjt9)"; flow:established,to_server; http.uri; content:"/stakings/?b=YTo0OntzOjU6ImxhYmVsIjtzOjA6IiI7czozOiJ1c3IiO2k6MTY0NDtzOjQ6Im5vcGQiO3M6MTQ6InJzczIuc2F5bGVyLmF0IjtzOjE6Im8iO2k6MTEzNjt9"; startswith; fast_pattern; http.host; content:"121gle.senes.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000971; classtype:social-engineering; sid:6000971; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vicomdirect.in/nkylawyers)"; flow:established,to_server; http.uri; content:"/nkylawyers"; startswith; fast_pattern; http.host; content:"vicomdirect.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000972; classtype:social-engineering; sid:6000972; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (link-magics.lovable.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"link-magics.lovable.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000973; classtype:social-engineering; sid:6000973; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (25thr777.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"25thr777.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000974; classtype:social-engineering; sid:6000974; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j87j.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j87j.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000975; classtype:social-engineering; sid:6000975; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-eu.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-eu.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000976; classtype:social-engineering; sid:6000976; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bnpparibas.mitarbeitervorteile.de/login-input.action)"; flow:established,to_server; http.uri; content:"/login-input.action"; startswith; fast_pattern; http.host; content:"bnpparibas.mitarbeitervorteile.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000977; classtype:social-engineering; sid:6000977; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (leigerd-li-ve-learn.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"leigerd-li-ve-learn.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000978; classtype:social-engineering; sid:6000978; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (octresearch.org/wp-content/plugins/lgfpgws/ZZ/dmlkorea.html)"; flow:established,to_server; http.uri; content:"/wp-content/plugins/lgfpgws/ZZ/dmlkorea.html"; startswith; fast_pattern; http.host; content:"octresearch.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000979; classtype:social-engineering; sid:6000979; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trzorr-io-start-en.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trzorr-io-start-en.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000980; classtype:social-engineering; sid:6000980; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (php-web-server--unittec.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"php-web-server--unittec.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000981; classtype:social-engineering; sid:6000981; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mfacebookloginn.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mfacebookloginn.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000982; classtype:social-engineering; sid:6000982; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (publicmaislimite.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"publicmaislimite.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000983; classtype:social-engineering; sid:6000983; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinbase2020.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"coinbase2020.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000984; classtype:social-engineering; sid:6000984; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (defiant-violet-313848.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"defiant-violet-313848.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000985; classtype:social-engineering; sid:6000985; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paket.info.20-215-187-250.cpanel.site/de/update.php)"; flow:established,to_server; http.uri; content:"/de/update.php"; startswith; fast_pattern; http.host; content:"paket.info.20-215-187-250.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000986; classtype:social-engineering; sid:6000986; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (l67kf-2g6-bou-fov1-6ex-v73t83.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"l67kf-2g6-bou-fov1-6ex-v73t83.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000987; classtype:social-engineering; sid:6000987; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bersatu.me/N3HVnw)"; flow:established,to_server; http.uri; content:"/N3HVnw"; startswith; fast_pattern; http.host; content:"bersatu.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000988; classtype:social-engineering; sid:6000988; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (minimum-personalization-528224.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"minimum-personalization-528224.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000989; classtype:social-engineering; sid:6000989; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robiox.com.gr/communities/769052881/Gram-Grade)"; flow:established,to_server; http.uri; content:"/communities/769052881/Gram-Grade"; startswith; fast_pattern; http.host; content:"robiox.com.gr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000990; classtype:social-engineering; sid:6000990; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (us1-cloud-storage-online-document-sign-review-l048694-k04869.b-cdn.net/app/index.html)"; flow:established,to_server; http.uri; content:"/app/index.html"; startswith; fast_pattern; http.host; content:"us1-cloud-storage-online-document-sign-review-l048694-k04869.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000991; classtype:social-engineering; sid:6000991; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (broad-days-230559.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"broad-days-230559.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000992; classtype:social-engineering; sid:6000992; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (byycart.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"byycart.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000993; classtype:social-engineering; sid:6000993; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinityajsj-pao.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinityajsj-pao.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000994; classtype:social-engineering; sid:6000994; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.loginfacebook3.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.loginfacebook3.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000995; classtype:social-engineering; sid:6000995; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dashboardaccount-moviepremiumnetfix.129-121-114-233.cpanel.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.dashboardaccount-moviepremiumnetfix.129-121-114-233.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000996; classtype:social-engineering; sid:6000996; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whatsappzoeiras.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsappzoeiras.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000997; classtype:social-engineering; sid:6000997; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (areasegura.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"areasegura.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000998; classtype:social-engineering; sid:6000998; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.clone-login-facebook.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.clone-login-facebook.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6000999; classtype:social-engineering; sid:6000999; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-plarnor-biz-drulvik-qolnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-plarnor-biz-drulvik-qolnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001000; classtype:social-engineering; sid:6001000; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (25fshop77.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"25fshop77.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001001; classtype:social-engineering; sid:6001001; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-gorvurin-biz8-durem-fasol.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-gorvurin-biz8-durem-fasol.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001002; classtype:social-engineering; sid:6001002; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nigerianembassycaracas.org/wp-admin/Miami_Lakes_Pediatrics)"; flow:established,to_server; http.uri; content:"/wp-admin/Miami_Lakes_Pediatrics"; startswith; fast_pattern; http.host; content:"nigerianembassycaracas.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001003; classtype:social-engineering; sid:6001003; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.rfhtecnologia.com.br/pam/)"; flow:established,to_server; http.uri; content:"/pam/"; startswith; fast_pattern; http.host; content:"www.rfhtecnologia.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001004; classtype:social-engineering; sid:6001004; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (magenta-designers-978286.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"magenta-designers-978286.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001005; classtype:social-engineering; sid:6001005; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.evidaa.com/p/p/ZGUyNzc1YTUtZDJiYi00NzQ1LWJkMGMtMmYxN2VmMzQ3N2EwXzVjNGM2ZjQ0LTg3MzYtNGQ0Mi1iODNkLTFjZWM5YzY4Mzg3ZV9rdXZleXR0dXJr)"; flow:established,to_server; http.uri; content:"/p/p/ZGUyNzc1YTUtZDJiYi00NzQ1LWJkMGMtMmYxN2VmMzQ3N2EwXzVjNGM2ZjQ0LTg3MzYtNGQ0Mi1iODNkLTFjZWM5YzY4Mzg3ZV9rdXZleXR0dXJr"; startswith; fast_pattern; http.host; content:"www.evidaa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001006; classtype:social-engineering; sid:6001006; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wawacomcomcom.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wawacomcomcom.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001007; classtype:social-engineering; sid:6001007; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (weitereisung.click/s/CGfJL3)"; flow:established,to_server; http.uri; content:"/s/CGfJL3"; startswith; fast_pattern; http.host; content:"weitereisung.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001008; classtype:social-engineering; sid:6001008; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hdhep.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hdhep.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001009; classtype:social-engineering; sid:6001009; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steamcommnumity.cam/tradeoffer/new/partner=483172147token=t02tMARO751294)"; flow:established,to_server; http.uri; content:"/tradeoffer/new/partner=483172147token=t02tMARO751294"; startswith; fast_pattern; http.host; content:"steamcommnumity.cam"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001010; classtype:social-engineering; sid:6001010; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct-ramev-biz8-surex-kolin.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct-ramev-biz8-surex-kolin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001011; classtype:social-engineering; sid:6001011; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (visual-mango-396940.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"visual-mango-396940.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001012; classtype:social-engineering; sid:6001012; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (segurossurah360.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"segurossurah360.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001013; classtype:social-engineering; sid:6001013; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebooklogin17.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebooklogin17.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001014; classtype:social-engineering; sid:6001014; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.outlookweb006.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.outlookweb006.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001015; classtype:social-engineering; sid:6001015; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j80l.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j80l.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001016; classtype:social-engineering; sid:6001016; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aware-seat-774154.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aware-seat-774154.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001017; classtype:social-engineering; sid:6001017; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (techguy005216.github.io/CRM)"; flow:established,to_server; http.uri; content:"/CRM"; startswith; fast_pattern; http.host; content:"techguy005216.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001018; classtype:social-engineering; sid:6001018; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stymm67.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"stymm67.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001019; classtype:social-engineering; sid:6001019; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct-sureq-biz8-vonel-harik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct-sureq-biz8-vonel-harik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001020; classtype:social-engineering; sid:6001020; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yxrrggaulragjcrjugzj.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yxrrggaulragjcrjugzj.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001021; classtype:social-engineering; sid:6001021; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (leger-live-doc-io.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"leger-live-doc-io.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001022; classtype:social-engineering; sid:6001022; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usaawebconnect.ns01.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"usaawebconnect.ns01.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001023; classtype:social-engineering; sid:6001023; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-native.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-native.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001024; classtype:social-engineering; sid:6001024; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.njjiulong.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.njjiulong.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001025; classtype:social-engineering; sid:6001025; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rotating-language-501995.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rotating-language-501995.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001026; classtype:social-engineering; sid:6001026; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ewxewxewx-41i.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ewxewxewx-41i.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001027; classtype:social-engineering; sid:6001027; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (solarys1998-sys.github.io/mark/)"; flow:established,to_server; http.uri; content:"/mark/"; startswith; fast_pattern; http.host; content:"solarys1998-sys.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001028; classtype:social-engineering; sid:6001028; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct-furem-biz8-lasek-horin.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct-furem-biz8-lasek-horin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001029; classtype:social-engineering; sid:6001029; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-uphlood.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app-uphlood.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001030; classtype:social-engineering; sid:6001030; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (welkineng.com/onedrivesettingtoenglish.html)"; flow:established,to_server; http.uri; content:"/onedrivesettingtoenglish.html"; startswith; fast_pattern; http.host; content:"welkineng.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001031; classtype:social-engineering; sid:6001031; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-project-with-java-script.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-project-with-java-script.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001032; classtype:social-engineering; sid:6001032; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.tpp.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.tpp.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001033; classtype:social-engineering; sid:6001033; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (panfetdelimite.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"panfetdelimite.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001034; classtype:social-engineering; sid:6001034; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bigshopee24.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bigshopee24.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001035; classtype:social-engineering; sid:6001035; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.apkguide.online/TileFlip-Free-Robux.php)"; flow:established,to_server; http.uri; content:"/TileFlip-Free-Robux.php"; startswith; fast_pattern; http.host; content:"www.apkguide.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001036; classtype:social-engineering; sid:6001036; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (consulta-si-erees-beneficiariio.hstn.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"consulta-si-erees-beneficiariio.hstn.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001037; classtype:social-engineering; sid:6001037; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yhtpw.net/mingtuab/heyausa)"; flow:established,to_server; http.uri; content:"/mingtuab/heyausa"; startswith; fast_pattern; http.host; content:"yhtpw.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001038; classtype:social-engineering; sid:6001038; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-live--app.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-live--app.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001039; classtype:social-engineering; sid:6001039; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hungry-league-681458.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hungry-league-681458.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001040; classtype:social-engineering; sid:6001040; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfupgradereset.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfupgradereset.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001041; classtype:social-engineering; sid:6001041; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (y32b.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"y32b.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001042; classtype:social-engineering; sid:6001042; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pazararna.com/p/p/ZGUyNzc1YTUtZDJiYi00NzQ1LWJkMGMtMmYxN2VmMzQ3N2EwXzVjNGM2ZjQ0LTg3MzYtNGQ0Mi1iODNkLTFjZWM5YzY4Mzg3ZV9rdXZleXR0dXJr)"; flow:established,to_server; http.uri; content:"/p/p/ZGUyNzc1YTUtZDJiYi00NzQ1LWJkMGMtMmYxN2VmMzQ3N2EwXzVjNGM2ZjQ0LTg3MzYtNGQ0Mi1iODNkLTFjZWM5YzY4Mzg3ZV9rdXZleXR0dXJr"; startswith; fast_pattern; http.host; content:"www.pazararna.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001043; classtype:social-engineering; sid:6001043; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rbcode.net/v/3afd0f6190540ae44622e14d6e0a25a7)"; flow:established,to_server; http.uri; content:"/v/3afd0f6190540ae44622e14d6e0a25a7"; startswith; fast_pattern; http.host; content:"rbcode.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001044; classtype:social-engineering; sid:6001044; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docu434.zfos.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"docu434.zfos.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001045; classtype:social-engineering; sid:6001045; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cjmcbride28.github.io/Ledgers/)"; flow:established,to_server; http.uri; content:"/Ledgers/"; startswith; fast_pattern; http.host; content:"cjmcbride28.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001046; classtype:social-engineering; sid:6001046; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (poojayadav40.github.io/amazon_ui_clone/)"; flow:established,to_server; http.uri; content:"/amazon_ui_clone/"; startswith; fast_pattern; http.host; content:"poojayadav40.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001047; classtype:social-engineering; sid:6001047; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nnum-4679-yyrc.cole-poppfloors-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nnum-4679-yyrc.cole-poppfloors-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001048; classtype:social-engineering; sid:6001048; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2547rr.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2547rr.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001049; classtype:social-engineering; sid:6001049; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (photsinsstagrmss.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"photsinsstagrmss.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001050; classtype:social-engineering; sid:6001050; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uvulprojectfy.tgbnj.asia/fengsqwv/dfiosud/)"; flow:established,to_server; http.uri; content:"/fengsqwv/dfiosud/"; startswith; fast_pattern; http.host; content:"uvulprojectfy.tgbnj.asia"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001051; classtype:social-engineering; sid:6001051; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wonderful-customers-149426.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wonderful-customers-149426.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001052; classtype:social-engineering; sid:6001052; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thoughtful-galaxy-390661.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"thoughtful-galaxy-390661.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001053; classtype:social-engineering; sid:6001053; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amusing-estimate-626643.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amusing-estimate-626643.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001054; classtype:social-engineering; sid:6001054; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (skymaiilservice.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"skymaiilservice.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001055; classtype:social-engineering; sid:6001055; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tstanpayeifyts.s3.us-east-005.backblazeb2.com/MTS_Mail-2.html)"; flow:established,to_server; http.uri; content:"/MTS_Mail-2.html"; startswith; fast_pattern; http.host; content:"tstanpayeifyts.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001056; classtype:social-engineering; sid:6001056; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.flow.page/att-paymentinfoupdate-portal)"; flow:established,to_server; http.uri; content:"/att-paymentinfoupdate-portal"; startswith; fast_pattern; http.host; content:"www.flow.page"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001057; classtype:social-engineering; sid:6001057; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sujlskkedh.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sujlskkedh.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001058; classtype:social-engineering; sid:6001058; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (elaslicity-bot.github.io/Crypto_V1/)"; flow:established,to_server; http.uri; content:"/Crypto_V1/"; startswith; fast_pattern; http.host; content:"elaslicity-bot.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001059; classtype:social-engineering; sid:6001059; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (positive-spots-703732.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"positive-spots-703732.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001060; classtype:social-engineering; sid:6001060; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aiai-lovers.com/maimai/insta/)"; flow:established,to_server; http.uri; content:"/maimai/insta/"; startswith; fast_pattern; http.host; content:"aiai-lovers.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001061; classtype:social-engineering; sid:6001061; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (altruistic-psychology-794163.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"altruistic-psychology-794163.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001062; classtype:social-engineering; sid:6001062; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bankofamerica-security.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bankofamerica-security.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001063; classtype:social-engineering; sid:6001063; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dynamicfacebook.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.dynamicfacebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001064; classtype:social-engineering; sid:6001064; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tvxplqmrzn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tvxplqmrzn.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001065; classtype:social-engineering; sid:6001065; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi212.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"info-resmi212.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001066; classtype:social-engineering; sid:6001066; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.zqtrvmplnx.icu/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.zqtrvmplnx.icu"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001067; classtype:social-engineering; sid:6001067; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tplqzrmnvx.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tplqzrmnvx.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001068; classtype:social-engineering; sid:6001068; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.dpdccak.cfd/co.uk/)"; flow:established,to_server; http.uri; content:"/co.uk/"; startswith; fast_pattern; http.host; content:"dpd.dpdccak.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001069; classtype:social-engineering; sid:6001069; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi782.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"info-resmi782.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001070; classtype:social-engineering; sid:6001070; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.plzqtrvnmx.icu/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.plzqtrvnmx.icu"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001071; classtype:social-engineering; sid:6001071; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (started-ssoapps.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"started-ssoapps.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001072; classtype:social-engineering; sid:6001072; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (screen-desktoplive.wixstudio.com/desktop)"; flow:established,to_server; http.uri; content:"/desktop"; startswith; fast_pattern; http.host; content:"screen-desktoplive.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001073; classtype:social-engineering; sid:6001073; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (subdomain.vdtronwebrriel.sbs/indexhtml)"; flow:established,to_server; http.uri; content:"/indexhtml"; startswith; fast_pattern; http.host; content:"subdomain.vdtronwebrriel.sbs"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001074; classtype:social-engineering; sid:6001074; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.cgd.pt/cdoOBA/login.seam?ref=3f3e1ac2300e91427aa77e420e92d00ad1)"; flow:established,to_server; http.uri; content:"/cdoOBA/login.seam?ref=3f3e1ac2300e91427aa77e420e92d00ad1"; startswith; fast_pattern; http.host; content:"app.cgd.pt"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001075; classtype:social-engineering; sid:6001075; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutch.towingservicenewjersey.com/receive/order/Aan5brHvjPK?r=0x14&__cf_chl_rt_tk=GL35VZUeFmCNfOxi7PCjsNKuGEJgYT4ya3rv_zaoD48-1780155288-1.0.1.1-L7yKZST7uyah9X.dSohSEJAPZLAYYP41yte6JorFswg)"; flow:established,to_server; http.uri; content:"/receive/order/Aan5brHvjPK?r=0x14&__cf_chl_rt_tk=GL35VZUeFmCNfOxi7PCjsNKuGEJgYT4ya3rv_zaoD48-1780155288-1.0.1.1-L7yKZST7uyah9X.dSohSEJAPZLAYYP41yte6JorFswg"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutch.towingservicenewjersey.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001076; classtype:social-engineering; sid:6001076; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (de.colomboag.ch/index.php?site=%22%2F%3E%3Cimg%20src%3D%22https%3A%2F%2Fgoogle.com%2FtB75rXsgzm59O.jpg%22%20onerror%3D%22window.location%3DdecodeURIComponent%28atob%28%27Njg3NDc0NzA3MzNhMmYyZjY1NzI3NDc2NzA2MTc2NjQ3YTZmNmU2NDJlMzAzMjMxMzEzMTMwNjYzNjJkMzUzMTM0MzYyZDM0NjE2NDM3MmQ2MTYyNjYzMDJkNjIzOTMxNjE2NDY2Mzg2NDM1NjY2NjMzMmU2MzZjNjk2MzZiMmY2MTYyMzczNTMzMzgzMTMzMmQzNjM1NjIzODJkMzQzOTM3MzAyZDM5Mzk2NDM0MmQ2MjMyNjIzMjYxNjI2MzMyMzEzMjY1MzYyZTcwNjg3MA%3D%3D%27%29.replace%28%2F%28..%29%2Fg%2C%20%27%25%241%27%29%29%3B%22%3E)"; flow:established,to_server; http.uri; content:"/index.php?site=%22%2F%3E%3Cimg%20src%3D%22https%3A%2F%2Fgoogle.com%2FtB75rXsgzm59O.jpg%22%20onerror%3D%22window.location%3DdecodeURIComponent%28atob%28%27Njg3NDc0NzA3MzNhMmYyZjY1NzI3NDc2NzA2MTc2NjQ3YTZmNmU2NDJlMzAzMjMxMzEzMTMwNjYzNjJkMzUzMTM0MzYyZDM0NjE2NDM3MmQ2MTYyNjYzMDJkNjIzOTMxNjE2NDY2Mzg2NDM1NjY2NjMzMmU2MzZjNjk2MzZiMmY2MTYyMzczNTMzMzgzMTMzMmQzNjM1NjIzODJkMzQzOTM3MzAyZDM5Mzk2NDM0MmQ2MjMyNjIzMjYxNjI2MzMyMzEzMjY1MzYyZTcwNjg3MA%3D%3D%27%29.replace%28%2F%28..%29%2Fg%2C%20%27%25%241%27%29%29%3B%22%3E"; startswith; fast_pattern; http.host; content:"de.colomboag.ch"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001077; classtype:social-engineering; sid:6001077; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qr-paydaygoto2.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qr-paydaygoto2.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001078; classtype:social-engineering; sid:6001078; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ameli-et-moi.my/pages/ban.php)"; flow:established,to_server; http.uri; content:"/pages/ban.php"; startswith; fast_pattern; http.host; content:"ameli-et-moi.my"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001079; classtype:social-engineering; sid:6001079; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trexorcdn-global.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"trexorcdn-global.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001080; classtype:social-engineering; sid:6001080; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ffaffx.021110f6-5146-4ad7-abf0-b91adf8d5ff3.click/ab753813-65b8-4970-99d4-b2b2abc212e6.php)"; flow:established,to_server; http.uri; content:"/ab753813-65b8-4970-99d4-b2b2abc212e6.php"; startswith; fast_pattern; http.host; content:"ffaffx.021110f6-5146-4ad7-abf0-b91adf8d5ff3.click"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001081; classtype:social-engineering; sid:6001081; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nav-ledgorsso.wixstudio.com/desktop)"; flow:established,to_server; http.uri; content:"/desktop"; startswith; fast_pattern; http.host; content:"nav-ledgorsso.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001082; classtype:social-engineering; sid:6001082; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (homepage-bridgeus.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"homepage-bridgeus.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001083; classtype:social-engineering; sid:6001083; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (espace-destinataire.com/pages/captcha.php)"; flow:established,to_server; http.uri; content:"/pages/captcha.php"; startswith; fast_pattern; http.host; content:"espace-destinataire.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001084; classtype:social-engineering; sid:6001084; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acessousuariomaster.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"acessousuariomaster.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001085; classtype:social-engineering; sid:6001085; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fcalertscd.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fcalertscd.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001086; classtype:social-engineering; sid:6001086; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rtfreeski.com/wp-admin/access.php?r=bD1odHRwczovL2RxcmRidi5jb20v)"; flow:established,to_server; http.uri; content:"/wp-admin/access.php?r=bD1odHRwczovL2RxcmRidi5jb20v"; startswith; fast_pattern; http.host; content:"rtfreeski.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001087; classtype:social-engineering; sid:6001087; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creativetrnd.wixstudio.com/mathieu-arsenault/en/qui-est-mathieu-arsenault)"; flow:established,to_server; http.uri; content:"/mathieu-arsenault/en/qui-est-mathieu-arsenault"; startswith; fast_pattern; http.host; content:"creativetrnd.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001088; classtype:social-engineering; sid:6001088; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-index--cryptosapp.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-index--cryptosapp.webflow.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001089; classtype:social-engineering; sid:6001089; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco.praempresas.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bradesco.praempresas.sbs"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001090; classtype:social-engineering; sid:6001090; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accountrogershop.com/cgi-sys/suspendedpage.cgi)"; flow:established,to_server; http.uri; content:"/cgi-sys/suspendedpage.cgi"; startswith; fast_pattern; http.host; content:"accountrogershop.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001091; classtype:social-engineering; sid:6001091; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (societegenerale-particuliers.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"societegenerale-particuliers.bolt.host"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001092; classtype:social-engineering; sid:6001092; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p28a.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p28a.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001093; classtype:social-engineering; sid:6001093; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (black-brook-8ab7.5a73cbc5.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"black-brook-8ab7.5a73cbc5.workers.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001094; classtype:social-engineering; sid:6001094; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pt-shopee0002.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"pt-shopee0002.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001095; classtype:social-engineering; sid:6001095; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (funciona.com.br/Tv8Qa2Lm7Hs4Y1DfR6BnU3GjW0PkCi5NuYq2RtK9EcLm1QaT4VpDf3GnUbJ5Xc/QWp7Hs2Qa9Lp4TvY1DfR6BnU3GjW0PkCi5XtKq2RyV8EcLm1QaT4DfGn3UbJ5Nua8Lp2Hs7TvY4DfR1BnU3GjW0PkWi5NuYq2RtK9EcLm1Hs4VpT7Df3GnUbJ5Cx/microsoft/)"; flow:established,to_server; http.uri; content:"/Tv8Qa2Lm7Hs4Y1DfR6BnU3GjW0PkCi5NuYq2RtK9EcLm1QaT4VpDf3GnUbJ5Xc/QWp7Hs2Qa9Lp4TvY1DfR6BnU3GjW0PkCi5XtKq2RyV8EcLm1QaT4DfGn3UbJ5Nua8Lp2Hs7TvY4DfR1BnU3GjW0PkWi5NuYq2RtK9EcLm1Hs4VpT7Df3GnUbJ5Cx/microsoft/"; startswith; fast_pattern; http.host; content:"funciona.com.br"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001096; classtype:social-engineering; sid:6001096; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.czqplwn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.czqplwn.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001097; classtype:social-engineering; sid:6001097; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgarliveslog.framer.media/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgarliveslog.framer.media"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001098; classtype:social-engineering; sid:6001098; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.cxmvprt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.cxmvprt.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001099; classtype:social-engineering; sid:6001099; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kyragaming.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kyragaming.info"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001100; classtype:social-engineering; sid:6001100; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi781.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi781.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001101; classtype:social-engineering; sid:6001101; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqzwknq.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqzwknq.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001102; classtype:social-engineering; sid:6001102; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tregar-io-start-us.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tregar-io-start-us.wasmer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001103; classtype:social-engineering; sid:6001103; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tnqzpvr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tnqzpvr.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001104; classtype:social-engineering; sid:6001104; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j72w.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j72w.vip"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001105; classtype:social-engineering; sid:6001105; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j72j.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j72j.vip"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001106; classtype:social-engineering; sid:6001106; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zttgroulp.com/sos/wmalln.html)"; flow:established,to_server; http.uri; content:"/sos/wmalln.html"; startswith; fast_pattern; http.host; content:"zttgroulp.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001107; classtype:social-engineering; sid:6001107; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.chkfortnite.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.chkfortnite.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001108; classtype:social-engineering; sid:6001108; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (princesleonorvipwebsitesreal.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"princesleonorvipwebsitesreal.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001109; classtype:social-engineering; sid:6001109; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.dpdccar.cfd/co.uk)"; flow:established,to_server; http.uri; content:"/co.uk"; startswith; fast_pattern; http.host; content:"dpd.dpdccar.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001110; classtype:social-engineering; sid:6001110; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-qravnik-biz-fravtek-plarnix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-qravnik-biz-fravtek-plarnix.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001111; classtype:social-engineering; sid:6001111; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (submit-verify-lifetime-blue.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"submit-verify-lifetime-blue.surge.sh"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001112; classtype:social-engineering; sid:6001112; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqtmzvp.ink/track/)"; flow:established,to_server; http.uri; content:"/track/"; startswith; fast_pattern; http.host; content:"dpd.rqtmzvp.ink"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001113; classtype:social-engineering; sid:6001113; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yi1-aqbyb4gkapb0d5dd.z02.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yi1-aqbyb4gkapb0d5dd.z02.azurefd.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001114; classtype:social-engineering; sid:6001114; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqtmxvl.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqtmxvl.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001115; classtype:social-engineering; sid:6001115; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1615666999.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1615666999.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001116; classtype:social-engineering; sid:6001116; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kzwrplq.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kzwrplq.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001117; classtype:social-engineering; sid:6001117; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b30o.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b30o.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001118; classtype:social-engineering; sid:6001118; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.yzz.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.yzz.my.id"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001119; classtype:social-engineering; sid:6001119; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (microsoft-1ogin.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"microsoft-1ogin.duckdns.org"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001120; classtype:social-engineering; sid:6001120; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gnzwrpl.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gnzwrpl.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001121; classtype:social-engineering; sid:6001121; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.inforesmi099.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.inforesmi099.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001122; classtype:social-engineering; sid:6001122; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (security-hub--halebowdondenta.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"security-hub--halebowdondenta.replit.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001123; classtype:social-engineering; sid:6001123; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-plornok-biz-fraptek-slurnix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-plornok-biz-fraptek-slurnix.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001124; classtype:social-engineering; sid:6001124; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zenn-dot.github.io/Smart_Netflix/)"; flow:established,to_server; http.uri; content:"/Smart_Netflix/"; startswith; fast_pattern; http.host; content:"zenn-dot.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001125; classtype:social-engineering; sid:6001125; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zb22.cc/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"zb22.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001126; classtype:social-engineering; sid:6001126; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqtxmvl.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqtxmvl.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001127; classtype:social-engineering; sid:6001127; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (97ee7.catex.at/cnbcard/?b=YTo0OntzOjU6ImxhYmVsIjtzOjI6IjQ5IjtzOjM6InVzciI7aToxNjE2O3M6NDoibm9wZCI7czoxNDoicnNzLnJlYWRsZXMuYXQiO3M6MToibyI7aToyMTM1O30=)"; flow:established,to_server; http.uri; content:"/cnbcard/?b=YTo0OntzOjU6ImxhYmVsIjtzOjI6IjQ5IjtzOjM6InVzciI7aToxNjE2O3M6NDoibm9wZCI7czoxNDoicnNzLnJlYWRsZXMuYXQiO3M6MToibyI7aToyMTM1O30="; startswith; fast_pattern; http.host; content:"97ee7.catex.at"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001128; classtype:social-engineering; sid:6001128; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.k68h.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.k68h.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001129; classtype:social-engineering; sid:6001129; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bigsaleshopee359.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bigsaleshopee359.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001130; classtype:social-engineering; sid:6001130; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jplnzwq.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jplnzwq.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001131; classtype:social-engineering; sid:6001131; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hjvqtrp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.hjvqtrp.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001132; classtype:social-engineering; sid:6001132; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fqznplr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.fqznplr.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001133; classtype:social-engineering; sid:6001133; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecuad0r-your-access-001.free.nf/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ecuad0r-your-access-001.free.nf"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001134; classtype:social-engineering; sid:6001134; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflixy-bixy.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflixy-bixy.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001135; classtype:social-engineering; sid:6001135; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qznvplmtrx.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.qznvplmtrx.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001136; classtype:social-engineering; sid:6001136; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi774.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi774.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001137; classtype:social-engineering; sid:6001137; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.czplnwr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.czplnwr.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001138; classtype:social-engineering; sid:6001138; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gqtmwrp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gqtmwrp.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001139; classtype:social-engineering; sid:6001139; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jxtrmql.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jxtrmql.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001140; classtype:social-engineering; sid:6001140; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (15673.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"15673.xyz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001141; classtype:social-engineering; sid:6001141; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-vrolnex-biz-qravlor-glavrix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-vrolnex-biz-qravlor-glavrix.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001142; classtype:social-engineering; sid:6001142; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hk.uat.mizuhoscfglobal.com/scf/login?error)"; flow:established,to_server; http.uri; content:"/scf/login?error"; startswith; fast_pattern; http.host; content:"hk.uat.mizuhoscfglobal.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001143; classtype:social-engineering; sid:6001143; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (layconf80-boop.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"layconf80-boop.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001144; classtype:social-engineering; sid:6001144; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ee1505.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ee1505.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001145; classtype:social-engineering; sid:6001145; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gnwzrqp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gnwzrqp.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001146; classtype:social-engineering; sid:6001146; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqtxmvp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqtxmvp.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001147; classtype:social-engineering; sid:6001147; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kpmxqvt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kpmxqvt.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001148; classtype:social-engineering; sid:6001148; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvxqtrp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bvxqtrp.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001149; classtype:social-engineering; sid:6001149; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-fraptek-biz-slurnax-qolnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-fraptek-biz-slurnax-qolnex.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001150; classtype:social-engineering; sid:6001150; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tralalero-user.bandit.wtf/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tralalero-user.bandit.wtf"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001151; classtype:social-engineering; sid:6001151; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rajshreek651.github.io/ProjectAmazon-LandingPage/)"; flow:established,to_server; http.uri; content:"/ProjectAmazon-LandingPage/"; startswith; fast_pattern; http.host; content:"rajshreek651.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001152; classtype:social-engineering; sid:6001152; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toxic-adeayo.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"toxic-adeayo.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001153; classtype:social-engineering; sid:6001153; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (humanresources.website/page/a681c378e23f13fd5ba5247d2c55da0a038b3f03)"; flow:established,to_server; http.uri; content:"/page/a681c378e23f13fd5ba5247d2c55da0a038b3f03"; startswith; fast_pattern; http.host; content:"humanresources.website"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001154; classtype:social-engineering; sid:6001154; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeeid101.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopeeid101.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001155; classtype:social-engineering; sid:6001155; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fqplznv.cloud/track/)"; flow:established,to_server; http.uri; content:"/track/"; startswith; fast_pattern; http.host; content:"dpd.fqplznv.cloud"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001156; classtype:social-engineering; sid:6001156; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.boniuwen.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.boniuwen.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001157; classtype:social-engineering; sid:6001157; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwe.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwe.cyou"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001158; classtype:social-engineering; sid:6001158; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kplxqvr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kplxqvr.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001159; classtype:social-engineering; sid:6001159; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hvxptrq.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.hvxptrq.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001160; classtype:social-engineering; sid:6001160; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi465.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi465.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001161; classtype:social-engineering; sid:6001161; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nnnn195.com/m/)"; flow:established,to_server; http.uri; content:"/m/"; startswith; fast_pattern; http.host; content:"nnnn195.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001162; classtype:social-engineering; sid:6001162; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwd.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingwd.cyou"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001163; classtype:social-engineering; sid:6001163; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jplwnqr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jplwnqr.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001164; classtype:social-engineering; sid:6001164; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gnwrqpl.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gnwrqpl.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001165; classtype:social-engineering; sid:6001165; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreibjfpmextex4uxucejwm4huyvvlgattxhddtqio4cmj3h4zafhzzu.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreibjfpmextex4uxucejwm4huyvvlgattxhddtqio4cmj3h4zafhzzu.ipfs.dweb.link"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001166; classtype:social-engineering; sid:6001166; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwa.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwa.cyou"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001167; classtype:social-engineering; sid:6001167; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (joeueiu.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"joeueiu.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001168; classtype:social-engineering; sid:6001168; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi212.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi212.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001169; classtype:social-engineering; sid:6001169; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aitptest.com/?rid=nsqfVze)"; flow:established,to_server; http.uri; content:"/?rid=nsqfVze"; startswith; fast_pattern; http.host; content:"aitptest.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001170; classtype:social-engineering; sid:6001170; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hvzplqn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.hvzplqn.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001171; classtype:social-engineering; sid:6001171; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.p-pagamentoseguro.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.p-pagamentoseguro.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001172; classtype:social-engineering; sid:6001172; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (y28m.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"y28m.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001173; classtype:social-engineering; sid:6001173; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dna-formnindonesia.xoxoiuh.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dna-formnindonesia.xoxoiuh.biz.id"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001174; classtype:social-engineering; sid:6001174; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi919.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi919.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001175; classtype:social-engineering; sid:6001175; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi275.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi275.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001176; classtype:social-engineering; sid:6001176; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.fqplwrq.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.fqplwrq.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001177; classtype:social-engineering; sid:6001177; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqznxlp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqznxlp.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001178; classtype:social-engineering; sid:6001178; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (new-cm-edgedigital.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"new-cm-edgedigital.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001179; classtype:social-engineering; sid:6001179; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.pl-59012941.lat/oferta/97916684/amd-ryzen-7-58)"; flow:established,to_server; http.uri; content:"/oferta/97916684/amd-ryzen-7-58"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-59012941.lat"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001180; classtype:social-engineering; sid:6001180; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.pnzqwrl.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.pnzqwrl.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001181; classtype:social-engineering; sid:6001181; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x20h.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"x20h.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001182; classtype:social-engineering; sid:6001182; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tnvplkq.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tnvplkq.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001183; classtype:social-engineering; sid:6001183; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (game-mall.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"game-mall.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001184; classtype:social-engineering; sid:6001184; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqzmtvp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqzmtvp.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001185; classtype:social-engineering; sid:6001185; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqznwqk.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqznwqk.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001186; classtype:social-engineering; sid:6001186; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ghotkshop.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ghotkshop.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001187; classtype:social-engineering; sid:6001187; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shifaa07.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"shifaa07.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001188; classtype:social-engineering; sid:6001188; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-zeta-five.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-zeta-five.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001189; classtype:social-engineering; sid:6001189; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-4e0d515d9c79417e8b4042dfa120d149.r2.dev/shyfacewebnnf.html?koiclid=DtsiGAESnl)"; flow:established,to_server; http.uri; content:"/shyfacewebnnf.html?koiclid=DtsiGAESnl"; startswith; fast_pattern; http.host; content:"pub-4e0d515d9c79417e8b4042dfa120d149.r2.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001190; classtype:social-engineering; sid:6001190; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-plament-biz-travnik-vrolqar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-plament-biz-travnik-vrolqar.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001191; classtype:social-engineering; sid:6001191; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingqn.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingqn.cyou"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001192; classtype:social-engineering; sid:6001192; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bzqwnlt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bzqwnlt.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001193; classtype:social-engineering; sid:6001193; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jplnqwr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jplnqwr.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001194; classtype:social-engineering; sid:6001194; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hvplqzr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.hvplqzr.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001195; classtype:social-engineering; sid:6001195; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tmqzxvl.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tmqzxvl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001196; classtype:social-engineering; sid:6001196; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwj.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001197; classtype:social-engineering; sid:6001197; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (com--dubai-booking.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"com--dubai-booking.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001198; classtype:social-engineering; sid:6001198; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi127.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi127.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001199; classtype:social-engineering; sid:6001199; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bagqcn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bagqcn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001200; classtype:social-engineering; sid:6001200; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwh.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwh.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001201; classtype:social-engineering; sid:6001201; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortchecktop.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortchecktop.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001202; classtype:social-engineering; sid:6001202; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tmqprvx.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tmqprvx.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001203; classtype:social-engineering; sid:6001203; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mexicounidosorteos.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mexicounidosorteos.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001204; classtype:social-engineering; sid:6001204; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.nextmegamart.fun/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.nextmegamart.fun"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001205; classtype:social-engineering; sid:6001205; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wetransfer-app.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wetransfer-app.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001206; classtype:social-engineering; sid:6001206; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p28d.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p28d.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001207; classtype:social-engineering; sid:6001207; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.amznmshs-tlk.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amznmshs-tlk.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001208; classtype:social-engineering; sid:6001208; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (location-lost.info/fhn)"; flow:established,to_server; http.uri; content:"/fhn"; startswith; fast_pattern; http.host; content:"location-lost.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001209; classtype:social-engineering; sid:6001209; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fnstash.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fnstash.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001210; classtype:social-engineering; sid:6001210; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (airbnbclone-jrg8daobo-yusef-mohamed.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"airbnbclone-jrg8daobo-yusef-mohamed.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001211; classtype:social-engineering; sid:6001211; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fojsv.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.fojsv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001212; classtype:social-engineering; sid:6001212; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (k69d.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"k69d.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001213; classtype:social-engineering; sid:6001213; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unidosconmexicossorteos.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"unidosconmexicossorteos.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001214; classtype:social-engineering; sid:6001214; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi877.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi877.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001215; classtype:social-engineering; sid:6001215; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwj.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwj.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001216; classtype:social-engineering; sid:6001216; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hotflirtoffer4.com/de/de_fourthMultiStep_blue_120723)"; flow:established,to_server; http.uri; content:"/de/de_fourthMultiStep_blue_120723"; startswith; fast_pattern; http.host; content:"hotflirtoffer4.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001217; classtype:social-engineering; sid:6001217; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (edfdc0fa5e2ae6e3c6d7156f3b2ce00c.cdn.bubble.io/f1679644455398x630943732016925300/webmailf.html)"; flow:established,to_server; http.uri; content:"/f1679644455398x630943732016925300/webmailf.html"; startswith; fast_pattern; http.host; content:"edfdc0fa5e2ae6e3c6d7156f3b2ce00c.cdn.bubble.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001218; classtype:social-engineering; sid:6001218; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loss.blogbeastit.info/?app_vl=ZYFwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=solelx@fc6ed5fae4a56ff9909b3bbb3f96e465a2a5.com&sui=%7Bsui%7D&fn=Kateryna&ln=Morawik&p=&z=PLNAMERAW-2905-digi9)"; flow:established,to_server; http.uri; content:"/?app_vl=ZYFwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=solelx@fc6ed5fae4a56ff9909b3bbb3f96e465a2a5.com&sui=%7Bsui%7D&fn=Kateryna&ln=Morawik&p=&z=PLNAMERAW-2905-digi9"; startswith; fast_pattern; http.host; content:"loss.blogbeastit.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001219; classtype:social-engineering; sid:6001219; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adobeadcrobatsign.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"adobeadcrobatsign.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001220; classtype:social-engineering; sid:6001220; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.buenosayrestec.com.ar/home/Trustit/)"; flow:established,to_server; http.uri; content:"/home/Trustit/"; startswith; fast_pattern; http.host; content:"www.buenosayrestec.com.ar"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001221; classtype:social-engineering; sid:6001221; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (elevation.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"elevation.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001222; classtype:social-engineering; sid:6001222; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortoscore.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortoscore.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001223; classtype:social-engineering; sid:6001223; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinmarketcaa.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coinmarketcaa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001224; classtype:social-engineering; sid:6001224; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.betgaranti.us.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.betgaranti.us.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001225; classtype:social-engineering; sid:6001225; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h21a.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"h21a.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001226; classtype:social-engineering; sid:6001226; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortgg.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortgg.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001227; classtype:social-engineering; sid:6001227; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortweg.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortweg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001228; classtype:social-engineering; sid:6001228; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ameer-hammza.github.io/netflix-clone-practice)"; flow:established,to_server; http.uri; content:"/netflix-clone-practice"; startswith; fast_pattern; http.host; content:"ameer-hammza.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001229; classtype:social-engineering; sid:6001229; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0112573.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0112573.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001230; classtype:social-engineering; sid:6001230; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hgaxz.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hgaxz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001231; classtype:social-engineering; sid:6001231; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (safari.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"safari.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001232; classtype:social-engineering; sid:6001232; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crese-con-cred-miles.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"crese-con-cred-miles.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001233; classtype:social-engineering; sid:6001233; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fbshop161.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fbshop161.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001234; classtype:social-engineering; sid:6001234; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (claims2-esl.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"claims2-esl.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001235; classtype:social-engineering; sid:6001235; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (244eac011af63a9080fb074ee.s3.eu-central-1.amazonaws.com/c5a9eb789.html)"; flow:established,to_server; http.uri; content:"/c5a9eb789.html"; startswith; fast_pattern; http.host; content:"244eac011af63a9080fb074ee.s3.eu-central-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001236; classtype:social-engineering; sid:6001236; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (w33onm9q.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"w33onm9q.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001237; classtype:social-engineering; sid:6001237; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ladgr-live-hub.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ladgr-live-hub.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001238; classtype:social-engineering; sid:6001238; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fbshop711.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fbshop711.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001239; classtype:social-engineering; sid:6001239; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (scotiabookingsecured-booking.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"scotiabookingsecured-booking.bolt.host"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001240; classtype:social-engineering; sid:6001240; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (43.165.174.250/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"43.165.174.250"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001241; classtype:social-engineering; sid:6001241; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (r4wp8kv.hair/9ncr9hdj/0QSA9q/37untY)"; flow:established,to_server; http.uri; content:"/9ncr9hdj/0QSA9q/37untY"; startswith; fast_pattern; http.host; content:"r4wp8kv.hair"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001242; classtype:social-engineering; sid:6001242; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zamowienie216.lat/o/hxu17/1769963912159#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/hxu17/1769963912159#selectedbank9"; startswith; fast_pattern; http.host; content:"zamowienie216.lat"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001243; classtype:social-engineering; sid:6001243; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aether-marigold-quench-bracket.s3.us-east-2.amazonaws.com/j21taLDpwOxPlN?email=redacted@abuse.ionos.com)"; flow:established,to_server; http.uri; content:"/j21taLDpwOxPlN?email=redacted@abuse.ionos.com"; startswith; fast_pattern; http.host; content:"aether-marigold-quench-bracket.s3.us-east-2.amazonaws.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001244; classtype:social-engineering; sid:6001244; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ue2wgw.sbs/o/hxu17/1769963912159#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/hxu17/1769963912159#selectedbank9"; startswith; fast_pattern; http.host; content:"ue2wgw.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001245; classtype:social-engineering; sid:6001245; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vz7qxn.cfd/o/hxu17/1769963912159#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/hxu17/1769963912159#selectedbank9"; startswith; fast_pattern; http.host; content:"vz7qxn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001246; classtype:social-engineering; sid:6001246; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ehay-uk-login-secures-ww7rwgzs.carremovals247.com.au/cgi-sys/suspendedpage.cgi)"; flow:established,to_server; http.uri; content:"/cgi-sys/suspendedpage.cgi"; startswith; fast_pattern; http.host; content:"ehay-uk-login-secures-ww7rwgzs.carremovals247.com.au"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001247; classtype:social-engineering; sid:6001247; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (startledegrapp.ghost.io/live-app/)"; flow:established,to_server; http.uri; content:"/live-app/"; startswith; fast_pattern; http.host; content:"startledegrapp.ghost.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001248; classtype:social-engineering; sid:6001248; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seoma.ru/local/components/promo//red/en.html?eta=redacted@abuse.ionos.com)"; flow:established,to_server; http.uri; content:"/local/components/promo//red/en.html?eta=redacted@abuse.ionos.com"; startswith; fast_pattern; http.host; content:"seoma.ru"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001249; classtype:social-engineering; sid:6001249; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (z9vgtm.cfd/o/hxu17/1769963912159#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/hxu17/1769963912159#selectedbank9"; startswith; fast_pattern; http.host; content:"z9vgtm.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001250; classtype:social-engineering; sid:6001250; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (45tgfrt-ggg3-o04.sfo3.digitaloceanspaces.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"45tgfrt-ggg3-o04.sfo3.digitaloceanspaces.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001251; classtype:social-engineering; sid:6001251; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-bridge.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"support-bridge.zapier.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001252; classtype:social-engineering; sid:6001252; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tmzqrvxpln.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tmzqrvxpln.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001253; classtype:social-engineering; sid:6001253; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ptshopee445.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"ptshopee445.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001254; classtype:social-engineering; sid:6001254; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mipanaderiaca.com/about-us/)"; flow:established,to_server; http.uri; content:"/about-us/"; startswith; fast_pattern; http.host; content:"www.mipanaderiaca.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001255; classtype:social-engineering; sid:6001255; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (financialdept1.de/?r=9c508ec1-53cf-4223-8afa-9870f7bbbcf4)"; flow:established,to_server; http.uri; content:"/?r=9c508ec1-53cf-4223-8afa-9870f7bbbcf4"; startswith; fast_pattern; http.host; content:"financialdept1.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001256; classtype:social-engineering; sid:6001256; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bb7765.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bb7765.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001257; classtype:social-engineering; sid:6001257; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hadiahshopee-indonesia.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.hadiahshopee-indonesia.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001258; classtype:social-engineering; sid:6001258; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.exchange-microsoft.com/?session_token=JBekNvo)"; flow:established,to_server; http.uri; content:"/?session_token=JBekNvo"; startswith; fast_pattern; http.host; content:"www.exchange-microsoft.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001259; classtype:social-engineering; sid:6001259; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usa-mettmssak-s0inin.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"usa-mettmssak-s0inin.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001260; classtype:social-engineering; sid:6001260; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.hthhrp.help/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.hthhrp.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001261; classtype:social-engineering; sid:6001261; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.plzqtrmxvn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.plzqtrmxvn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001262; classtype:social-engineering; sid:6001262; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (penguinwalkalone-create.github.io/Instagram.)"; flow:established,to_server; http.uri; content:"/Instagram."; startswith; fast_pattern; http.host; content:"penguinwalkalone-create.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001263; classtype:social-engineering; sid:6001263; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hfczqs.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hfczqs.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001264; classtype:social-engineering; sid:6001264; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cloudinfolibrary.com/reports/hpe-insights313download.jsp)"; flow:established,to_server; http.uri; content:"/reports/hpe-insights313download.jsp"; startswith; fast_pattern; http.host; content:"cloudinfolibrary.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001265; classtype:social-engineering; sid:6001265; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.fycuqy.help/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.fycuqy.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001266; classtype:social-engineering; sid:6001266; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (syncethernet.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"syncethernet.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001267; classtype:social-engineering; sid:6001267; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ketuatoto.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ketuatoto.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001268; classtype:social-engineering; sid:6001268; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.cznplwr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.cznplwr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001269; classtype:social-engineering; sid:6001269; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (z2whjt.casa/o/hxu17/1769963912159#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/hxu17/1769963912159#selectedbank9"; startswith; fast_pattern; http.host; content:"z2whjt.casa"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001270; classtype:social-engineering; sid:6001270; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.lvqtrmx.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.lvqtrmx.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001271; classtype:social-engineering; sid:6001271; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9839365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9839365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001272; classtype:social-engineering; sid:6001272; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ptshopee617.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ptshopee617.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001273; classtype:social-engineering; sid:6001273; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (globalmedia.lk/www.made-in-china.com/index.html)"; flow:established,to_server; http.uri; content:"/www.made-in-china.com/index.html"; startswith; fast_pattern; http.host; content:"globalmedia.lk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001274; classtype:social-engineering; sid:6001274; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.dokxme.click/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.dokxme.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001275; classtype:social-engineering; sid:6001275; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktifkandanapayltter.amormarch.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktifkandanapayltter.amormarch.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001276; classtype:social-engineering; sid:6001276; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xqtrplnzvm.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xqtrplnzvm.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001277; classtype:social-engineering; sid:6001277; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.xavxnq.help/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.xavxnq.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001278; classtype:social-engineering; sid:6001278; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sourcing10.com/.cgi/54321.html)"; flow:established,to_server; http.uri; content:"/.cgi/54321.html"; startswith; fast_pattern; http.host; content:"sourcing10.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001279; classtype:social-engineering; sid:6001279; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vrtxqplznm.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vrtxqplznm.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001280; classtype:social-engineering; sid:6001280; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-clone-taupe-two.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-taupe-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001281; classtype:social-engineering; sid:6001281; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tvplxrmqzn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tvplxrmqzn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001282; classtype:social-engineering; sid:6001282; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.surrwa.buzz/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.surrwa.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001283; classtype:social-engineering; sid:6001283; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (topball-yes-football.games/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"topball-yes-football.games"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001284; classtype:social-engineering; sid:6001284; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imto-ken.rest/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"imto-ken.rest"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001285; classtype:social-engineering; sid:6001285; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-drulnex-biz-plornik-vromtek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-drulnex-biz-plornik-vromtek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001286; classtype:social-engineering; sid:6001286; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mypost.cpogmv.buzz/au/mon1/)"; flow:established,to_server; http.uri; content:"/au/mon1/"; startswith; fast_pattern; http.host; content:"mypost.cpogmv.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001287; classtype:social-engineering; sid:6001287; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiflcz4b7rnhk5r3w52drlysvolzauhvz4kltcq6qpzfzdajyudqm4.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiflcz4b7rnhk5r3w52drlysvolzauhvz4kltcq6qpzfzdajyudqm4.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001288; classtype:social-engineering; sid:6001288; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ufzwqk.wasmer.app/hostedbyinfocast)"; flow:established,to_server; http.uri; content:"/hostedbyinfocast"; startswith; fast_pattern; http.host; content:"ufzwqk.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001289; classtype:social-engineering; sid:6001289; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.sufsit.help/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.sufsit.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001290; classtype:social-engineering; sid:6001290; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gebyar-shopee20.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gebyar-shopee20.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001291; classtype:social-engineering; sid:6001291; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hostpoint-update.servepics.com/hostpoint/)"; flow:established,to_server; http.uri; content:"/hostpoint/"; startswith; fast_pattern; http.host; content:"hostpoint-update.servepics.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001292; classtype:social-engineering; sid:6001292; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.truttwalet.work/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.truttwalet.work"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001293; classtype:social-engineering; sid:6001293; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gunceladresler.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gunceladresler.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001294; classtype:social-engineering; sid:6001294; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.galabet-guncel-resmigiris.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.galabet-guncel-resmigiris.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001295; classtype:social-engineering; sid:6001295; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (exodus--web3--help.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"exodus--web3--help.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001296; classtype:social-engineering; sid:6001296; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hasilundianresmishopee.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hasilundianresmishopee.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001297; classtype:social-engineering; sid:6001297; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (claims1-esl.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"claims1-esl.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001298; classtype:social-engineering; sid:6001298; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365bet-go.bet/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365bet-go.bet"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001299; classtype:social-engineering; sid:6001299; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsappsemsalvarcontato.com.br/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsappsemsalvarcontato.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001300; classtype:social-engineering; sid:6001300; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-slurnik-biz-vroltek-plavrix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-slurnik-biz-vroltek-plavrix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001301; classtype:social-engineering; sid:6001301; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1615999111.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1615999111.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001302; classtype:social-engineering; sid:6001302; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1yhxpzqnpg9uhb2.s3-website-us-east-1.amazonaws.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1yhxpzqnpg9uhb2.s3-website-us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001303; classtype:social-engineering; sid:6001303; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mypost.tgvozk.buzz/au/kzmc)"; flow:established,to_server; http.uri; content:"/au/kzmc"; startswith; fast_pattern; http.host; content:"mypost.tgvozk.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001304; classtype:social-engineering; sid:6001304; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvnqzrt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bvnqzrt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001305; classtype:social-engineering; sid:6001305; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (link-dana-sekarang.dana-terbaru.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"link-dana-sekarang.dana-terbaru.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001306; classtype:social-engineering; sid:6001306; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.betrrrr.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.betrrrr.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001307; classtype:social-engineering; sid:6001307; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.galabet-haziran.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.galabet-haziran.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001308; classtype:social-engineering; sid:6001308; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sign.pensia.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sign.pensia.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001309; classtype:social-engineering; sid:6001309; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (15636.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"15636.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001310; classtype:social-engineering; sid:6001310; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dnallyanx-newfromn.fredped.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dnallyanx-newfromn.fredped.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001311; classtype:social-engineering; sid:6001311; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.trusttwallet.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.trusttwallet.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001312; classtype:social-engineering; sid:6001312; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.qzktsj.click/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.qzktsj.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001313; classtype:social-engineering; sid:6001313; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.vrqtplxnmz.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.vrqtplxnmz.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001314; classtype:social-engineering; sid:6001314; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (high-journey-042246.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"high-journey-042246.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001315; classtype:social-engineering; sid:6001315; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqtmzql.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqtmzql.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001316; classtype:social-engineering; sid:6001316; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.xvnplzrmqt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.xvnplzrmqt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001317; classtype:social-engineering; sid:6001317; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (channelhub.online/m0ae5e22epce2746dbpa266e6a2k8cd2460b.html)"; flow:established,to_server; http.uri; content:"/m0ae5e22epce2746dbpa266e6a2k8cd2460b.html"; startswith; fast_pattern; http.host; content:"channelhub.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001318; classtype:social-engineering; sid:6001318; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.tolweb.click/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.tolweb.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001319; classtype:social-engineering; sid:6001319; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nitinbhas001.github.io/HTML-Tutorial)"; flow:established,to_server; http.uri; content:"/HTML-Tutorial"; startswith; fast_pattern; http.host; content:"nitinbhas001.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001320; classtype:social-engineering; sid:6001320; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.padisahbet2.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.padisahbet2.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001321; classtype:social-engineering; sid:6001321; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.truttwalet.art/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.truttwalet.art"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001322; classtype:social-engineering; sid:6001322; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365best2.com/home)"; flow:established,to_server; http.uri; content:"/home"; startswith; fast_pattern; http.host; content:"365best2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001323; classtype:social-engineering; sid:6001323; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tnqpzvr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tnqpzvr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001324; classtype:social-engineering; sid:6001324; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kzwxpln.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kzwxpln.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001325; classtype:social-engineering; sid:6001325; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (identity-google.info/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&dsh=S-1391434002%3A1780312270343217&followup=https%3A%2F%2Faccounts.google.com%2F&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2PatgkI6aIEcIWchuNGJmgKfHIAAu4b2ToZ89mMJbxFiVUjLuMu4ZzgCHEdd8gvn9_ecwGDQA3g)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&dsh=S-1391434002%3A1780312270343217&followup=https%3A%2F%2Faccounts.google.com%2F&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AWa2PatgkI6aIEcIWchuNGJmgKfHIAAu4b2ToZ89mMJbxFiVUjLuMu4ZzgCHEdd8gvn9_ecwGDQA3g"; startswith; fast_pattern; http.host; content:"identity-google.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001326; classtype:social-engineering; sid:6001326; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.galabet1-giris.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.galabet1-giris.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001327; classtype:social-engineering; sid:6001327; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.frttib.help/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.frttib.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001328; classtype:social-engineering; sid:6001328; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (15596.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"15596.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001329; classtype:social-engineering; sid:6001329; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ldrmrdftr.esaic4.workers.dev//)"; flow:established,to_server; http.uri; content:"//"; startswith; fast_pattern; http.host; content:"ldrmrdftr.esaic4.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001330; classtype:social-engineering; sid:6001330; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mztrqplxvn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mztrqplxvn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001331; classtype:social-engineering; sid:6001331; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hyperequipments.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hyperequipments.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001332; classtype:social-engineering; sid:6001332; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pt-shopee034.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pt-shopee034.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001333; classtype:social-engineering; sid:6001333; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mxqtplrzvn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mxqtplrzvn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001334; classtype:social-engineering; sid:6001334; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mzqrvtplxn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mzqrvtplxn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001335; classtype:social-engineering; sid:6001335; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mzqtrvplxn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mzqtrvplxn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001336; classtype:social-engineering; sid:6001336; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.uzznou.help/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.uzznou.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001337; classtype:social-engineering; sid:6001337; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.adssh.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app.adssh.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001338; classtype:social-engineering; sid:6001338; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newgamingapi.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"newgamingapi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001339; classtype:social-engineering; sid:6001339; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mznrqtxplv.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mznrqtxplv.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001340; classtype:social-engineering; sid:6001340; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (download-updateledger.com/?acc=UC-wARhaZ6ak1D_rW2ez61wqsx6eZgm1ZQFON08qw2p7Mq9WgrKSDAZ3sCc-TpSslzZyvJX5kxGLz-NNoKmZb9jBDXLXERzFLK2aUbdN9nAimhjhGqpngkr4gU3m4K4U4lDEwjpxroS0lkwO4A_6LhLXcyq4ghdvVSyUdzcD7ZbLlYgRQCPc8FzZ04M2XsvsnBG2NbBuFbtcyI11wsS9TDhX7iJNQ6oZILynzaT9NGPHQWliwplGQMY7ziLIr39atjulB6aC1hjNTNMGcJyjk_0l6qAD3gOqOl8qvrfq4eSayDsmHgVToKWFhzQTZaWyjDrOdZniZjxqPftr7hLuOg==&view=lg)"; flow:established,to_server; http.uri; content:"/?acc=UC-wARhaZ6ak1D_rW2ez61wqsx6eZgm1ZQFON08qw2p7Mq9WgrKSDAZ3sCc-TpSslzZyvJX5kxGLz-NNoKmZb9jBDXLXERzFLK2aUbdN9nAimhjhGqpngkr4gU3m4K4U4lDEwjpxroS0lkwO4A_6LhLXcyq4ghdvVSyUdzcD7ZbLlYgRQCPc8FzZ04M2XsvsnBG2NbBuFbtcyI11wsS9TDhX7iJNQ6oZILynzaT9NGPHQWliwplGQMY7ziLIr39atjulB6aC1hjNTNMGcJyjk_0l6qAD3gOqOl8qvrfq4eSayDsmHgVToKWFhzQTZaWyjDrOdZniZjxqPftr7hLuOg==&view=lg"; startswith; fast_pattern; http.host; content:"download-updateledger.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001341; classtype:social-engineering; sid:6001341; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-gamma.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-gamma.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001342; classtype:social-engineering; sid:6001342; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.qtrplzmxvn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.qtrplzmxvn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001343; classtype:social-engineering; sid:6001343; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.xupdygxtxq.one/uqjmw)"; flow:established,to_server; http.uri; content:"/uqjmw"; startswith; fast_pattern; http.host; content:"usps.xupdygxtxq.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001344; classtype:social-engineering; sid:6001344; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (u20n.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"u20n.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001345; classtype:social-engineering; sid:6001345; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwz.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingwz.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001346; classtype:social-engineering; sid:6001346; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-delta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-delta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001347; classtype:social-engineering; sid:6001347; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hcxr-42552.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hcxr-42552.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001348; classtype:social-engineering; sid:6001348; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blockchaincomwalletus.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"blockchaincomwalletus.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001349; classtype:social-engineering; sid:6001349; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (exoreuswalle-ot.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"exoreuswalle-ot.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001350; classtype:social-engineering; sid:6001350; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (n2v3d.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"n2v3d.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001351; classtype:social-engineering; sid:6001351; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unicredit-login.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"unicredit-login.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001352; classtype:social-engineering; sid:6001352; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f-binance.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f-binance.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001353; classtype:social-engineering; sid:6001353; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (especially.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"especially.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001354; classtype:social-engineering; sid:6001354; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qel4l1sz120i8zo.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qel4l1sz120i8zo.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001355; classtype:social-engineering; sid:6001355; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazongroup44.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazongroup44.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001356; classtype:social-engineering; sid:6001356; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sumit-7500.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"sumit-7500.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001357; classtype:social-engineering; sid:6001357; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mypost.sunocz.click/au/kzmc)"; flow:established,to_server; http.uri; content:"/au/kzmc"; startswith; fast_pattern; http.host; content:"mypost.sunocz.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001358; classtype:social-engineering; sid:6001358; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dev.nova-host.store/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dev.nova-host.store"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001359; classtype:social-engineering; sid:6001359; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mxtrqplzvn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mxtrqplzvn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001360; classtype:social-engineering; sid:6001360; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (static-hub.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"static-hub.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001361; classtype:social-engineering; sid:6001361; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gnwrzpq.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gnwrzpq.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001362; classtype:social-engineering; sid:6001362; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tplqvrxzmn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tplqvrxzmn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001363; classtype:social-engineering; sid:6001363; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (promohadiah44.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"promohadiah44.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001364; classtype:social-engineering; sid:6001364; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zsdr.pages.dev/today/camp/)"; flow:established,to_server; http.uri; content:"/today/camp/"; startswith; fast_pattern; http.host; content:"zsdr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001365; classtype:social-engineering; sid:6001365; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.lhztll.click/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.lhztll.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001366; classtype:social-engineering; sid:6001366; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (haytemmoso-del.github.io/instagram)"; flow:established,to_server; http.uri; content:"/instagram"; startswith; fast_pattern; http.host; content:"haytemmoso-del.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001367; classtype:social-engineering; sid:6001367; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galeri-pemenang-shopee43.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"galeri-pemenang-shopee43.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001368; classtype:social-engineering; sid:6001368; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kptxqvr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kptxqvr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001369; classtype:social-engineering; sid:6001369; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hadiah-undian-shopee2021.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hadiah-undian-shopee2021.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001370; classtype:social-engineering; sid:6001370; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-delta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-delta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001371; classtype:social-engineering; sid:6001371; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oki.jtu.mybluehost.me/wp-includes/assets/swiss/swisscom/ch/index.asp.php?6739354637a4d20ac3b341d9ccd930ad)"; flow:established,to_server; http.uri; content:"/wp-includes/assets/swiss/swisscom/ch/index.asp.php?6739354637a4d20ac3b341d9ccd930ad"; startswith; fast_pattern; http.host; content:"oki.jtu.mybluehost.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001372; classtype:social-engineering; sid:6001372; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-gamma.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-gamma.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001373; classtype:social-engineering; sid:6001373; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mm7765.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mm7765.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001374; classtype:social-engineering; sid:6001374; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gebyarundianshopee55.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gebyarundianshopee55.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001375; classtype:social-engineering; sid:6001375; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-frapvik-biz-vrolnex-drament.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-frapvik-biz-vrolnex-drament.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001376; classtype:social-engineering; sid:6001376; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mm1775.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mm1775.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001377; classtype:social-engineering; sid:6001377; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fsh2.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fsh2.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001378; classtype:social-engineering; sid:6001378; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.zudxrf.buzz/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.zudxrf.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001379; classtype:social-engineering; sid:6001379; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enquiry-walock-tcap23nqu.springcapital91.workers.dev/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"enquiry-walock-tcap23nqu.springcapital91.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001380; classtype:social-engineering; sid:6001380; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adarsh405.github.io/netflix-clone-website/)"; flow:established,to_server; http.uri; content:"/netflix-clone-website/"; startswith; fast_pattern; http.host; content:"adarsh405.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001381; classtype:social-engineering; sid:6001381; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hetron.net/verify.php)"; flow:established,to_server; http.uri; content:"/verify.php"; startswith; fast_pattern; http.host; content:"hetron.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001382; classtype:social-engineering; sid:6001382; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netanswer-potalsite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netanswer-potalsite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001383; classtype:social-engineering; sid:6001383; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1999365.com//)"; flow:established,to_server; http.uri; content:"//"; startswith; fast_pattern; http.host; content:"1999365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001384; classtype:social-engineering; sid:6001384; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rechnundoub.com/privatkunden/srsltid/cc.php)"; flow:established,to_server; http.uri; content:"/privatkunden/srsltid/cc.php"; startswith; fast_pattern; http.host; content:"rechnundoub.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001385; classtype:social-engineering; sid:6001385; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (concifyrespotrymain.wasmer.app/pennon-group)"; flow:established,to_server; http.uri; content:"/pennon-group"; startswith; fast_pattern; http.host; content:"concifyrespotrymain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001386; classtype:social-engineering; sid:6001386; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hadiahshopee-indonesia.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hadiahshopee-indonesia.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001387; classtype:social-engineering; sid:6001387; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ult1moaviso365.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ult1moaviso365.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001388; classtype:social-engineering; sid:6001388; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.bnqdrg.buzz/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.bnqdrg.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001389; classtype:social-engineering; sid:6001389; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sunsetcp.com.au/wp-includes/sitemaps/ifezwla/)"; flow:established,to_server; http.uri; content:"/wp-includes/sitemaps/ifezwla/"; startswith; fast_pattern; http.host; content:"www.sunsetcp.com.au"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001390; classtype:social-engineering; sid:6001390; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pangarevanthkumar2006-pixel.github.io/netflix-clones)"; flow:established,to_server; http.uri; content:"/netflix-clones"; startswith; fast_pattern; http.host; content:"pangarevanthkumar2006-pixel.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001391; classtype:social-engineering; sid:6001391; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-plovnix-biz-drurnax-slortek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-plovnix-biz-drurnax-slortek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001392; classtype:social-engineering; sid:6001392; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.asjghxv.kxvias.portlandfurnitureonline.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.asjghxv.kxvias.portlandfurnitureonline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001393; classtype:social-engineering; sid:6001393; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galeripemenang77.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galeripemenang77.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001394; classtype:social-engineering; sid:6001394; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.cfkwpa.buzz/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.cfkwpa.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001395; classtype:social-engineering; sid:6001395; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ramadan-sale2021.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"ramadan-sale2021.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001396; classtype:social-engineering; sid:6001396; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqtmplxzvn.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqtmplxzvn.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001397; classtype:social-engineering; sid:6001397; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.padisahbet.business/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.padisahbet.business"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001398; classtype:social-engineering; sid:6001398; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oyekaleisrael2-dev.github.io/netflix)"; flow:established,to_server; http.uri; content:"/netflix"; startswith; fast_pattern; http.host; content:"oyekaleisrael2-dev.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001399; classtype:social-engineering; sid:6001399; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (undianresmishopee11.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"undianresmishopee11.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001400; classtype:social-engineering; sid:6001400; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiifkanpaylaterr.ydd.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiifkanpaylaterr.ydd.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001401; classtype:social-engineering; sid:6001401; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brt.oegmte.help/secure/it)"; flow:established,to_server; http.uri; content:"/secure/it"; startswith; fast_pattern; http.host; content:"brt.oegmte.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001402; classtype:social-engineering; sid:6001402; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tsess-29e.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tsess-29e.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001403; classtype:social-engineering; sid:6001403; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (introduction-bridge.wixstudio.com/bridge-en-us)"; flow:established,to_server; http.uri; content:"/bridge-en-us"; startswith; fast_pattern; http.host; content:"introduction-bridge.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001404; classtype:social-engineering; sid:6001404; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kreditbanking-dkb-de.propertytoken.ae/dkb/login.php)"; flow:established,to_server; http.uri; content:"/dkb/login.php"; startswith; fast_pattern; http.host; content:"kreditbanking-dkb-de.propertytoken.ae"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001405; classtype:social-engineering; sid:6001405; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.829302.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.829302.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001406; classtype:social-engineering; sid:6001406; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www-att-bellsouth-verifier-f82b3a.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www-att-bellsouth-verifier-f82b3a.webflow.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001407; classtype:social-engineering; sid:6001407; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dietzens.de/seiten/zitate/auswahl.php?suche=%22%2F%3E%3Cimg%20src%3D%22https%3A%2F%2Fgoogle.com%2F2I5CrL5ylnDKP.jpg%22%20onerror%3D%22window.location%3DdecodeURIComponent%28atob%28%27Njg3NDc0NzA3MzNhMmYyZjY0NmQ2OTcwNjE3MDc4NzE2NDY4NmMyZTMxMzMzNDM3MzMzMjYzMzAyZDY2MzIzMzM4MmQzNDYyMzkzNDJkNjEzOTM0MzMyZDMxMzUzODMxMzkzMTMzMzc2MTYxMzU2NTJlNjM2NjY0%27%29.replace%28%2F%28..%29%2Fg%2C%20%27%25%241%27%29%29%3B%22%3E)"; flow:established,to_server; http.uri; content:"/seiten/zitate/auswahl.php?suche=%22%2F%3E%3Cimg%20src%3D%22https%3A%2F%2Fgoogle.com%2F2I5CrL5ylnDKP.jpg%22%20onerror%3D%22window.location%3DdecodeURIComponent%28atob%28%27Njg3NDc0NzA3MzNhMmYyZjY0NmQ2OTcwNjE3MDc4NzE2NDY4NmMyZTMxMzMzNDM3MzMzMjYzMzAyZDY2MzIzMzM4MmQzNDYyMzkzNDJkNjEzOTM0MzMyZDMxMzUzODMxMzkzMTMzMzc2MTYxMzU2NTJlNjM2NjY0%27%29.replace%28%2F%28..%29%2Fg%2C%20%27%25%241%27%29%29%3B%22%3E"; startswith; fast_pattern; http.host; content:"dietzens.de"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001408; classtype:social-engineering; sid:6001408; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (io-startd-trzon.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"io-startd-trzon.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001409; classtype:social-engineering; sid:6001409; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (startlezer-comcdn.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"startlezer-comcdn.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001410; classtype:social-engineering; sid:6001410; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appsuites-trezur.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"appsuites-trezur.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001411; classtype:social-engineering; sid:6001411; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xkpbfv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xkpbfv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001412; classtype:social-engineering; sid:6001412; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nydbjc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nydbjc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001413; classtype:social-engineering; sid:6001413; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bdv-enlinea.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bdv-enlinea.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001414; classtype:social-engineering; sid:6001414; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rucpyw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rucpyw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001415; classtype:social-engineering; sid:6001415; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.sjrgzw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.sjrgzw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001416; classtype:social-engineering; sid:6001416; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yuoqid.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.yuoqid.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001417; classtype:social-engineering; sid:6001417; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gvhnr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gvhnr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001418; classtype:social-engineering; sid:6001418; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.cvpjwk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.cvpjwk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001419; classtype:social-engineering; sid:6001419; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fcds-47514.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fcds-47514.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001420; classtype:social-engineering; sid:6001420; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zqrtmo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zqrtmo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001421; classtype:social-engineering; sid:6001421; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.iszkbm.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.iszkbm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001422; classtype:social-engineering; sid:6001422; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shrturls.sbs/mexc6/)"; flow:established,to_server; http.uri; content:"/mexc6/"; startswith; fast_pattern; http.host; content:"www.shrturls.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001423; classtype:social-engineering; sid:6001423; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uyfxbg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.uyfxbg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001424; classtype:social-engineering; sid:6001424; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kbstxv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kbstxv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001425; classtype:social-engineering; sid:6001425; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhaveshpandey142007-dev.github.io/netflix-clone)"; flow:established,to_server; http.uri; content:"/netflix-clone"; startswith; fast_pattern; http.host; content:"bhaveshpandey142007-dev.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001426; classtype:social-engineering; sid:6001426; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ndilcz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ndilcz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001427; classtype:social-engineering; sid:6001427; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.csfht.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.csfht.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001428; classtype:social-engineering; sid:6001428; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ykdqlr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ykdqlr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001429; classtype:social-engineering; sid:6001429; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bdv-enlinea.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bdv-enlinea.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001430; classtype:social-engineering; sid:6001430; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sophiacarvalho307-dotcom.github.io/netflix-/)"; flow:established,to_server; http.uri; content:"/netflix-/"; startswith; fast_pattern; http.host; content:"sophiacarvalho307-dotcom.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001431; classtype:social-engineering; sid:6001431; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tdcfwg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tdcfwg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001432; classtype:social-engineering; sid:6001432; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yqzoig.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.yqzoig.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001433; classtype:social-engineering; sid:6001433; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qbatou.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qbatou.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001434; classtype:social-engineering; sid:6001434; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (validecgobecc.iceiy.com/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"validecgobecc.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001435; classtype:social-engineering; sid:6001435; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yubmvk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.yubmvk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001436; classtype:social-engineering; sid:6001436; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lhenif.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lhenif.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001437; classtype:social-engineering; sid:6001437; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xcwhal.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xcwhal.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001438; classtype:social-engineering; sid:6001438; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jzmoa.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jzmoa.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001439; classtype:social-engineering; sid:6001439; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bjirqs.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bjirqs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001440; classtype:social-engineering; sid:6001440; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gaiqbf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gaiqbf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001441; classtype:social-engineering; sid:6001441; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gyftxi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gyftxi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001442; classtype:social-engineering; sid:6001442; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danaa-iindonesiaa.ndd.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danaa-iindonesiaa.ndd.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001443; classtype:social-engineering; sid:6001443; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.feqwrc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.feqwrc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001444; classtype:social-engineering; sid:6001444; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mpyqso.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mpyqso.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001445; classtype:social-engineering; sid:6001445; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uscanadacpas.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uscanadacpas.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001446; classtype:social-engineering; sid:6001446; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ingresarprodubanco-ec.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ingresarprodubanco-ec.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001447; classtype:social-engineering; sid:6001447; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bluemark-free-see-more.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bluemark-free-see-more.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001448; classtype:social-engineering; sid:6001448; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.euhjv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.euhjv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001449; classtype:social-engineering; sid:6001449; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hbycld.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hbycld.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001450; classtype:social-engineering; sid:6001450; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mbqpay.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mbqpay.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001451; classtype:social-engineering; sid:6001451; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xlynnid-danaz.mildcou.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xlynnid-danaz.mildcou.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001452; classtype:social-engineering; sid:6001452; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ulkfmt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ulkfmt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001453; classtype:social-engineering; sid:6001453; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lnmvrg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lnmvrg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001454; classtype:social-engineering; sid:6001454; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reactivautlook356.iceiy.com/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"reactivautlook356.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001455; classtype:social-engineering; sid:6001455; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fbekgj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fbekgj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001456; classtype:social-engineering; sid:6001456; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ygqbhe.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ygqbhe.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001457; classtype:social-engineering; sid:6001457; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.srxipv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.srxipv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001458; classtype:social-engineering; sid:6001458; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kpevcg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kpevcg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001459; classtype:social-engineering; sid:6001459; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeebig67.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopeebig67.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001460; classtype:social-engineering; sid:6001460; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15598.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15598.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001461; classtype:social-engineering; sid:6001461; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mfhdro.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mfhdro.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001462; classtype:social-engineering; sid:6001462; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bsuneo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bsuneo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001463; classtype:social-engineering; sid:6001463; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ndygsu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ndygsu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001464; classtype:social-engineering; sid:6001464; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fwyqrl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fwyqrl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001465; classtype:social-engineering; sid:6001465; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qantasmoney-support.ns01.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qantasmoney-support.ns01.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001466; classtype:social-engineering; sid:6001466; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qantasmoney-verifications.ns01.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qantasmoney-verifications.ns01.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001467; classtype:social-engineering; sid:6001467; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.qantasmoney-verifications.ns01.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.qantasmoney-verifications.ns01.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001468; classtype:social-engineering; sid:6001468; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.penguinsitter.com/wp-includes/WP_admCH/Wp_gg/)"; flow:established,to_server; http.uri; content:"/wp-includes/WP_admCH/Wp_gg/"; startswith; fast_pattern; http.host; content:"www.penguinsitter.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001469; classtype:social-engineering; sid:6001469; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.anemop.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.anemop.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001470; classtype:social-engineering; sid:6001470; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (formanmills.com/Facebook/login.html)"; flow:established,to_server; http.uri; content:"/Facebook/login.html"; startswith; fast_pattern; http.host; content:"formanmills.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001471; classtype:social-engineering; sid:6001471; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bluemark-free-see-more.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bluemark-free-see-more.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001472; classtype:social-engineering; sid:6001472; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danaa-iindonesiaa.vaa.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danaa-iindonesiaa.vaa.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001473; classtype:social-engineering; sid:6001473; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ximbsh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ximbsh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001474; classtype:social-engineering; sid:6001474; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.posevg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.posevg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001475; classtype:social-engineering; sid:6001475; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hzvngq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hzvngq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001476; classtype:social-engineering; sid:6001476; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.obzdav.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.obzdav.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001477; classtype:social-engineering; sid:6001477; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (assuredannuity.com/members/classes/captcha/CerticodePlus/DSP2/)"; flow:established,to_server; http.uri; content:"/members/classes/captcha/CerticodePlus/DSP2/"; startswith; fast_pattern; http.host; content:"assuredannuity.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001478; classtype:social-engineering; sid:6001478; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (outiook-offlceauthyfyveriflive.icu/api/verification/page)"; flow:established,to_server; http.uri; content:"/api/verification/page"; startswith; fast_pattern; http.host; content:"outiook-offlceauthyfyveriflive.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001479; classtype:social-engineering; sid:6001479; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.chufmb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.chufmb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001480; classtype:social-engineering; sid:6001480; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.glosze.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.glosze.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001481; classtype:social-engineering; sid:6001481; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hkscbo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hkscbo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001482; classtype:social-engineering; sid:6001482; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pxfleq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pxfleq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001483; classtype:social-engineering; sid:6001483; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qantasmoney-financial.ns01.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qantasmoney-financial.ns01.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001484; classtype:social-engineering; sid:6001484; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qantasmoney.ns02.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qantasmoney.ns02.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001485; classtype:social-engineering; sid:6001485; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.steammystation.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.steammystation.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001486; classtype:social-engineering; sid:6001486; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (frshmeme.s3.us-east-1.amazonaws.com/dropboxess.html)"; flow:established,to_server; http.uri; content:"/dropboxess.html"; startswith; fast_pattern; http.host; content:"frshmeme.s3.us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001487; classtype:social-engineering; sid:6001487; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (solicitudesenlineaprocesodeverifica.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"solicitudesenlineaprocesodeverifica.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001488; classtype:social-engineering; sid:6001488; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (395bet1.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"395bet1.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001489; classtype:social-engineering; sid:6001489; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (produbanprestarapidoec.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"produbanprestarapidoec.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001490; classtype:social-engineering; sid:6001490; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ahurahotel.com/Adobereader/)"; flow:established,to_server; http.uri; content:"/Adobereader/"; startswith; fast_pattern; http.host; content:"ahurahotel.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001491; classtype:social-engineering; sid:6001491; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365bet992.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365bet992.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001492; classtype:social-engineering; sid:6001492; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vejdfs.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vejdfs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001493; classtype:social-engineering; sid:6001493; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-fraplor-biz-dravnix-qravtek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-fraplor-biz-dravnix-qravtek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001494; classtype:social-engineering; sid:6001494; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vgfy-36757.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vgfy-36757.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001495; classtype:social-engineering; sid:6001495; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jolcwd.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jolcwd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001496; classtype:social-engineering; sid:6001496; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ymxupt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ymxupt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001497; classtype:social-engineering; sid:6001497; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bbvanet-cash.duckdns.org/e-bbvanetcash.com/Portal/Empresas/PSE/Credenciales)"; flow:established,to_server; http.uri; content:"/e-bbvanetcash.com/Portal/Empresas/PSE/Credenciales"; startswith; fast_pattern; http.host; content:"bbvanet-cash.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001498; classtype:social-engineering; sid:6001498; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fjosv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fjosv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001499; classtype:social-engineering; sid:6001499; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.g15r.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.g15r.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001500; classtype:social-engineering; sid:6001500; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.derksi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.derksi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001501; classtype:social-engineering; sid:6001501; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zkqlpw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zkqlpw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001502; classtype:social-engineering; sid:6001502; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stealthsvcverification.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"stealthsvcverification.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001503; classtype:social-engineering; sid:6001503; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pittaa.mooo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pittaa.mooo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001504; classtype:social-engineering; sid:6001504; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (may-statementd-downloadv52026.com/us/)"; flow:established,to_server; http.uri; content:"/us/"; startswith; fast_pattern; http.host; content:"may-statementd-downloadv52026.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001505; classtype:social-engineering; sid:6001505; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newneddes.s3.us-east-1.amazonaws.com/dropboxess.html?email=a.b@c)"; flow:established,to_server; http.uri; content:"/dropboxess.html?email=a.b@c"; startswith; fast_pattern; http.host; content:"newneddes.s3.us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001506; classtype:social-engineering; sid:6001506; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sasktelresetupdate.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sasktelresetupdate.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001507; classtype:social-engineering; sid:6001507; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (garantiareservatecnicaativodegiro.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"garantiareservatecnicaativodegiro.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001508; classtype:social-engineering; sid:6001508; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myownm.s3.us-east-1.amazonaws.com/dropboxess.html?email=a.b@c)"; flow:established,to_server; http.uri; content:"/dropboxess.html?email=a.b@c"; startswith; fast_pattern; http.host; content:"myownm.s3.us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001509; classtype:social-engineering; sid:6001509; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a3b9c4s3.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a3b9c4s3.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001510; classtype:social-engineering; sid:6001510; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tarjetasprodubancsosiality.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tarjetasprodubancsosiality.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001511; classtype:social-engineering; sid:6001511; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (15647.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"15647.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001512; classtype:social-engineering; sid:6001512; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.istond.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.istond.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001513; classtype:social-engineering; sid:6001513; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.szuqwf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.szuqwf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001514; classtype:social-engineering; sid:6001514; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j39b.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j39b.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001515; classtype:social-engineering; sid:6001515; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.oxpfkc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.oxpfkc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001516; classtype:social-engineering; sid:6001516; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.qantasmoney-support.ns01.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.qantasmoney-support.ns01.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001517; classtype:social-engineering; sid:6001517; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.solicitudesenlineaprocesodeverifica.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.solicitudesenlineaprocesodeverifica.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001518; classtype:social-engineering; sid:6001518; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kmcros.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kmcros.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001519; classtype:social-engineering; sid:6001519; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (drk-whatsapp.hk.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"drk-whatsapp.hk.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001520; classtype:social-engineering; sid:6001520; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15626.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15626.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001521; classtype:social-engineering; sid:6001521; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-qolvrax-biz-glarnor-slurnax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-qolvrax-biz-glarnor-slurnax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001522; classtype:social-engineering; sid:6001522; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-glarnex-biz-vrolvax-trapnix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-glarnex-biz-vrolvax-trapnix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001523; classtype:social-engineering; sid:6001523; rev:1; metadata: signature_severity Major, created_et 2026_06_01, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hjvillakmms.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hjvillakmms.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001524; classtype:social-engineering; sid:6001524; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (right-points-940085.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"right-points-940085.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001525; classtype:social-engineering; sid:6001525; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usdaproposalbid.wixsite.com/my-site-1)"; flow:established,to_server; http.uri; content:"/my-site-1"; startswith; fast_pattern; http.host; content:"usdaproposalbid.wixsite.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001526; classtype:social-engineering; sid:6001526; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nice-item-273012.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nice-item-273012.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001527; classtype:social-engineering; sid:6001527; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (104.21.30.72/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"104.21.30.72"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001528; classtype:social-engineering; sid:6001528; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (protal-live.wixstudio.com/enus)"; flow:established,to_server; http.uri; content:"/enus"; startswith; fast_pattern; http.host; content:"protal-live.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001529; classtype:social-engineering; sid:6001529; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (officialdesktop-legr.wixstudio.com/usen)"; flow:established,to_server; http.uri; content:"/usen"; startswith; fast_pattern; http.host; content:"officialdesktop-legr.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001530; classtype:social-engineering; sid:6001530; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (live-streted.wixstudio.com/live-en)"; flow:established,to_server; http.uri; content:"/live-en"; startswith; fast_pattern; http.host; content:"live-streted.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001531; classtype:social-engineering; sid:6001531; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (midco-mailredirect-solution.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"midco-mailredirect-solution.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001532; classtype:social-engineering; sid:6001532; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (securedolstateusau.wixsite.com/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"securedolstateusau.wixsite.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001533; classtype:social-engineering; sid:6001533; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (liveapp-ledzer.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"liveapp-ledzer.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001534; classtype:social-engineering; sid:6001534; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1inch-eth.ipns.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1inch-eth.ipns.dweb.link"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001535; classtype:social-engineering; sid:6001535; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (desktop-ledzercdn.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"desktop-ledzercdn.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001536; classtype:social-engineering; sid:6001536; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jhuauthform.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jhuauthform.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001537; classtype:social-engineering; sid:6001537; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (breakable-europe-800085.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"breakable-europe-800085.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001538; classtype:social-engineering; sid:6001538; rev:1; metadata: signature_severity Major, created_et 2026_06_02, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwz.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwz.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001539; classtype:social-engineering; sid:6001539; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cxztsnation.com/dsi/)"; flow:established,to_server; http.uri; content:"/dsi/"; startswith; fast_pattern; http.host; content:"cxztsnation.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001540; classtype:social-engineering; sid:6001540; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nowdesktop-live.wixstudio.com/desktop)"; flow:established,to_server; http.uri; content:"/desktop"; startswith; fast_pattern; http.host; content:"nowdesktop-live.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001541; classtype:social-engineering; sid:6001541; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwv.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwv.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001542; classtype:social-engineering; sid:6001542; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingee.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingee.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001543; classtype:social-engineering; sid:6001543; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dk-healthydiet.shop/ZYQ-DK01/)"; flow:established,to_server; http.uri; content:"/ZYQ-DK01/"; startswith; fast_pattern; http.host; content:"dk-healthydiet.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001544; classtype:social-engineering; sid:6001544; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (homepage-suitpps.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"homepage-suitpps.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001545; classtype:social-engineering; sid:6001545; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maker-app.at/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"maker-app.at"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001546; classtype:social-engineering; sid:6001546; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (indoamerica200.github.io/libremx/)"; flow:established,to_server; http.uri; content:"/libremx/"; startswith; fast_pattern; http.host; content:"indoamerica200.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001547; classtype:social-engineering; sid:6001547; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (parkeasaring-aw.buzz/fl)"; flow:established,to_server; http.uri; content:"/fl"; startswith; fast_pattern; http.host; content:"parkeasaring-aw.buzz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001548; classtype:social-engineering; sid:6001548; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (z55gxbf0bb.execute-api.us-west-2.amazonaws.com/track?curr_track_type=link_click&link_id=gchZNr2&temp_id=IjI2OTM3NyI_3D&email_id=mailget_email_id_replace&s_id=mailget_s_id_replace&server=replace_smtp_server&type=replace_drip_type)"; flow:established,to_server; http.uri; content:"/track?curr_track_type=link_click&link_id=gchZNr2&temp_id=IjI2OTM3NyI_3D&email_id=mailget_email_id_replace&s_id=mailget_s_id_replace&server=replace_smtp_server&type=replace_drip_type"; startswith; fast_pattern; http.host; content:"z55gxbf0bb.execute-api.us-west-2.amazonaws.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001549; classtype:social-engineering; sid:6001549; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (theccguy.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"theccguy.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001550; classtype:social-engineering; sid:6001550; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingeu.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingeu.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001551; classtype:social-engineering; sid:6001551; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingeo.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingeo.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001552; classtype:social-engineering; sid:6001552; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-server-page--lilyjaneleeks1.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-server-page--lilyjaneleeks1.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001553; classtype:social-engineering; sid:6001553; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.web-git-05-08-featwebenhancedepthchartwithflipto-60762c-uniswap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.web-git-05-08-featwebenhancedepthchartwithflipto-60762c-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001554; classtype:social-engineering; sid:6001554; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (htpmwebsunrisemail.flazio.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"htpmwebsunrisemail.flazio.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001555; classtype:social-engineering; sid:6001555; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (glde.click/?email=haliolab@9fa87bf8f06c7a12cad351f9d8782439742e.org)"; flow:established,to_server; http.uri; content:"/?email=haliolab@9fa87bf8f06c7a12cad351f9d8782439742e.org"; startswith; fast_pattern; http.host; content:"glde.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001556; classtype:social-engineering; sid:6001556; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingeq.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingeq.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001557; classtype:social-engineering; sid:6001557; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verseacademy.io/gulfcourt/frnds/rabi/tangpko/ZmlvbmEuYWJiZXlAZGVmZW5jZWZvcmNlcy5pZQ==)"; flow:established,to_server; http.uri; content:"/gulfcourt/frnds/rabi/tangpko/ZmlvbmEuYWJiZXlAZGVmZW5jZWZvcmNlcy5pZQ=="; startswith; fast_pattern; http.host; content:"verseacademy.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001558; classtype:social-engineering; sid:6001558; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dealbamiguel491-maker.github.io/MIGUEL-DE-ALBA)"; flow:established,to_server; http.uri; content:"/MIGUEL-DE-ALBA"; startswith; fast_pattern; http.host; content:"dealbamiguel491-maker.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001559; classtype:social-engineering; sid:6001559; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.86365x.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.86365x.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001560; classtype:social-engineering; sid:6001560; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (visitwatertownwi.com/sgnv/sg/login?id=WYXzSCTJ4E0VTy65WlLcQoZx1S6mFyWzPNROJg4eVSW1gDvCzzHKFazPO0tRBwjTkKZ53iuqgMB2sulpNg8meYnkShZOwIIqkYd&token=emWPwLuyjsJunRFrSPq8bDg3aLEnDNAlO4NYh7HtGBGcfIvIisVJLyWSqTyvBBMsZAoAQ4HthweEvW4hlie13j1Ej52Z)"; flow:established,to_server; http.uri; content:"/sgnv/sg/login?id=WYXzSCTJ4E0VTy65WlLcQoZx1S6mFyWzPNROJg4eVSW1gDvCzzHKFazPO0tRBwjTkKZ53iuqgMB2sulpNg8meYnkShZOwIIqkYd&token=emWPwLuyjsJunRFrSPq8bDg3aLEnDNAlO4NYh7HtGBGcfIvIisVJLyWSqTyvBBMsZAoAQ4HthweEvW4hlie13j1Ej52Z"; startswith; fast_pattern; http.host; content:"visitwatertownwi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001561; classtype:social-engineering; sid:6001561; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (samplel-ks6yxvur5-instagramm.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"samplel-ks6yxvur5-instagramm.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001562; classtype:social-engineering; sid:6001562; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (red-block-531fly.clyde-e0f.workers.dev/common/oauth2/v2.0/authorize/)"; flow:established,to_server; http.uri; content:"/common/oauth2/v2.0/authorize/"; startswith; fast_pattern; http.host; content:"red-block-531fly.clyde-e0f.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001563; classtype:social-engineering; sid:6001563; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ahmed-reda-elnajjar.github.io/Negroomove/)"; flow:established,to_server; http.uri; content:"/Negroomove/"; startswith; fast_pattern; http.host; content:"ahmed-reda-elnajjar.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001564; classtype:social-engineering; sid:6001564; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eu.itpatches.com/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"eu.itpatches.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001565; classtype:social-engineering; sid:6001565; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingso.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingso.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001566; classtype:social-engineering; sid:6001566; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecards.amazingcoupons.co.uk/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"ecards.amazingcoupons.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001567; classtype:social-engineering; sid:6001567; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (user-cembraaap-zone.b-cdn.net/B92x5T/d9fe07c.html)"; flow:established,to_server; http.uri; content:"/B92x5T/d9fe07c.html"; startswith; fast_pattern; http.host; content:"user-cembraaap-zone.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001568; classtype:social-engineering; sid:6001568; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-vrolqar-biz-glarnix-qravtor.pages.dev/...)"; flow:established,to_server; http.uri; content:"/..."; startswith; fast_pattern; http.host; content:"sp1ct6-vrolqar-biz-glarnix-qravtor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001569; classtype:social-engineering; sid:6001569; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bagi-bagi-hadiah677.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bagi-bagi-hadiah677.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001570; classtype:social-engineering; sid:6001570; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreicf7u63fffew5buejmxwltgkvnsyqbnkbcrbrx2bfvw72j2hqy3gu.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreicf7u63fffew5buejmxwltgkvnsyqbnkbcrbrx2bfvw72j2hqy3gu.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001571; classtype:social-engineering; sid:6001571; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortup.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortup.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001572; classtype:social-engineering; sid:6001572; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365wtvip.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365wtvip.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001573; classtype:social-engineering; sid:6001573; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dark-plum-k7yi7i8396.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dark-plum-k7yi7i8396.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001574; classtype:social-engineering; sid:6001574; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.jj1775.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.jj1775.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001575; classtype:social-engineering; sid:6001575; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uber-clone-ur.vercel.app/auth/forgot)"; flow:established,to_server; http.uri; content:"/auth/forgot"; startswith; fast_pattern; http.host; content:"uber-clone-ur.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001576; classtype:social-engineering; sid:6001576; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uber-beta-ten.vercel.app/user/login)"; flow:established,to_server; http.uri; content:"/user/login"; startswith; fast_pattern; http.host; content:"uber-beta-ten.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001577; classtype:social-engineering; sid:6001577; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1615666444.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1615666444.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001578; classtype:social-engineering; sid:6001578; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.67395.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.67395.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001579; classtype:social-engineering; sid:6001579; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-black-iota.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-black-iota.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001580; classtype:social-engineering; sid:6001580; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amangirwal.github.io/netflix_clone/)"; flow:established,to_server; http.uri; content:"/netflix_clone/"; startswith; fast_pattern; http.host; content:"amangirwal.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001581; classtype:social-engineering; sid:6001581; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.eu.itpatches.com/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"mail.eu.itpatches.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001582; classtype:social-engineering; sid:6001582; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-glarnor-biz-frapvik-vrolqar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-glarnor-biz-frapvik-vrolqar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001583; classtype:social-engineering; sid:6001583; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vaibhavexpo.com/ProstBuilders/RandyEubank.html)"; flow:established,to_server; http.uri; content:"/ProstBuilders/RandyEubank.html"; startswith; fast_pattern; http.host; content:"vaibhavexpo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001584; classtype:social-engineering; sid:6001584; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee.firdous.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee.firdous.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001585; classtype:social-engineering; sid:6001585; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x-shrtn.com/s/1d3wmu)"; flow:established,to_server; http.uri; content:"/s/1d3wmu"; startswith; fast_pattern; http.host; content:"x-shrtn.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001586; classtype:social-engineering; sid:6001586; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pp7765.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pp7765.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001587; classtype:social-engineering; sid:6001587; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingst.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingst.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001588; classtype:social-engineering; sid:6001588; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hackerog17.github.io/1k-on-ur-instagram-account)"; flow:established,to_server; http.uri; content:"/1k-on-ur-instagram-account"; startswith; fast_pattern; http.host; content:"hackerog17.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001589; classtype:social-engineering; sid:6001589; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.57365y.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.57365y.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001590; classtype:social-engineering; sid:6001590; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.stabblepolicyreview.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.stabblepolicyreview.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001591; classtype:social-engineering; sid:6001591; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi7767.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.info-resmi7767.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001592; classtype:social-engineering; sid:6001592; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15373.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15373.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001593; classtype:social-engineering; sid:6001593; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lucroemalta.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"lucroemalta.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001594; classtype:social-engineering; sid:6001594; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-frulnik-biz-qravtor-vrolnax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-frulnik-biz-qravtor-vrolnax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001595; classtype:social-engineering; sid:6001595; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gmb.xhalo.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gmb.xhalo.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001596; classtype:social-engineering; sid:6001596; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-fravnik-biz-qoltex-slarnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-fravnik-biz-qoltex-slarnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001597; classtype:social-engineering; sid:6001597; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rajatsaini90420.github.io/Amazon-Clone-Website/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone-Website/"; startswith; fast_pattern; http.host; content:"rajatsaini90420.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001598; classtype:social-engineering; sid:6001598; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-glavnex-biz-drurnik-qravtex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-glavnex-biz-drurnik-qravtex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001599; classtype:social-engineering; sid:6001599; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17569.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17569.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001600; classtype:social-engineering; sid:6001600; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.confirm-address-changing.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.confirm-address-changing.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001601; classtype:social-engineering; sid:6001601; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adiborty-code.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"adiborty-code.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001602; classtype:social-engineering; sid:6001602; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-prduction-user-58774889.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-prduction-user-58774889.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001603; classtype:social-engineering; sid:6001603; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (logsys476-pgvy.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"logsys476-pgvy.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001604; classtype:social-engineering; sid:6001604; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (control-credito.vercel.app/hsbc/index.html)"; flow:established,to_server; http.uri; content:"/hsbc/index.html"; startswith; fast_pattern; http.host; content:"control-credito.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001605; classtype:social-engineering; sid:6001605; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwc.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwc.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001606; classtype:social-engineering; sid:6001606; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usuariosmx2026.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"usuariosmx2026.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001607; classtype:social-engineering; sid:6001607; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.2461870365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.2461870365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001608; classtype:social-engineering; sid:6001608; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freelanceconnect.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"freelanceconnect.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001609; classtype:social-engineering; sid:6001609; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dsk010101010001010010.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.dsk010101010001010010.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001610; classtype:social-engineering; sid:6001610; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingei.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingei.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001611; classtype:social-engineering; sid:6001611; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portal.e-docssign.net/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"portal.e-docssign.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001612; classtype:social-engineering; sid:6001612; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aalima4477-ux.github.io/ALERT-IG/)"; flow:established,to_server; http.uri; content:"/ALERT-IG/"; startswith; fast_pattern; http.host; content:"aalima4477-ux.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001613; classtype:social-engineering; sid:6001613; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-m277.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-m277.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001614; classtype:social-engineering; sid:6001614; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp.verify.help/?%20p=9647719774647)"; flow:established,to_server; http.uri; content:"/?%20p=9647719774647"; startswith; fast_pattern; http.host; content:"whatsapp.verify.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001615; classtype:social-engineering; sid:6001615; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwx.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwx.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001616; classtype:social-engineering; sid:6001616; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-resmi979.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"program-resmi979.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001617; classtype:social-engineering; sid:6001617; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cez.dvf.mybluehost.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cez.dvf.mybluehost.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001618; classtype:social-engineering; sid:6001618; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whataspp.verify.help/v/?p=9647719774647)"; flow:established,to_server; http.uri; content:"/v/?p=9647719774647"; startswith; fast_pattern; http.host; content:"whataspp.verify.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001619; classtype:social-engineering; sid:6001619; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure.new.hr-rewards.com/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"secure.new.hr-rewards.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001620; classtype:social-engineering; sid:6001620; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.trust-wallet-en.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.trust-wallet-en.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001621; classtype:social-engineering; sid:6001621; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (innogy.e-docssign.net/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"innogy.e-docssign.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001622; classtype:social-engineering; sid:6001622; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingeg.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingeg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001623; classtype:social-engineering; sid:6001623; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (postch-swisspost.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"postch-swisspost.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001624; classtype:social-engineering; sid:6001624; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tamdaiphat5.github.io/security)"; flow:established,to_server; http.uri; content:"/security"; startswith; fast_pattern; http.host; content:"tamdaiphat5.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001625; classtype:social-engineering; sid:6001625; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (document.webshar.es/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"document.webshar.es"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001626; classtype:social-engineering; sid:6001626; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (https-544nddedc44342442442423232342-e3a8.tony-f61.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"https-544nddedc44342442442423232342-e3a8.tony-f61.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001627; classtype:social-engineering; sid:6001627; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vardhan8060.github.io/javascript-ecommerce-project/)"; flow:established,to_server; http.uri; content:"/javascript-ecommerce-project/"; startswith; fast_pattern; http.host; content:"vardhan8060.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001628; classtype:social-engineering; sid:6001628; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.9247870365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.9247870365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001629; classtype:social-engineering; sid:6001629; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bocai2027.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bocai2027.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001630; classtype:social-engineering; sid:6001630; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hskh-9860.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hskh-9860.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001631; classtype:social-engineering; sid:6001631; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vermillion-churros-e00a9a.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vermillion-churros-e00a9a.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001632; classtype:social-engineering; sid:6001632; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (beta-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"beta-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001633; classtype:social-engineering; sid:6001633; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingsu.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingsu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001634; classtype:social-engineering; sid:6001634; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-drulqor-biz-fruntax-plarnix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-drulqor-biz-fruntax-plarnix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001635; classtype:social-engineering; sid:6001635; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.d666f999.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.d666f999.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001636; classtype:social-engineering; sid:6001636; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-clone-lilac-eight.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-lilac-eight.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001637; classtype:social-engineering; sid:6001637; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ptshopee033.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ptshopee033.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001638; classtype:social-engineering; sid:6001638; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-sigma-hazel.vercel.app/auth)"; flow:established,to_server; http.uri; content:"/auth"; startswith; fast_pattern; http.host; content:"netflix-clone-sigma-hazel.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001639; classtype:social-engineering; sid:6001639; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eosvx.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eosvx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001640; classtype:social-engineering; sid:6001640; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (indoonxpayllaterrnew.bestxzor.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"indoonxpayllaterrnew.bestxzor.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001641; classtype:social-engineering; sid:6001641; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi7767.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"info-resmi7767.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001642; classtype:social-engineering; sid:6001642; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sliwxcc.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sliwxcc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001643; classtype:social-engineering; sid:6001643; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.auth983781901982737192.ocslinicals.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.auth983781901982737192.ocslinicals.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001644; classtype:social-engineering; sid:6001644; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (identifiez-vous42.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"identifiez-vous42.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001645; classtype:social-engineering; sid:6001645; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sunrisemailweb.flazio.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sunrisemailweb.flazio.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001646; classtype:social-engineering; sid:6001646; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vmi3340884.contaboserver.net/cr/corres/COR/COR/corr.php)"; flow:established,to_server; http.uri; content:"/cr/corres/COR/COR/corr.php"; startswith; fast_pattern; http.host; content:"vmi3340884.contaboserver.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001647; classtype:social-engineering; sid:6001647; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nzeljf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nzeljf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001648; classtype:social-engineering; sid:6001648; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (escehrgroup.com/?email=d)"; flow:established,to_server; http.uri; content:"/?email=d"; startswith; fast_pattern; http.host; content:"escehrgroup.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001649; classtype:social-engineering; sid:6001649; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ptshopee033.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ptshopee033.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001650; classtype:social-engineering; sid:6001650; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingew.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingew.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001651; classtype:social-engineering; sid:6001651; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.systxt754-sgbi.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.systxt754-sgbi.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001652; classtype:social-engineering; sid:6001652; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-plornex-biz-slortik-frunvor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-plornex-biz-slortik-frunvor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001653; classtype:social-engineering; sid:6001653; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingsi.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingsi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001654; classtype:social-engineering; sid:6001654; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sim-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.sim-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001655; classtype:social-engineering; sid:6001655; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (post-avis-de-passage-relivraison.vercel.app/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"post-avis-de-passage-relivraison.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001656; classtype:social-engineering; sid:6001656; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwm.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwm.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001657; classtype:social-engineering; sid:6001657; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (009987b555552.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"009987b555552.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001658; classtype:social-engineering; sid:6001658; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-tramvor-biz-glarnik-drultex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-tramvor-biz-glarnik-drultex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001659; classtype:social-engineering; sid:6001659; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bellojawad4111.github.io/My-facebook-page/)"; flow:established,to_server; http.uri; content:"/My-facebook-page/"; startswith; fast_pattern; http.host; content:"bellojawad4111.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001660; classtype:social-engineering; sid:6001660; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bagi-bagi-hadiah677.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bagi-bagi-hadiah677.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001661; classtype:social-engineering; sid:6001661; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreib2ofz55l4gjzluimk6wkhcxlj2avfmbmkjlsp442cnzirap3ckjy.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreib2ofz55l4gjzluimk6wkhcxlj2avfmbmkjlsp442cnzirap3ckjy.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001662; classtype:social-engineering; sid:6001662; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tinyurl.com/InterDelivery)"; flow:established,to_server; http.uri; content:"/InterDelivery"; startswith; fast_pattern; http.host; content:"tinyurl.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001663; classtype:social-engineering; sid:6001663; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.123trx.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.123trx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001664; classtype:social-engineering; sid:6001664; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-stack.pages.dev/appeals/submit-appeal-form/return)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-form/return"; startswith; fast_pattern; http.host; content:"meta-stack.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001665; classtype:social-engineering; sid:6001665; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-tramvor-biz-dranqor-vralnix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-tramvor-biz-dranqor-vralnix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001666; classtype:social-engineering; sid:6001666; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.2349365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.2349365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001667; classtype:social-engineering; sid:6001667; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (axincoin.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"axincoin.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001668; classtype:social-engineering; sid:6001668; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telefoon.flazio.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telefoon.flazio.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001669; classtype:social-engineering; sid:6001669; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1615555333.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1615555333.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001670; classtype:social-engineering; sid:6001670; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (feiji-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"feiji-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001671; classtype:social-engineering; sid:6001671; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazonwebclone-alpha.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazonwebclone-alpha.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001672; classtype:social-engineering; sid:6001672; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bwpyex.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bwpyex.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001673; classtype:social-engineering; sid:6001673; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-support-bridge.pages.dev/appeals/submit-appeal-form/return)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-form/return"; startswith; fast_pattern; http.host; content:"meta-support-bridge.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001674; classtype:social-engineering; sid:6001674; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.fraud-protect.com/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"login.fraud-protect.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001675; classtype:social-engineering; sid:6001675; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-aegis-u4o.pages.dev/appeals/submit-appeal-form/return)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-form/return"; startswith; fast_pattern; http.host; content:"meta-aegis-u4o.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001676; classtype:social-engineering; sid:6001676; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (idapple-br.com/tTkcz/)"; flow:established,to_server; http.uri; content:"/tTkcz/"; startswith; fast_pattern; http.host; content:"idapple-br.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001677; classtype:social-engineering; sid:6001677; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qinzhou-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qinzhou-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001678; classtype:social-engineering; sid:6001678; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nehagupta-coder.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"nehagupta-coder.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001679; classtype:social-engineering; sid:6001679; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365756zxd.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365756zxd.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001680; classtype:social-engineering; sid:6001680; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nationwidelicensingsystem.docmechdel.sbs/d0cs/d0cs/windows/utility.php/)"; flow:established,to_server; http.uri; content:"/d0cs/d0cs/windows/utility.php/"; startswith; fast_pattern; http.host; content:"nationwidelicensingsystem.docmechdel.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001681; classtype:social-engineering; sid:6001681; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-xolnex-biz-vraltor-drunik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-xolnex-biz-vraltor-drunik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001682; classtype:social-engineering; sid:6001682; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kingswet431-spec.github.io/for-real-use/)"; flow:established,to_server; http.uri; content:"/for-real-use/"; startswith; fast_pattern; http.host; content:"kingswet431-spec.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001683; classtype:social-engineering; sid:6001683; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info.remote-otp.com/homepage/corporate-offer?rid=QGtPzS6)"; flow:established,to_server; http.uri; content:"/homepage/corporate-offer?rid=QGtPzS6"; startswith; fast_pattern; http.host; content:"info.remote-otp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001684; classtype:social-engineering; sid:6001684; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sreenu9133.github.io/insta-login-page-ui)"; flow:established,to_server; http.uri; content:"/insta-login-page-ui"; startswith; fast_pattern; http.host; content:"sreenu9133.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001685; classtype:social-engineering; sid:6001685; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.authorised-support.com/microsoft365/mfa/PA7DrZmy7BgokPONGDiZO9H9kV8qJ8Ly5VEA=2Aw==3XlpQQVxAXFVHbF5VUmxfXFRaXQ==/7XkYq0JOunZn8Twk5JBWTMExm1brXaV5)"; flow:established,to_server; http.uri; content:"/microsoft365/mfa/PA7DrZmy7BgokPONGDiZO9H9kV8qJ8Ly5VEA=2Aw==3XlpQQVxAXFVHbF5VUmxfXFRaXQ==/7XkYq0JOunZn8Twk5JBWTMExm1brXaV5"; startswith; fast_pattern; http.host; content:"login.authorised-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001686; classtype:social-engineering; sid:6001686; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tiktoke.fit/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tiktoke.fit"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001687; classtype:social-engineering; sid:6001687; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingwx.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingwx.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001688; classtype:social-engineering; sid:6001688; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-git-brnunes-web-auction-allow-sepolia-uniswap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-git-brnunes-web-auction-allow-sepolia-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001689; classtype:social-engineering; sid:6001689; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingst.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingst.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001690; classtype:social-engineering; sid:6001690; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17537.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17537.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001691; classtype:social-engineering; sid:6001691; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.214365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.214365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001692; classtype:social-engineering; sid:6001692; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aav-zra-biz-kpo-miv-sp7ct2.pages.dev/form_submit_appeal/)"; flow:established,to_server; http.uri; content:"/form_submit_appeal/"; startswith; fast_pattern; http.host; content:"aav-zra-biz-kpo-miv-sp7ct2.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001693; classtype:social-engineering; sid:6001693; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (basic-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"basic-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001694; classtype:social-engineering; sid:6001694; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sirivarshini04.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"sirivarshini04.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001695; classtype:social-engineering; sid:6001695; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6318365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6318365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001696; classtype:social-engineering; sid:6001696; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zaidbek.github.io/unstagram/index.html)"; flow:established,to_server; http.uri; content:"/unstagram/index.html"; startswith; fast_pattern; http.host; content:"zaidbek.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001697; classtype:social-engineering; sid:6001697; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.trip-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.trip-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001698; classtype:social-engineering; sid:6001698; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-traqnik-biz-glurnor-plavtex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-traqnik-biz-glurnor-plavtex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001699; classtype:social-engineering; sid:6001699; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.amazon-clone-coral-nine.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-clone-coral-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001700; classtype:social-engineering; sid:6001700; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1615www.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1615www.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001701; classtype:social-engineering; sid:6001701; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (parcelhouse.4-222-235-4.cpanel.site/eu/)"; flow:established,to_server; http.uri; content:"/eu/"; startswith; fast_pattern; http.host; content:"parcelhouse.4-222-235-4.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001702; classtype:social-engineering; sid:6001702; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paruchuruvyshnavi.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"paruchuruvyshnavi.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001703; classtype:social-engineering; sid:6001703; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.spotify-clone-project-ashy.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.spotify-clone-project-ashy.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001704; classtype:social-engineering; sid:6001704; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (good.coinbase-inv.vip/?adid=1230706)"; flow:established,to_server; http.uri; content:"/?adid=1230706"; startswith; fast_pattern; http.host; content:"good.coinbase-inv.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001705; classtype:social-engineering; sid:6001705; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sources.sviluppo.host/Login/S2FB10FG5N4FG4N154DR1G52RE1H45RT1HJ0000000E241R4H1ER1H00000/)"; flow:established,to_server; http.uri; content:"/Login/S2FB10FG5N4FG4N154DR1G52RE1H45RT1HJ0000000E241R4H1ER1H00000/"; startswith; fast_pattern; http.host; content:"sources.sviluppo.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001706; classtype:social-engineering; sid:6001706; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kanji138.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kanji138.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001707; classtype:social-engineering; sid:6001707; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee-pusat1212.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.shopee-pusat1212.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001708; classtype:social-engineering; sid:6001708; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (theqntp.com/authy/?=1TEgjGuEyd3bgmsAmjCTL8B0pW3OteXuTDtuV0qttUtwC3WvJWPJrOe2hajAgX6SrWbCe44ab7IehPtTkdAQbZIG9maiTQlx54LRYegwutGVXB6HexscVJ3oOHMFHN1BmSS5FT26UEFYmObZPVLbE7G4v3slPwTJ3ZvypZrYEbkYb8MmLWOxhiUNywJYUGIumyOaWKO3)"; flow:established,to_server; http.uri; content:"/authy/?=1TEgjGuEyd3bgmsAmjCTL8B0pW3OteXuTDtuV0qttUtwC3WvJWPJrOe2hajAgX6SrWbCe44ab7IehPtTkdAQbZIG9maiTQlx54LRYegwutGVXB6HexscVJ3oOHMFHN1BmSS5FT26UEFYmObZPVLbE7G4v3slPwTJ3ZvypZrYEbkYb8MmLWOxhiUNywJYUGIumyOaWKO3"; startswith; fast_pattern; http.host; content:"theqntp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001709; classtype:social-engineering; sid:6001709; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-vraltik-biz-glortex-dramnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-vraltik-biz-glortex-dramnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001710; classtype:social-engineering; sid:6001710; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-m277.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-m277.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001711; classtype:social-engineering; sid:6001711; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17553.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17553.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001712; classtype:social-engineering; sid:6001712; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee-pusat1212.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopee-pusat1212.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001713; classtype:social-engineering; sid:6001713; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17559.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17559.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001714; classtype:social-engineering; sid:6001714; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (user-cembraaap-hostname.b-cdn.net/B92x5T/d9fe07c.html?t=75fKocgGIpVxuo0l65wSjf8_Wexjryv9ww)"; flow:established,to_server; http.uri; content:"/B92x5T/d9fe07c.html?t=75fKocgGIpVxuo0l65wSjf8_Wexjryv9ww"; startswith; fast_pattern; http.host; content:"user-cembraaap-hostname.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001715; classtype:social-engineering; sid:6001715; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1xlite-94803.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1xlite-94803.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001716; classtype:social-engineering; sid:6001716; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-clone-umber-kappa.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-umber-kappa.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001717; classtype:social-engineering; sid:6001717; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (double-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"double-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001718; classtype:social-engineering; sid:6001718; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ww87365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ww87365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001719; classtype:social-engineering; sid:6001719; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icy-resonance-7dea.pete-803.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"icy-resonance-7dea.pete-803.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001720; classtype:social-engineering; sid:6001720; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (majorartproductions.com/doc/)"; flow:established,to_server; http.uri; content:"/doc/"; startswith; fast_pattern; http.host; content:"majorartproductions.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001721; classtype:social-engineering; sid:6001721; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15393.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15393.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001722; classtype:social-engineering; sid:6001722; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15823.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15823.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001723; classtype:social-engineering; sid:6001723; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ymca.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ymca.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001724; classtype:social-engineering; sid:6001724; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-fralnix-biz-glortek-plurnax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-fralnix-biz-glortek-plurnax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001725; classtype:social-engineering; sid:6001725; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cez.dvf.mybluehost.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cez.dvf.mybluehost.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001726; classtype:social-engineering; sid:6001726; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qurnex-biz-plarnik-glotex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qurnex-biz-plarnik-glotex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001727; classtype:social-engineering; sid:6001727; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-pink-kappa.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-pink-kappa.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001728; classtype:social-engineering; sid:6001728; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (albertjataya.org/BG/)"; flow:established,to_server; http.uri; content:"/BG/"; startswith; fast_pattern; http.host; content:"albertjataya.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001729; classtype:social-engineering; sid:6001729; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-zernivax.pages.dev/appeals/submit-appeal-form/return)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-form/return"; startswith; fast_pattern; http.host; content:"meta-zernivax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001730; classtype:social-engineering; sid:6001730; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15395.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15395.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001731; classtype:social-engineering; sid:6001731; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ymca.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ymca.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001732; classtype:social-engineering; sid:6001732; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-nextjs-sooty.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-nextjs-sooty.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001733; classtype:social-engineering; sid:6001733; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.e-odemeler.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.e-odemeler.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001734; classtype:social-engineering; sid:6001734; rev:1; metadata: signature_severity Major, created_et 2026_06_04, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-page-trezor.wixstudio.com/us-bridge)"; flow:established,to_server; http.uri; content:"/us-bridge"; startswith; fast_pattern; http.host; content:"app-page-trezor.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001735; classtype:social-engineering; sid:6001735; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.pl-214154.cfd/oferta/rower-wodny-pelikan-22/68838)"; flow:established,to_server; http.uri; content:"/oferta/rower-wodny-pelikan-22/68838"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-214154.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001736; classtype:social-engineering; sid:6001736; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-authentication.secure-datalink.org/landing/form/6268997c-22d3-4670-a7b1-d486420fb4ac)"; flow:established,to_server; http.uri; content:"/landing/form/6268997c-22d3-4670-a7b1-d486420fb4ac"; startswith; fast_pattern; http.host; content:"facebook-authentication.secure-datalink.org"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001737; classtype:social-engineering; sid:6001737; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prime-video-facture.com/suivi)"; flow:established,to_server; http.uri; content:"/suivi"; startswith; fast_pattern; http.host; content:"prime-video-facture.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001738; classtype:social-engineering; sid:6001738; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.cxrmptv.club/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.cxrmptv.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001739; classtype:social-engineering; sid:6001739; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xdmcta.top/pay/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.xdmcta.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001740; classtype:social-engineering; sid:6001740; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (l-iniciarseuatendimentohoje.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"l-iniciarseuatendimentohoje.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001741; classtype:social-engineering; sid:6001741; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-dranqor-biz-vralnik-gluntex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-dranqor-biz-vralnik-gluntex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001742; classtype:social-engineering; sid:6001742; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coversmine.weebly.com/blog/wwe-2k-battlegrounds-caw)"; flow:established,to_server; http.uri; content:"/blog/wwe-2k-battlegrounds-caw"; startswith; fast_pattern; http.host; content:"coversmine.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001743; classtype:social-engineering; sid:6001743; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rokpbm.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.rokpbm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001744; classtype:social-engineering; sid:6001744; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (useforhuzaifa-wq.github.io/Amazon-web-2/)"; flow:established,to_server; http.uri; content:"/Amazon-web-2/"; startswith; fast_pattern; http.host; content:"useforhuzaifa-wq.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001745; classtype:social-engineering; sid:6001745; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-fraltor-biz-vrolqor-qarnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-fraltor-biz-vrolqor-qarnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001746; classtype:social-engineering; sid:6001746; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-glavtex-biz-fruntor-vranik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-glavtex-biz-fruntor-vranik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001747; classtype:social-engineering; sid:6001747; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.whsnxl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.whsnxl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001748; classtype:social-engineering; sid:6001748; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingey.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingey.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001749; classtype:social-engineering; sid:6001749; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.rwenzoritechub.com/doublec/po/rabi/xnkPvzG/amFzb24uYmVhdW1vbnRAbXl0b25mb29kZ3JvdXAuY29t)"; flow:established,to_server; http.uri; content:"/doublec/po/rabi/xnkPvzG/amFzb24uYmVhdW1vbnRAbXl0b25mb29kZ3JvdXAuY29t"; startswith; fast_pattern; http.host; content:"www.rwenzoritechub.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001750; classtype:social-engineering; sid:6001750; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oakandgarden.eu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"oakandgarden.eu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001751; classtype:social-engineering; sid:6001751; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (syszgd.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"syszgd.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001752; classtype:social-engineering; sid:6001752; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oily-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"oily-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001753; classtype:social-engineering; sid:6001753; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-tranqax-biz-plurnor-qravtek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-tranqax-biz-plurnor-qravtek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001754; classtype:social-engineering; sid:6001754; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.scqyjo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.scqyjo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001755; classtype:social-engineering; sid:6001755; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jcshyt.top/pay/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.jcshyt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001756; classtype:social-engineering; sid:6001756; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox.com.kz/users/1179291790/profile)"; flow:established,to_server; http.uri; content:"/users/1179291790/profile"; startswith; fast_pattern; http.host; content:"www.roblox.com.kz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001757; classtype:social-engineering; sid:6001757; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17402.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17402.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001758; classtype:social-engineering; sid:6001758; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dsk010101010001010010.vercel.app/Ma010chelpAbh1041/index.html?ph0nq=null)"; flow:established,to_server; http.uri; content:"/Ma010chelpAbh1041/index.html?ph0nq=null"; startswith; fast_pattern; http.host; content:"dsk010101010001010010.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001759; classtype:social-engineering; sid:6001759; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hjsu8m.naifei.bet/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hjsu8m.naifei.bet"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001760; classtype:social-engineering; sid:6001760; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-clone-delta-hazel.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-delta-hazel.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001761; classtype:social-engineering; sid:6001761; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-page-builder--lucasas22.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-page-builder--lucasas22.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001762; classtype:social-engineering; sid:6001762; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (makeredto.org/wp-content/themes/help/hard_88390993993/ups/indexbill.php?info=Global&)"; flow:established,to_server; http.uri; content:"/wp-content/themes/help/hard_88390993993/ups/indexbill.php?info=Global&"; startswith; fast_pattern; http.host; content:"makeredto.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001763; classtype:social-engineering; sid:6001763; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (emamazumder.github.io/Amazon-Clone-Website)"; flow:established,to_server; http.uri; content:"/Amazon-Clone-Website"; startswith; fast_pattern; http.host; content:"emamazumder.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001764; classtype:social-engineering; sid:6001764; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-qravlor-biz-slurnik-framvor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-qravlor-biz-slurnik-framvor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001765; classtype:social-engineering; sid:6001765; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bigelsinindirimkodu.amazingcoupons.co.uk/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"bigelsinindirimkodu.amazingcoupons.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001766; classtype:social-engineering; sid:6001766; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f-feiraosrs2026.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f-feiraosrs2026.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001767; classtype:social-engineering; sid:6001767; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-nolvarin.pages.dev/appeals/submit-appeal-form/return)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-form/return"; startswith; fast_pattern; http.host; content:"meta-nolvarin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001768; classtype:social-engineering; sid:6001768; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zjcaks.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zjcaks.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001769; classtype:social-engineering; sid:6001769; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pixelora.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pixelora.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001770; classtype:social-engineering; sid:6001770; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-qarnax-biz-slurnik-plaqtor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-qarnax-biz-slurnik-plaqtor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001771; classtype:social-engineering; sid:6001771; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-vraxtor-biz-fralqor-dravnix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-vraxtor-biz-fralqor-dravnix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001772; classtype:social-engineering; sid:6001772; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (growthoptimizerx.com/oop/home.php)"; flow:established,to_server; http.uri; content:"/oop/home.php"; startswith; fast_pattern; http.host; content:"growthoptimizerx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001773; classtype:social-engineering; sid:6001773; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.clone-netflix-alpha-two.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.clone-netflix-alpha-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001774; classtype:social-engineering; sid:6001774; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagramlogin-accounts-logintocontinue.github.io/login-verification)"; flow:established,to_server; http.uri; content:"/login-verification"; startswith; fast_pattern; http.host; content:"instagramlogin-accounts-logintocontinue.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001775; classtype:social-engineering; sid:6001775; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.qr.codes/UDpCqT/)"; flow:established,to_server; http.uri; content:"/UDpCqT/"; startswith; fast_pattern; http.host; content:"www.qr.codes"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001776; classtype:social-engineering; sid:6001776; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4rbh-zqg8-clq3.accounts-dynamech-ca-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4rbh-zqg8-clq3.accounts-dynamech-ca-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001777; classtype:social-engineering; sid:6001777; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortan.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortan.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001778; classtype:social-engineering; sid:6001778; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17428.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17428.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001779; classtype:social-engineering; sid:6001779; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maquiequiposmyosas.com/wp-includes/xoffice/SharePoint-LLHDBMPORTUGAL.html)"; flow:established,to_server; http.uri; content:"/wp-includes/xoffice/SharePoint-LLHDBMPORTUGAL.html"; startswith; fast_pattern; http.host; content:"maquiequiposmyosas.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001780; classtype:social-engineering; sid:6001780; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-zarnex-biz-fralvik-qortem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-zarnex-biz-fralvik-qortem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001781; classtype:social-engineering; sid:6001781; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zjdc-22038.wasmer.app/dist/)"; flow:established,to_server; http.uri; content:"/dist/"; startswith; fast_pattern; http.host; content:"zjdc-22038.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001782; classtype:social-engineering; sid:6001782; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zulpiyev.github.io/js29)"; flow:established,to_server; http.uri; content:"/js29"; startswith; fast_pattern; http.host; content:"zulpiyev.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001783; classtype:social-engineering; sid:6001783; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.neplxt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.neplxt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001784; classtype:social-engineering; sid:6001784; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store.communityappitem.shop/workshop/AK47-EternalDecay/)"; flow:established,to_server; http.uri; content:"/workshop/AK47-EternalDecay/"; startswith; fast_pattern; http.host; content:"store.communityappitem.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001785; classtype:social-engineering; sid:6001785; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ldgkooejkd.azulab24.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ldgkooejkd.azulab24.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001786; classtype:social-engineering; sid:6001786; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-clone-mu-hazel.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-mu-hazel.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001787; classtype:social-engineering; sid:6001787; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingsii.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingsii.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001788; classtype:social-engineering; sid:6001788; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apple-map.live/xXS)"; flow:established,to_server; http.uri; content:"/xXS"; startswith; fast_pattern; http.host; content:"apple-map.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001789; classtype:social-engineering; sid:6001789; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bloxfit.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bloxfit.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001790; classtype:social-engineering; sid:6001790; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.e-odeme.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.e-odeme.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001791; classtype:social-engineering; sid:6001791; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rashithakoppurouthu.github.io/amazonclone/)"; flow:established,to_server; http.uri; content:"/amazonclone/"; startswith; fast_pattern; http.host; content:"rashithakoppurouthu.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001792; classtype:social-engineering; sid:6001792; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adiaditi-priya17.github.io/Netflix_Clone/)"; flow:established,to_server; http.uri; content:"/Netflix_Clone/"; startswith; fast_pattern; http.host; content:"adiaditi-priya17.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001793; classtype:social-engineering; sid:6001793; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-glavqor-biz-slortik-frantex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-glavqor-biz-slortik-frantex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001794; classtype:social-engineering; sid:6001794; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zh-coinbase.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zh-coinbase.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001795; classtype:social-engineering; sid:6001795; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vrontek-biz-slarnix-framor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vrontek-biz-slarnix-framor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001796; classtype:social-engineering; sid:6001796; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pfoten-nahrung.de/factura/)"; flow:established,to_server; http.uri; content:"/factura/"; startswith; fast_pattern; http.host; content:"pfoten-nahrung.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001797; classtype:social-engineering; sid:6001797; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17384.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17384.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001798; classtype:social-engineering; sid:6001798; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (startling-marzipan-94f36b.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"startling-marzipan-94f36b.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001799; classtype:social-engineering; sid:6001799; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (esl-fraud-claims.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"esl-fraud-claims.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001800; classtype:social-engineering; sid:6001800; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17551.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17551.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001801; classtype:social-engineering; sid:6001801; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (peeyushgupta967.github.io/amazonClonewebpage-with-help-of-html-and-css-)"; flow:established,to_server; http.uri; content:"/amazonClonewebpage-with-help-of-html-and-css-"; startswith; fast_pattern; http.host; content:"peeyushgupta967.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001802; classtype:social-engineering; sid:6001802; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1958833.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1958833.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001803; classtype:social-engineering; sid:6001803; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cuentainactiva2026.github.io/email)"; flow:established,to_server; http.uri; content:"/email"; startswith; fast_pattern; http.host; content:"cuentainactiva2026.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001804; classtype:social-engineering; sid:6001804; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (esl-fraud-claims.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"esl-fraud-claims.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001805; classtype:social-engineering; sid:6001805; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-lake.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-lake.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001806; classtype:social-engineering; sid:6001806; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (obrapia.com/Adobe/en_Installer)"; flow:established,to_server; http.uri; content:"/Adobe/en_Installer"; startswith; fast_pattern; http.host; content:"obrapia.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001807; classtype:social-engineering; sid:6001807; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nul-01a.github.io/invest-fix)"; flow:established,to_server; http.uri; content:"/invest-fix"; startswith; fast_pattern; http.host; content:"nul-01a.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001808; classtype:social-engineering; sid:6001808; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paypay-bank-loginusercenter-fyp.github.io/sudo/)"; flow:established,to_server; http.uri; content:"/sudo/"; startswith; fast_pattern; http.host; content:"paypay-bank-loginusercenter-fyp.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001809; classtype:social-engineering; sid:6001809; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17394.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17394.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001810; classtype:social-engineering; sid:6001810; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.twplqxr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.twplqxr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001811; classtype:social-engineering; sid:6001811; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-dravtex-biz-plaqvor-glurnax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-dravtex-biz-plaqvor-glurnax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001812; classtype:social-engineering; sid:6001812; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jnelfk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jnelfk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001813; classtype:social-engineering; sid:6001813; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bet6663.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bet6663.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001814; classtype:social-engineering; sid:6001814; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (antivirus.sg/cny/en.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1)"; flow:established,to_server; http.uri; content:"/cny/en.php?rand=13InboxLightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13InboxLight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=&.rand=13InboxLight.aspx?n=1774256418&fid=4#n=1252899642&fid=1&fav=1"; startswith; fast_pattern; http.host; content:"antivirus.sg"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001815; classtype:social-engineering; sid:6001815; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cloud.sviluppo.host/Login/DF0BGD21N1Y41KJ4TYU1R41G4ERTH16R4JK10000000ZE5FGZ1Y4E400000/)"; flow:established,to_server; http.uri; content:"/Login/DF0BGD21N1Y41KJ4TYU1R41G4ERTH16R4JK10000000ZE5FGZ1Y4E400000/"; startswith; fast_pattern; http.host; content:"cloud.sviluppo.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001816; classtype:social-engineering; sid:6001816; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bg2-n11.global.ssl.fastly.net/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"bg2-n11.global.ssl.fastly.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001817; classtype:social-engineering; sid:6001817; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home-webmail-login-mvefi1z5snnoqy2ekh.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"home-webmail-login-mvefi1z5snnoqy2ekh.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001818; classtype:social-engineering; sid:6001818; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gnwrzkp.icu/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gnwrzkp.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001819; classtype:social-engineering; sid:6001819; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adityakumar712.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"adityakumar712.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001820; classtype:social-engineering; sid:6001820; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meppla.com/bassettassociates)"; flow:established,to_server; http.uri; content:"/bassettassociates"; startswith; fast_pattern; http.host; content:"meppla.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001821; classtype:social-engineering; sid:6001821; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-dranqax-biz-slortik-vralnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-dranqax-biz-slortik-vralnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001822; classtype:social-engineering; sid:6001822; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreigxlel6k7fm2g4gwpthofpcnb5yr3syium2wrfxvw3gge6rvhmixe.ipfs.w3s.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreigxlel6k7fm2g4gwpthofpcnb5yr3syium2wrfxvw3gge6rvhmixe.ipfs.w3s.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001823; classtype:social-engineering; sid:6001823; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-docsign.s3.us-east-2.amazonaws.com/adobereader/index.html)"; flow:established,to_server; http.uri; content:"/adobereader/index.html"; startswith; fast_pattern; http.host; content:"secure-docsign.s3.us-east-2.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001824; classtype:social-engineering; sid:6001824; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.movique.cyou/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.movique.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001825; classtype:social-engineering; sid:6001825; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hortenciateles.github.io/facebook-copia/)"; flow:established,to_server; http.uri; content:"/facebook-copia/"; startswith; fast_pattern; http.host; content:"hortenciateles.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001826; classtype:social-engineering; sid:6001826; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dgdwxl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dgdwxl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001827; classtype:social-engineering; sid:6001827; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1615uuu.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1615uuu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001828; classtype:social-engineering; sid:6001828; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-vralnik-biz-qoltex-plurnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-vralnik-biz-qoltex-plurnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001829; classtype:social-engineering; sid:6001829; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-slortor-biz-framnik-glarnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-slortor-biz-framnik-glarnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001830; classtype:social-engineering; sid:6001830; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-dravtek-biz-vraqlor-slurnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-dravtek-biz-vraqlor-slurnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001831; classtype:social-engineering; sid:6001831; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gg1775.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.gg1775.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001832; classtype:social-engineering; sid:6001832; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fluidpolicyreview.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fluidpolicyreview.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001833; classtype:social-engineering; sid:6001833; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiav45q7ijzvs3vtzq6z62byalu3epl42avfqi4icebqjl2mc55fdy.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiav45q7ijzvs3vtzq6z62byalu3epl42avfqi4icebqjl2mc55fdy.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001834; classtype:social-engineering; sid:6001834; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support.digitalprocurements.co.uk/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"support.digitalprocurements.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001835; classtype:social-engineering; sid:6001835; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-glamtex-biz-dravlor-fruntik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-glamtex-biz-dravlor-fruntik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001836; classtype:social-engineering; sid:6001836; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bet36500004.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bet36500004.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001837; classtype:social-engineering; sid:6001837; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-slurnor-biz-plaqtex-glavnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-slurnor-biz-plaqtex-glavnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001838; classtype:social-engineering; sid:6001838; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-glurnik-biz-plortor-fraltex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-glurnik-biz-plortor-fraltex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001839; classtype:social-engineering; sid:6001839; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pgkhwq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pgkhwq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001840; classtype:social-engineering; sid:6001840; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-tronvik-biz-qalnex-frutor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-tronvik-biz-qalnex-frutor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001841; classtype:social-engineering; sid:6001841; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (post.uberweisung.org/278048391/de)"; flow:established,to_server; http.uri; content:"/278048391/de"; startswith; fast_pattern; http.host; content:"post.uberweisung.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001842; classtype:social-engineering; sid:6001842; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.color.hop.ru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.color.hop.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001843; classtype:social-engineering; sid:6001843; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingsi.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingsi.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001844; classtype:social-engineering; sid:6001844; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.makharza.ps/lehnpainting/)"; flow:established,to_server; http.uri; content:"/lehnpainting/"; startswith; fast_pattern; http.host; content:"www.makharza.ps"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001845; classtype:social-engineering; sid:6001845; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fraud-claims-esl.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fraud-claims-esl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001846; classtype:social-engineering; sid:6001846; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-porthub.pages.dev/appeals/submit-appeal-form/return)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-form/return"; startswith; fast_pattern; http.host; content:"meta-porthub.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001847; classtype:social-engineering; sid:6001847; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-plaqtex-biz-dravlor-sluntik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-plaqtex-biz-dravlor-sluntik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001848; classtype:social-engineering; sid:6001848; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (swift-event-488641.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"swift-event-488641.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001849; classtype:social-engineering; sid:6001849; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nmjbgt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nmjbgt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001850; classtype:social-engineering; sid:6001850; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (user-cembraaap-bitrefill.b-cdn.net/B92x5T/d9fe07c.html)"; flow:established,to_server; http.uri; content:"/B92x5T/d9fe07c.html"; startswith; fast_pattern; http.host; content:"user-cembraaap-bitrefill.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001851; classtype:social-engineering; sid:6001851; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-support-network.pages.dev/appeals/submit-appeal-form/return)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-form/return"; startswith; fast_pattern; http.host; content:"meta-support-network.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001852; classtype:social-engineering; sid:6001852; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (beta.ldebc.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"beta.ldebc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001853; classtype:social-engineering; sid:6001853; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gmtrjx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gmtrjx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001854; classtype:social-engineering; sid:6001854; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-clone-sigma-hazel.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-sigma-hazel.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001855; classtype:social-engineering; sid:6001855; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-plamnik-biz-glortex-dravtor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-plamnik-biz-glortex-dravtor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001856; classtype:social-engineering; sid:6001856; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (glittery-pegasus-dbc406.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"glittery-pegasus-dbc406.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001857; classtype:social-engineering; sid:6001857; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (homenovoacessb.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"homenovoacessb.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001858; classtype:social-engineering; sid:6001858; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.wemhki.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.wemhki.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001859; classtype:social-engineering; sid:6001859; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (esl-fraud-claims.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"esl-fraud-claims.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001860; classtype:social-engineering; sid:6001860; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vsd6m8rtpo.cloudfrontsa.cyou/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vsd6m8rtpo.cloudfrontsa.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001861; classtype:social-engineering; sid:6001861; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bgcb-3wfu-2x0k.rdials-compasslabservices-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bgcb-3wfu-2x0k.rdials-compasslabservices-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001862; classtype:social-engineering; sid:6001862; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (center-reassurance-adminpage.pages.dev/help/contact/637539019806253)"; flow:established,to_server; http.uri; content:"/help/contact/637539019806253"; startswith; fast_pattern; http.host; content:"center-reassurance-adminpage.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001863; classtype:social-engineering; sid:6001863; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clone-netflix-alpha-two.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clone-netflix-alpha-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001864; classtype:social-engineering; sid:6001864; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-for-brynvero-8jq.pages.dev/login/)"; flow:established,to_server; http.uri; content:"/login/"; startswith; fast_pattern; http.host; content:"business-for-brynvero-8jq.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001865; classtype:social-engineering; sid:6001865; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-slarnik-biz-vroltor-framtex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-slarnik-biz-vroltor-framtex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001866; classtype:social-engineering; sid:6001866; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (email.securebankinggroup.eu/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"email.securebankinggroup.eu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001867; classtype:social-engineering; sid:6001867; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-plortor-biz-glurnex-vralnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-plortor-biz-glurnex-vralnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001868; classtype:social-engineering; sid:6001868; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3d17-050k-1vwa.brentt-gfwdsupply-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3d17-050k-1vwa.brentt-gfwdsupply-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001869; classtype:social-engineering; sid:6001869; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www-currently-sign-in-fec9a1.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www-currently-sign-in-fec9a1.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001870; classtype:social-engineering; sid:6001870; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-lake.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-lake.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001871; classtype:social-engineering; sid:6001871; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1775ooooo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1775ooooo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001872; classtype:social-engineering; sid:6001872; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingssi.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingssi.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001873; classtype:social-engineering; sid:6001873; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eu.webservices.asia/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/107519/8af662/475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"eu.webservices.asia"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001874; classtype:social-engineering; sid:6001874; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gufdcz.top/pay/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.gufdcz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001875; classtype:social-engineering; sid:6001875; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-negotiation.pages.dev/appeals/submit-appeal-form/return)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-form/return"; startswith; fast_pattern; http.host; content:"meta-negotiation.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001876; classtype:social-engineering; sid:6001876; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mobil2e.de/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mobil2e.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001877; classtype:social-engineering; sid:6001877; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tsogbu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tsogbu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001878; classtype:social-engineering; sid:6001878; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (q.funyfpt.org/dbcpo/class/)"; flow:established,to_server; http.uri; content:"/dbcpo/class/"; startswith; fast_pattern; http.host; content:"q.funyfpt.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001879; classtype:social-engineering; sid:6001879; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (landing.isscrconnect.info/41-1511-280526/)"; flow:established,to_server; http.uri; content:"/41-1511-280526/"; startswith; fast_pattern; http.host; content:"landing.isscrconnect.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001880; classtype:social-engineering; sid:6001880; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-mavnidor.pages.dev/appeals/submit-appeal-form/return)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-form/return"; startswith; fast_pattern; http.host; content:"meta-mavnidor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001881; classtype:social-engineering; sid:6001881; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail-admin-portal-7c9a45.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webmail-admin-portal-7c9a45.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001882; classtype:social-engineering; sid:6001882; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.omhuwk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.omhuwk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001883; classtype:social-engineering; sid:6001883; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-dralvor-biz-glavnik-qoltex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-dralvor-biz-glavnik-qoltex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001884; classtype:social-engineering; sid:6001884; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17752211.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17752211.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001885; classtype:social-engineering; sid:6001885; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.identifiez-vous42.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.identifiez-vous42.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001886; classtype:social-engineering; sid:6001886; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pleuih.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pleuih.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001887; classtype:social-engineering; sid:6001887; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17401.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17401.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001888; classtype:social-engineering; sid:6001888; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-fraltek-biz-glarnor-vraqnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-fraltek-biz-glarnor-vraqnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001889; classtype:social-engineering; sid:6001889; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kzwlnxp.icu/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kzwlnxp.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001890; classtype:social-engineering; sid:6001890; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-froltek-biz-slanvor-drunex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-froltek-biz-slanvor-drunex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001891; classtype:social-engineering; sid:6001891; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (considerate-raven-173194.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"considerate-raven-173194.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001892; classtype:social-engineering; sid:6001892; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (upnobolso.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"upnobolso.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001893; classtype:social-engineering; sid:6001893; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (boompecker.de/Kundenservice-cyon1/index.php)"; flow:established,to_server; http.uri; content:"/Kundenservice-cyon1/index.php"; startswith; fast_pattern; http.host; content:"boompecker.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001894; classtype:social-engineering; sid:6001894; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-qravnix-biz-vroltek-plornax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-qravnix-biz-vroltek-plornax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001895; classtype:social-engineering; sid:6001895; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hilfezentrum-benutzer-info.serveousercontent.com/DE/process/user.html)"; flow:established,to_server; http.uri; content:"/DE/process/user.html"; startswith; fast_pattern; http.host; content:"hilfezentrum-benutzer-info.serveousercontent.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001896; classtype:social-engineering; sid:6001896; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.defisherial.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.defisherial.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001897; classtype:social-engineering; sid:6001897; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blissful-diversity-365097.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"blissful-diversity-365097.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001898; classtype:social-engineering; sid:6001898; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-drolvik-biz-qarnor-slutex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-drolvik-biz-qarnor-slutex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001899; classtype:social-engineering; sid:6001899; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (itsuppports.com/?r=29f30695-002d-440b-984a-a10eebd02ce2&rg=eu)"; flow:established,to_server; http.uri; content:"/?r=29f30695-002d-440b-984a-a10eebd02ce2&rg=eu"; startswith; fast_pattern; http.host; content:"itsuppports.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001900; classtype:social-engineering; sid:6001900; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-plortik-biz-glanex-vrutex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-plortik-biz-glanex-vrutex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001901; classtype:social-engineering; sid:6001901; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pdf30-p-fi13.5676hygh5ghg.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pdf30-p-fi13.5676hygh5ghg.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001902; classtype:social-engineering; sid:6001902; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (altaperformance.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"altaperformance.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001903; classtype:social-engineering; sid:6001903; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookweb.github.io/.com-application-help.center-/)"; flow:established,to_server; http.uri; content:"/.com-application-help.center-/"; startswith; fast_pattern; http.host; content:"facebookweb.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001904; classtype:social-engineering; sid:6001904; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bet98d.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bet98d.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001905; classtype:social-engineering; sid:6001905; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (broader-support-675540.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"broader-support-675540.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001906; classtype:social-engineering; sid:6001906; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.choice-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.choice-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001907; classtype:social-engineering; sid:6001907; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (personal-app-130616.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"personal-app-130616.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001908; classtype:social-engineering; sid:6001908; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-ndax-io-docs.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"support-ndax-io-docs.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001909; classtype:social-engineering; sid:6001909; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gmfbve.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gmfbve.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001910; classtype:social-engineering; sid:6001910; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netzwerk.click/ygjytf5rf58gthtgg)"; flow:established,to_server; http.uri; content:"/ygjytf5rf58gthtgg"; startswith; fast_pattern; http.host; content:"netzwerk.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001911; classtype:social-engineering; sid:6001911; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (magma.casasdomani.net/?email=ZXhhbXBsZUBleGFtcGxlLmNvbQ==)"; flow:established,to_server; http.uri; content:"/?email=ZXhhbXBsZUBleGFtcGxlLmNvbQ=="; startswith; fast_pattern; http.host; content:"magma.casasdomani.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001912; classtype:social-engineering; sid:6001912; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (magalu-copa2026.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"magalu-copa2026.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001913; classtype:social-engineering; sid:6001913; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (notificationaccessaleert.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"notificationaccessaleert.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001914; classtype:social-engineering; sid:6001914; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-tranvik-biz-dravqor-vroltex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-tranvik-biz-dravqor-vroltex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001915; classtype:social-engineering; sid:6001915; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-framnik-biz-plaqtor-glortex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-framnik-biz-plaqtor-glortex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001916; classtype:social-engineering; sid:6001916; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15591.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15591.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001917; classtype:social-engineering; sid:6001917; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-carlivon.pages.dev/appeals/submit-appeal-form/return)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-form/return"; startswith; fast_pattern; http.host; content:"meta-carlivon.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001918; classtype:social-engineering; sid:6001918; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (id8319832apple.sviluppo.host/8209398182/)"; flow:established,to_server; http.uri; content:"/8209398182/"; startswith; fast_pattern; http.host; content:"id8319832apple.sviluppo.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001919; classtype:social-engineering; sid:6001919; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (google-maps.live/fQj)"; flow:established,to_server; http.uri; content:"/fQj"; startswith; fast_pattern; http.host; content:"google-maps.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001920; classtype:social-engineering; sid:6001920; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pszcna.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pszcna.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001921; classtype:social-engineering; sid:6001921; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gaussc.mx/aeenvironmentalconsulting/aeenviroopendocaccess.html)"; flow:established,to_server; http.uri; content:"/aeenvironmentalconsulting/aeenviroopendocaccess.html"; startswith; fast_pattern; http.host; content:"www.gaussc.mx"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001922; classtype:social-engineering; sid:6001922; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (justi-tech.com/XuqMkA4)"; flow:established,to_server; http.uri; content:"/XuqMkA4"; startswith; fast_pattern; http.host; content:"justi-tech.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001923; classtype:social-engineering; sid:6001923; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clientdesktop-live.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"clientdesktop-live.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001924; classtype:social-engineering; sid:6001924; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bernard.ext5723518.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bernard.ext5723518.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001925; classtype:social-engineering; sid:6001925; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (filou.ext5723518.pro/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"filou.ext5723518.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001926; classtype:social-engineering; sid:6001926; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aboula.hub5724557.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aboula.hub5724557.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001927; classtype:social-engineering; sid:6001927; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-c56bca134f274de6b02d532435dd1540.r2.dev/ohmm.html)"; flow:established,to_server; http.uri; content:"/ohmm.html"; startswith; fast_pattern; http.host; content:"pub-c56bca134f274de6b02d532435dd1540.r2.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001928; classtype:social-engineering; sid:6001928; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (desktops-client.wixstudio.com/desktop)"; flow:established,to_server; http.uri; content:"/desktop"; startswith; fast_pattern; http.host; content:"desktops-client.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001929; classtype:social-engineering; sid:6001929; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marcel.hub5724557.pro/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"marcel.hub5724557.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001930; classtype:social-engineering; sid:6001930; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (one-moment-542706.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"one-moment-542706.webflow.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001931; classtype:social-engineering; sid:6001931; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hub5724557.pro/captcha.php)"; flow:established,to_server; http.uri; content:"/captcha.php"; startswith; fast_pattern; http.host; content:"www.hub5724557.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6001932; classtype:social-engineering; sid:6001932; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pickup.e-docssign.net/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"pickup.e-docssign.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001933; classtype:social-engineering; sid:6001933; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-site-editor--mnt1094.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-site-editor--mnt1094.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001934; classtype:social-engineering; sid:6001934; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (storage.yandexcloud.net/seren/jo/bi2/shr.html)"; flow:established,to_server; http.uri; content:"/seren/jo/bi2/shr.html"; startswith; fast_pattern; http.host; content:"storage.yandexcloud.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001935; classtype:social-engineering; sid:6001935; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-slorvik-biz-fratem-vrolnax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-slorvik-biz-fratem-vrolnax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001936; classtype:social-engineering; sid:6001936; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glanvik-biz-qurnex-vroltor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glanvik-biz-qurnex-vroltor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001937; classtype:social-engineering; sid:6001937; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-slortex-biz-fralnik-vramtor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-slortex-biz-fralnik-vramtor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001938; classtype:social-engineering; sid:6001938; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steamcommumnmlty.com/tradeoffer/new/partner=631639158token=p9rogeUI71621)"; flow:established,to_server; http.uri; content:"/tradeoffer/new/partner=631639158token=p9rogeUI71621"; startswith; fast_pattern; http.host; content:"steamcommumnmlty.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001939; classtype:social-engineering; sid:6001939; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (naifei.bet/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"naifei.bet"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001940; classtype:social-engineering; sid:6001940; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17390.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17390.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001941; classtype:social-engineering; sid:6001941; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nitish-04.github.io/Alfido-Tech-Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Alfido-Tech-Netflix-Clone/"; startswith; fast_pattern; http.host; content:"nitish-04.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001942; classtype:social-engineering; sid:6001942; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ms-tech.offices-support.com/i/a7c9fe738e7024d889b4fc6dad4e959ee)"; flow:established,to_server; http.uri; content:"/i/a7c9fe738e7024d889b4fc6dad4e959ee"; startswith; fast_pattern; http.host; content:"ms-tech.offices-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001943; classtype:social-engineering; sid:6001943; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vinuka17.github.io/https-www.instagram.com-reel-CxYZAbc12342-)"; flow:established,to_server; http.uri; content:"/https-www.instagram.com-reel-CxYZAbc12342-"; startswith; fast_pattern; http.host; content:"vinuka17.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001944; classtype:social-engineering; sid:6001944; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (veaxz.fwh.is/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"veaxz.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001945; classtype:social-engineering; sid:6001945; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tecnologiaderecuperacionavanzada.fwh.is/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tecnologiaderecuperacionavanzada.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001946; classtype:social-engineering; sid:6001946; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mik-space.github.io/doument-attacthed/Purchase%20Order)"; flow:established,to_server; http.uri; content:"/doument-attacthed/Purchase%20Order"; startswith; fast_pattern; http.host; content:"mik-space.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001947; classtype:social-engineering; sid:6001947; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alwajalwa.github.io/video-player)"; flow:established,to_server; http.uri; content:"/video-player"; startswith; fast_pattern; http.host; content:"alwajalwa.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001948; classtype:social-engineering; sid:6001948; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inenco.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"inenco.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001949; classtype:social-engineering; sid:6001949; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apple-maplocation.com/nVt)"; flow:established,to_server; http.uri; content:"/nVt"; startswith; fast_pattern; http.host; content:"apple-maplocation.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001950; classtype:social-engineering; sid:6001950; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imagemasters.greetings.pictures/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"imagemasters.greetings.pictures"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001951; classtype:social-engineering; sid:6001951; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pop.goood-mail.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pop.goood-mail.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001952; classtype:social-engineering; sid:6001952; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-tramtex-biz-slortik-fralnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-tramtex-biz-slortik-fralnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001953; classtype:social-engineering; sid:6001953; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure.associateratings.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"secure.associateratings.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001954; classtype:social-engineering; sid:6001954; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.program-resmi979.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.program-resmi979.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001955; classtype:social-engineering; sid:6001955; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glarnik-biz-frunor-plavtex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glarnik-biz-frunor-plavtex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001956; classtype:social-engineering; sid:6001956; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.nn1665.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.nn1665.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001957; classtype:social-engineering; sid:6001957; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (psa.corporatereward.net/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"psa.corporatereward.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001958; classtype:social-engineering; sid:6001958; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (msf.073202.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"msf.073202.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001959; classtype:social-engineering; sid:6001959; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rweysi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rweysi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001960; classtype:social-engineering; sid:6001960; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ip1238199153.itupdatealert.com/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"ip1238199153.itupdatealert.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001961; classtype:social-engineering; sid:6001961; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-slurnor-biz-vratem-glunix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-slurnor-biz-vratem-glunix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001962; classtype:social-engineering; sid:6001962; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ssl.073202.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"ssl.073202.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001963; classtype:social-engineering; sid:6001963; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.q7765.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.q7765.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001964; classtype:social-engineering; sid:6001964; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gweissrs.github.io/Netflix_telalogin)"; flow:established,to_server; http.uri; content:"/Netflix_telalogin"; startswith; fast_pattern; http.host; content:"gweissrs.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001965; classtype:social-engineering; sid:6001965; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ocslinicals.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ocslinicals.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001966; classtype:social-engineering; sid:6001966; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support.new.hr-rewards.com/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa)"; flow:established,to_server; http.uri; content:"/education_redirect_second?475d964a-0243-46bf-aefd-66da26254efa"; startswith; fast_pattern; http.host; content:"support.new.hr-rewards.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001967; classtype:social-engineering; sid:6001967; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingsl.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingsl.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001968; classtype:social-engineering; sid:6001968; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unicredit.market-trust-eu.sbs/client/235413)"; flow:established,to_server; http.uri; content:"/client/235413"; startswith; fast_pattern; http.host; content:"unicredit.market-trust-eu.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001969; classtype:social-engineering; sid:6001969; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloudbuscar.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"icloudbuscar.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001970; classtype:social-engineering; sid:6001970; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-dranvox-biz-plurnek-slatir.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-dranvox-biz-plurnek-slatir.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001971; classtype:social-engineering; sid:6001971; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.tnqzrpt.icu/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.tnqzrpt.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001972; classtype:social-engineering; sid:6001972; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coachingdevie.info/PL-1466-160526/?e=xxx&s3=Tadeusz&s4)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?e=xxx&s3=Tadeusz&s4"; startswith; fast_pattern; http.host; content:"coachingdevie.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001973; classtype:social-engineering; sid:6001973; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imap.goood-mail.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"imap.goood-mail.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001974; classtype:social-engineering; sid:6001974; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zazxwzoz.usw-1.sealos.app/vc/xv/login.php)"; flow:established,to_server; http.uri; content:"/vc/xv/login.php"; startswith; fast_pattern; http.host; content:"zazxwzoz.usw-1.sealos.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001975; classtype:social-engineering; sid:6001975; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (microsoft.com.cobblestonesw.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"microsoft.com.cobblestonesw.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001976; classtype:social-engineering; sid:6001976; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-vroltex-biz-plurnik-dravqor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-vroltex-biz-plurnik-dravqor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001977; classtype:social-engineering; sid:6001977; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.hvtmxqr.xin/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.hvtmxqr.xin"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001978; classtype:social-engineering; sid:6001978; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqtxvlm.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqtxvlm.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001979; classtype:social-engineering; sid:6001979; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gnlgroup.net/santander/index.html)"; flow:established,to_server; http.uri; content:"/santander/index.html"; startswith; fast_pattern; http.host; content:"gnlgroup.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001980; classtype:social-engineering; sid:6001980; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-plurnor-biz-fruntax-slortik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-plurnor-biz-fruntax-slortik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001981; classtype:social-engineering; sid:6001981; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-slanvik-biz-fraltor-qurnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-slanvik-biz-fraltor-qurnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001982; classtype:social-engineering; sid:6001982; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.geswid.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.geswid.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001983; classtype:social-engineering; sid:6001983; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ambystic.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ambystic.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001984; classtype:social-engineering; sid:6001984; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqtxvmp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqtxvmp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001985; classtype:social-engineering; sid:6001985; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xindonesiacstmerns.fredped.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xindonesiacstmerns.fredped.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001986; classtype:social-engineering; sid:6001986; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-vrolqor-biz-plaqnik-glurnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-vrolqor-biz-plaqnik-glurnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001987; classtype:social-engineering; sid:6001987; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supportmail2026.github.io/Activacion/)"; flow:established,to_server; http.uri; content:"/Activacion/"; startswith; fast_pattern; http.host; content:"supportmail2026.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001988; classtype:social-engineering; sid:6001988; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-qoltex-biz-framvor-dravnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-qoltex-biz-framvor-dravnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001989; classtype:social-engineering; sid:6001989; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prathameshschavan.github.io/Project_Airbnb.com/HTML/product.html)"; flow:established,to_server; http.uri; content:"/Project_Airbnb.com/HTML/product.html"; startswith; fast_pattern; http.host; content:"prathameshschavan.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001990; classtype:social-engineering; sid:6001990; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (binance-1-2-11-uniswap.vercel.app/positions)"; flow:established,to_server; http.uri; content:"/positions"; startswith; fast_pattern; http.host; content:"binance-1-2-11-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001991; classtype:social-engineering; sid:6001991; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glornex-biz-vratik-plurnax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glornex-biz-vratik-plurnax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001992; classtype:social-engineering; sid:6001992; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rasebitseirie-maker.github.io/Netflix-Project)"; flow:established,to_server; http.uri; content:"/Netflix-Project"; startswith; fast_pattern; http.host; content:"rasebitseirie-maker.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001993; classtype:social-engineering; sid:6001993; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (upxholdlogun.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"upxholdlogun.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001994; classtype:social-engineering; sid:6001994; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-glortex-biz-slurnor-plamnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-glortex-biz-slurnor-plamnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001995; classtype:social-engineering; sid:6001995; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glurnor-biz-platem-dravnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glurnor-biz-platem-dravnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001996; classtype:social-engineering; sid:6001996; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (intokem.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"intokem.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001997; classtype:social-engineering; sid:6001997; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deeps0408.github.io/instagram-clone)"; flow:established,to_server; http.uri; content:"/instagram-clone"; startswith; fast_pattern; http.host; content:"deeps0408.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001998; classtype:social-engineering; sid:6001998; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-vromqor-biz-plavnik-draltex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-vromqor-biz-plavnik-draltex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6001999; classtype:social-engineering; sid:6001999; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-dravrix-biz-fralnor-pluntex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-dravrix-biz-fralnor-pluntex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002000; classtype:social-engineering; sid:6002000; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faq-exodus.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faq-exodus.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002001; classtype:social-engineering; sid:6002001; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (right-otter-800818.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"right-otter-800818.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002002; classtype:social-engineering; sid:6002002; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (did.li/aHAmC)"; flow:established,to_server; http.uri; content:"/aHAmC"; startswith; fast_pattern; http.host; content:"did.li"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002003; classtype:social-engineering; sid:6002003; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (profile.set-huilier.fr/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"profile.set-huilier.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002004; classtype:social-engineering; sid:6002004; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ducalelara.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ducalelara.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002005; classtype:social-engineering; sid:6002005; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anflaty.github.io/Instagram.login/)"; flow:established,to_server; http.uri; content:"/Instagram.login/"; startswith; fast_pattern; http.host; content:"anflaty.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002006; classtype:social-engineering; sid:6002006; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.eatskorea.com/chsps/)"; flow:established,to_server; http.uri; content:"/chsps/"; startswith; fast_pattern; http.host; content:"www.eatskorea.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002007; classtype:social-engineering; sid:6002007; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (purobakery.com/wp-access.php)"; flow:established,to_server; http.uri; content:"/wp-access.php"; startswith; fast_pattern; http.host; content:"purobakery.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002008; classtype:social-engineering; sid:6002008; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kznlptx.vip/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kznlptx.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002009; classtype:social-engineering; sid:6002009; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (97ee5.catex.at/cnbcard/?b=YTo0OntzOjU6ImxhYmVsIjtzOjI6InB6IjtzOjM6InVzciI7aToxNjE2O3M6NDoibm9wZCI7czoxNToicnNzMi5yZWFkbGVzLmF0IjtzOjE6Im8iO2k6MjEzNTt9)"; flow:established,to_server; http.uri; content:"/cnbcard/?b=YTo0OntzOjU6ImxhYmVsIjtzOjI6InB6IjtzOjM6InVzciI7aToxNjE2O3M6NDoibm9wZCI7czoxNToicnNzMi5yZWFkbGVzLmF0IjtzOjE6Im8iO2k6MjEzNTt9"; startswith; fast_pattern; http.host; content:"97ee5.catex.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002010; classtype:social-engineering; sid:6002010; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.itupdatealert.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"login.itupdatealert.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002011; classtype:social-engineering; sid:6002011; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f240y.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f240y.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002012; classtype:social-engineering; sid:6002012; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glavtor-biz-tranvik-qolnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glavtor-biz-tranvik-qolnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002013; classtype:social-engineering; sid:6002013; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vcsz-18573.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vcsz-18573.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002014; classtype:social-engineering; sid:6002014; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (click.abitursprueche.de/ga/click/2-17328413-22-9261-18098-9967-509ff80723-af6f49103c)"; flow:established,to_server; http.uri; content:"/ga/click/2-17328413-22-9261-18098-9967-509ff80723-af6f49103c"; startswith; fast_pattern; http.host; content:"click.abitursprueche.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002015; classtype:social-engineering; sid:6002015; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-plurnex-biz-dranqor-glavnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-plurnex-biz-dranqor-glavnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002016; classtype:social-engineering; sid:6002016; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-glurnax-biz-qolvik-plarnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-glurnax-biz-qolvik-plarnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002017; classtype:social-engineering; sid:6002017; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-zeta-two.vercel.app/signIn.html/)"; flow:established,to_server; http.uri; content:"/signIn.html/"; startswith; fast_pattern; http.host; content:"netflix-clone-zeta-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002018; classtype:social-engineering; sid:6002018; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvxtmrq.xin/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bvxtmrq.xin"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002019; classtype:social-engineering; sid:6002019; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.amazonwebclone-alpha.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazonwebclone-alpha.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002020; classtype:social-engineering; sid:6002020; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yahwebonlinetime.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yahwebonlinetime.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002021; classtype:social-engineering; sid:6002021; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bahissiteleri46.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bahissiteleri46.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002022; classtype:social-engineering; sid:6002022; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-fruntex-biz-vraxnik-plaqtor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-fruntex-biz-vraxnik-plaqtor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002023; classtype:social-engineering; sid:6002023; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (y29g.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"y29g.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002024; classtype:social-engineering; sid:6002024; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vrolvik-biz-qortem-glurnax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vrolvik-biz-qortem-glurnax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002025; classtype:social-engineering; sid:6002025; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jessedigitalrfpdocs-dpgcy2fje2tm.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jessedigitalrfpdocs-dpgcy2fje2tm.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002026; classtype:social-engineering; sid:6002026; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jprlzwn.vip/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jprlzwn.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002027; classtype:social-engineering; sid:6002027; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kunal4137.github.io/Netflix_Clone/)"; flow:established,to_server; http.uri; content:"/Netflix_Clone/"; startswith; fast_pattern; http.host; content:"kunal4137.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002028; classtype:social-engineering; sid:6002028; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (popandc.be/wp-admin/js/cgi-ent/index--000.html)"; flow:established,to_server; http.uri; content:"/wp-admin/js/cgi-ent/index--000.html"; startswith; fast_pattern; http.host; content:"popandc.be"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002029; classtype:social-engineering; sid:6002029; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingeu.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingeu.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002030; classtype:social-engineering; sid:6002030; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-qravnor-biz-plaqtex-slavnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-qravnor-biz-plaqtex-slavnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002031; classtype:social-engineering; sid:6002031; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xinewsdna-formindo.revolusioner.web.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xinewsdna-formindo.revolusioner.web.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002032; classtype:social-engineering; sid:6002032; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (special-wincash2026.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"special-wincash2026.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002033; classtype:social-engineering; sid:6002033; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eng-xodus-wellat.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eng-xodus-wellat.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002034; classtype:social-engineering; sid:6002034; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (luna0-0.github.io/netflix-ui-clone)"; flow:established,to_server; http.uri; content:"/netflix-ui-clone"; startswith; fast_pattern; http.host; content:"luna0-0.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002035; classtype:social-engineering; sid:6002035; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-frurnik-biz-platem-dravnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-frurnik-biz-platem-dravnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002036; classtype:social-engineering; sid:6002036; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gls.axfvkd.cfd/SL)"; flow:established,to_server; http.uri; content:"/SL"; startswith; fast_pattern; http.host; content:"gls.axfvkd.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002037; classtype:social-engineering; sid:6002037; rev:1; metadata: signature_severity Major, created_et 2026_06_05, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lucky-exceptions-109626.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lucky-exceptions-109626.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002038; classtype:social-engineering; sid:6002038; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dskenvistacurelv.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dskenvistacurelv.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002039; classtype:social-engineering; sid:6002039; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-k25l.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-k25l.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002040; classtype:social-engineering; sid:6002040; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chorme-exodos-us.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"chorme-exodos-us.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002041; classtype:social-engineering; sid:6002041; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inspirational-pizza-522938.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"inspirational-pizza-522938.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002042; classtype:social-engineering; sid:6002042; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (knowingly-consistency-235981.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"knowingly-consistency-235981.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002043; classtype:social-engineering; sid:6002043; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (static-lettuce-467775.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"static-lettuce-467775.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002044; classtype:social-engineering; sid:6002044; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secured-suggestions-202987.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secured-suggestions-202987.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002045; classtype:social-engineering; sid:6002045; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dsksupportenvistacu.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dsksupportenvistacu.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002046; classtype:social-engineering; sid:6002046; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (88843534949.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"88843534949.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002047; classtype:social-engineering; sid:6002047; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (htttpsscsefcu.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"htttpsscsefcu.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002048; classtype:social-engineering; sid:6002048; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (affable-subtasks-609343.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"affable-subtasks-609343.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002049; classtype:social-engineering; sid:6002049; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (updatepass000555.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"updatepass000555.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002050; classtype:social-engineering; sid:6002050; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hh1565.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hh1565.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002051; classtype:social-engineering; sid:6002051; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dragon95.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dragon95.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002052; classtype:social-engineering; sid:6002052; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ahjykr.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.ahjykr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002053; classtype:social-engineering; sid:6002053; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-dranor-biz-fravik-slatem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-dranor-biz-fravik-slatem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002054; classtype:social-engineering; sid:6002054; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fraud-claims-esl.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fraud-claims-esl.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002055; classtype:social-engineering; sid:6002055; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee5849.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.shopee5849.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002056; classtype:social-engineering; sid:6002056; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (advhokc.cn/icloudss)"; flow:established,to_server; http.uri; content:"/icloudss"; startswith; fast_pattern; http.host; content:"advhokc.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002057; classtype:social-engineering; sid:6002057; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktifkaans-payllterdnax.dipsea.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktifkaans-payllterdnax.dipsea.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002058; classtype:social-engineering; sid:6002058; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home-renrensports.com/id-update)"; flow:established,to_server; http.uri; content:"/id-update"; startswith; fast_pattern; http.host; content:"home-renrensports.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002059; classtype:social-engineering; sid:6002059; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ekmithu.github.io/Netflix-Clone)"; flow:established,to_server; http.uri; content:"/Netflix-Clone"; startswith; fast_pattern; http.host; content:"ekmithu.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002060; classtype:social-engineering; sid:6002060; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-vrolnor-biz-slortik-framtex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-vrolnor-biz-slortik-framtex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002061; classtype:social-engineering; sid:6002061; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abril.ink/7ui36/)"; flow:established,to_server; http.uri; content:"/7ui36/"; startswith; fast_pattern; http.host; content:"abril.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002062; classtype:social-engineering; sid:6002062; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-drontek-biz-slurnik-fralnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-drontek-biz-slurnik-fralnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002063; classtype:social-engineering; sid:6002063; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-quenza-biz-fralko-timve.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-quenza-biz-fralko-timve.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002064; classtype:social-engineering; sid:6002064; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (muzammil4464.github.io/amazon-redesign-by-muzammil)"; flow:established,to_server; http.uri; content:"/amazon-redesign-by-muzammil"; startswith; fast_pattern; http.host; content:"muzammil4464.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002065; classtype:social-engineering; sid:6002065; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fre.to/Dana-lndonesiaa)"; flow:established,to_server; http.uri; content:"/Dana-lndonesiaa"; startswith; fast_pattern; http.host; content:"fre.to"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002066; classtype:social-engineering; sid:6002066; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail.au.bezpieczneudostepnianieplikow.pl/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"webmail.au.bezpieczneudostepnianieplikow.pl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002067; classtype:social-engineering; sid:6002067; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ptshopee990.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.ptshopee990.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002068; classtype:social-engineering; sid:6002068; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-drament-biz-qravlor-plarnix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-drament-biz-qravlor-plarnix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002069; classtype:social-engineering; sid:6002069; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (global-sohusports.com/id-update)"; flow:established,to_server; http.uri; content:"/id-update"; startswith; fast_pattern; http.host; content:"global-sohusports.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002070; classtype:social-engineering; sid:6002070; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail.photosnsfw.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"webmail.photosnsfw.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002071; classtype:social-engineering; sid:6002071; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail.au.newsalerts.com.sg/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"webmail.au.newsalerts.com.sg"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002072; classtype:social-engineering; sid:6002072; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.nissan66.ru/bitrix/open/made.in.china/membercenter.made-in-china.com/index.html)"; flow:established,to_server; http.uri; content:"/bitrix/open/made.in.china/membercenter.made-in-china.com/index.html"; startswith; fast_pattern; http.host; content:"www.nissan66.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002073; classtype:social-engineering; sid:6002073; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mostafijuranu-maker.github.io/Google-log-in/)"; flow:established,to_server; http.uri; content:"/Google-log-in/"; startswith; fast_pattern; http.host; content:"mostafijuranu-maker.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002074; classtype:social-engineering; sid:6002074; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ssl.secureinvestingonline.com/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"ssl.secureinvestingonline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002075; classtype:social-engineering; sid:6002075; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-travik-biz-fraltem-slurnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-travik-biz-fraltem-slurnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002076; classtype:social-engineering; sid:6002076; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-vralvor-biz-dravqor-plurnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-vralvor-biz-dravqor-plurnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002077; classtype:social-engineering; sid:6002077; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee5849.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopee5849.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002078; classtype:social-engineering; sid:6002078; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (saadshaikh27.github.io/Second-Repo)"; flow:established,to_server; http.uri; content:"/Second-Repo"; startswith; fast_pattern; http.host; content:"saadshaikh27.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002079; classtype:social-engineering; sid:6002079; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (owa.itineraryupdate.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"owa.itineraryupdate.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002080; classtype:social-engineering; sid:6002080; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.au.expressparcel.com.sg/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"mail.au.expressparcel.com.sg"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002081; classtype:social-engineering; sid:6002081; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-traltem-biz-fralnor-qurnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-traltem-biz-fralnor-qurnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002082; classtype:social-engineering; sid:6002082; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (binanceltd.ltd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"binanceltd.ltd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002083; classtype:social-engineering; sid:6002083; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (greetings.pictures/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"greetings.pictures"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002084; classtype:social-engineering; sid:6002084; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (y218a.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"y218a.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002085; classtype:social-engineering; sid:6002085; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dospablosca.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.dospablosca.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002086; classtype:social-engineering; sid:6002086; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-plovnix-biz-vroltek-drament.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-plovnix-biz-vroltek-drament.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002087; classtype:social-engineering; sid:6002087; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aibsolar.yourretrofit.ie/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aibsolar.yourretrofit.ie"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002088; classtype:social-engineering; sid:6002088; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ahv3ctpms4e.tokenvalidate.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"ahv3ctpms4e.tokenvalidate.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002089; classtype:social-engineering; sid:6002089; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17391.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17391.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002090; classtype:social-engineering; sid:6002090; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (links.votrentreprise.com/v/c43/VsmX93GoYDANtcAei5YdTa/09bd53a5/)"; flow:established,to_server; http.uri; content:"/v/c43/VsmX93GoYDANtcAei5YdTa/09bd53a5/"; startswith; fast_pattern; http.host; content:"links.votrentreprise.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002091; classtype:social-engineering; sid:6002091; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (server-index-page--eefostar.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"server-index-page--eefostar.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002092; classtype:social-engineering; sid:6002092; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (happ-c7entertainment.com/id-update)"; flow:established,to_server; http.uri; content:"/id-update"; startswith; fast_pattern; http.host; content:"happ-c7entertainment.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002093; classtype:social-engineering; sid:6002093; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.gal/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.gal"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002094; classtype:social-engineering; sid:6002094; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (opportunityboost2026.free.nf/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"opportunityboost2026.free.nf"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002095; classtype:social-engineering; sid:6002095; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santanderenlinea.github.io/prestamo.com/)"; flow:established,to_server; http.uri; content:"/prestamo.com/"; startswith; fast_pattern; http.host; content:"santanderenlinea.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002096; classtype:social-engineering; sid:6002096; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-landing-page-ui.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-landing-page-ui.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002097; classtype:social-engineering; sid:6002097; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (local-kaiyunplay.com/id-update)"; flow:established,to_server; http.uri; content:"/id-update"; startswith; fast_pattern; http.host; content:"local-kaiyunplay.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002098; classtype:social-engineering; sid:6002098; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brittanytheengineer369.github.io/javascript-amazon-project/tracking.html?orderId=123)"; flow:established,to_server; http.uri; content:"/javascript-amazon-project/tracking.html?orderId=123"; startswith; fast_pattern; http.host; content:"brittanytheengineer369.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002099; classtype:social-engineering; sid:6002099; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dbhlmp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dbhlmp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002100; classtype:social-engineering; sid:6002100; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vralnik-biz-qornex-drutek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vralnik-biz-qornex-drutek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002101; classtype:social-engineering; sid:6002101; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-travik-biz-dolsen-qarmu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-travik-biz-dolsen-qarmu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002102; classtype:social-engineering; sid:6002102; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinsqure-eng.zapier.app/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"coinsqure-eng.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002103; classtype:social-engineering; sid:6002103; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17335.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17335.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002104; classtype:social-engineering; sid:6002104; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gemini-balance.755176.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gemini-balance.755176.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002105; classtype:social-engineering; sid:6002105; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (salecreekmarina.com/kofthqin/)"; flow:established,to_server; http.uri; content:"/kofthqin/"; startswith; fast_pattern; http.host; content:"salecreekmarina.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002106; classtype:social-engineering; sid:6002106; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zxscfv.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.zxscfv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002107; classtype:social-engineering; sid:6002107; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (y218g.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"y218g.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002108; classtype:social-engineering; sid:6002108; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qurnax-biz-vrolnik-glortex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qurnax-biz-vrolnik-glortex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002109; classtype:social-engineering; sid:6002109; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.galabetresmigrisi.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.galabetresmigrisi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002110; classtype:social-engineering; sid:6002110; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (azure-celery-615100.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"azure-celery-615100.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002111; classtype:social-engineering; sid:6002111; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.sharefiles.email/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"login.sharefiles.email"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002112; classtype:social-engineering; sid:6002112; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (djksjvjds.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"djksjvjds.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002113; classtype:social-engineering; sid:6002113; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zhapp-douqiuzhibo.com/id-update)"; flow:established,to_server; http.uri; content:"/id-update"; startswith; fast_pattern; http.host; content:"zhapp-douqiuzhibo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002114; classtype:social-engineering; sid:6002114; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support.malwarequarantine.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"support.malwarequarantine.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002115; classtype:social-engineering; sid:6002115; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (au.enterpriserewards.com.sg/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"au.enterpriserewards.com.sg"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002116; classtype:social-engineering; sid:6002116; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.socialnetworkingcentral.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"login.socialnetworkingcentral.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002117; classtype:social-engineering; sid:6002117; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.umyeos.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.umyeos.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002118; classtype:social-engineering; sid:6002118; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dana.websiite-resmi.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dana.websiite-resmi.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002119; classtype:social-engineering; sid:6002119; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bbvaenlinea.github.io/santander.com)"; flow:established,to_server; http.uri; content:"/santander.com"; startswith; fast_pattern; http.host; content:"bbvaenlinea.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002120; classtype:social-engineering; sid:6002120; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (koiiccuiglogig.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"koiiccuiglogig.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002121; classtype:social-engineering; sid:6002121; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-fratox-biz-glarnik-plurnov.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-fratox-biz-glarnik-plurnov.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002122; classtype:social-engineering; sid:6002122; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (au.expressparcel.com.sg/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"au.expressparcel.com.sg"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002123; classtype:social-engineering; sid:6002123; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tlrfbj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tlrfbj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002124; classtype:social-engineering; sid:6002124; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-dravvor-biz-fraltex-glurnix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-dravvor-biz-fraltex-glurnix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002125; classtype:social-engineering; sid:6002125; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.itineraryupdate.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"mail.itineraryupdate.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002126; classtype:social-engineering; sid:6002126; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (default._bimi.073202.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"default._bimi.073202.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002127; classtype:social-engineering; sid:6002127; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (humanrisefoundation.org/t@xform/form/login.htm)"; flow:established,to_server; http.uri; content:"/t@xform/form/login.htm"; startswith; fast_pattern; http.host; content:"humanrisefoundation.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002128; classtype:social-engineering; sid:6002128; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17366.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17366.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002129; classtype:social-engineering; sid:6002129; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-frutem-biz-glanrix-slortex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-frutem-biz-glanrix-slortex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002130; classtype:social-engineering; sid:6002130; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maps-cloud.com/aU3VJ0FM/)"; flow:established,to_server; http.uri; content:"/aU3VJ0FM/"; startswith; fast_pattern; http.host; content:"maps-cloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002131; classtype:social-engineering; sid:6002131; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bobsrvsc.com/docusign/Mac/utility.php)"; flow:established,to_server; http.uri; content:"/docusign/Mac/utility.php"; startswith; fast_pattern; http.host; content:"bobsrvsc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002132; classtype:social-engineering; sid:6002132; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (greeninvestmentgroup.073202.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"greeninvestmentgroup.073202.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002133; classtype:social-engineering; sid:6002133; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee3336.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopee3336.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002134; classtype:social-engineering; sid:6002134; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee3336.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.shopee3336.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002135; classtype:social-engineering; sid:6002135; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (registerdomain.asia/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"registerdomain.asia"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002136; classtype:social-engineering; sid:6002136; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-frurnex-biz-slatem-qarnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-frurnex-biz-slatem-qarnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002137; classtype:social-engineering; sid:6002137; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (localsites.hrbonuses.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"localsites.hrbonuses.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002138; classtype:social-engineering; sid:6002138; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (livesocially.co/ftx/page.html)"; flow:established,to_server; http.uri; content:"/ftx/page.html"; startswith; fast_pattern; http.host; content:"livesocially.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002139; classtype:social-engineering; sid:6002139; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-glortor-biz-slurnik-fralnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-glortor-biz-slurnik-fralnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002140; classtype:social-engineering; sid:6002140; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vrantex-biz-slornik-glunor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vrantex-biz-slornik-glunor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002141; classtype:social-engineering; sid:6002141; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (delivery-globaldhlauth.github.io/samedaydelivery/)"; flow:established,to_server; http.uri; content:"/samedaydelivery/"; startswith; fast_pattern; http.host; content:"delivery-globaldhlauth.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002142; classtype:social-engineering; sid:6002142; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.asdsfr.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.asdsfr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002143; classtype:social-engineering; sid:6002143; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tksell.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tksell.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002144; classtype:social-engineering; sid:6002144; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17382.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17382.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002145; classtype:social-engineering; sid:6002145; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.galabet-songirisler.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.galabet-songirisler.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002146; classtype:social-engineering; sid:6002146; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi254.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"info-resmi254.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002147; classtype:social-engineering; sid:6002147; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (emailaccesspolicytermination.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"emailaccesspolicytermination.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002148; classtype:social-engineering; sid:6002148; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usps.postros.shop/update)"; flow:established,to_server; http.uri; content:"/update"; startswith; fast_pattern; http.host; content:"usps.postros.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002149; classtype:social-engineering; sid:6002149; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hth-mobile.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hth-mobile.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002150; classtype:social-engineering; sid:6002150; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uuu.binanceltd.ltd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uuu.binanceltd.ltd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002151; classtype:social-engineering; sid:6002151; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-slantek-biz-vortix-qralnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-slantek-biz-vortix-qralnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002152; classtype:social-engineering; sid:6002152; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gebyar-shopee20.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.gebyar-shopee20.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002153; classtype:social-engineering; sid:6002153; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (professional-blackberry-043549.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"professional-blackberry-043549.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002154; classtype:social-engineering; sid:6002154; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (naifei.win/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"naifei.win"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002155; classtype:social-engineering; sid:6002155; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uzmanbahis.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uzmanbahis.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002156; classtype:social-engineering; sid:6002156; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rijmhck.cn/icloudss/)"; flow:established,to_server; http.uri; content:"/icloudss/"; startswith; fast_pattern; http.host; content:"rijmhck.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002157; classtype:social-engineering; sid:6002157; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17336.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17336.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002158; classtype:social-engineering; sid:6002158; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (strumentimusicaliporri.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"strumentimusicaliporri.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002159; classtype:social-engineering; sid:6002159; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (postch-reprogrammation.help/pages/ban.php)"; flow:established,to_server; http.uri; content:"/pages/ban.php"; startswith; fast_pattern; http.host; content:"postch-reprogrammation.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002160; classtype:social-engineering; sid:6002160; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-tenqor-biz-vralik-mosdu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-tenqor-biz-vralik-mosdu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002161; classtype:social-engineering; sid:6002161; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (black-math-cbc3.dakriacreuielwtxea.workers.dev/meta.help)"; flow:established,to_server; http.uri; content:"/meta.help"; startswith; fast_pattern; http.host; content:"black-math-cbc3.dakriacreuielwtxea.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002162; classtype:social-engineering; sid:6002162; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vrolqix-biz-plarnex-glutor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vrolqix-biz-plarnex-glutor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002163; classtype:social-engineering; sid:6002163; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (make-lynx-807794.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"make-lynx-807794.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002164; classtype:social-engineering; sid:6002164; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (postailedger.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"postailedger.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002165; classtype:social-engineering; sid:6002165; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uzmanbahis2.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uzmanbahis2.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002166; classtype:social-engineering; sid:6002166; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.opportunityboost2026.free.nf/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.opportunityboost2026.free.nf"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002167; classtype:social-engineering; sid:6002167; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cnci--seguridad019.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cnci--seguridad019.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002168; classtype:social-engineering; sid:6002168; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kleinanzeigen-deutsch.srvc-de836589.info/getpaymentm/201631787/m9/)"; flow:established,to_server; http.uri; content:"/getpaymentm/201631787/m9/"; startswith; fast_pattern; http.host; content:"kleinanzeigen-deutsch.srvc-de836589.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002169; classtype:social-engineering; sid:6002169; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (landing.azeiteeoliva.info/41-1511-280526/?u=161C1515&e=p.ernst%2540bluewin.ch&s3=Peter&s4=Ernst&s5=&s6=8404&s7=&s8=)"; flow:established,to_server; http.uri; content:"/41-1511-280526/?u=161C1515&e=p.ernst%2540bluewin.ch&s3=Peter&s4=Ernst&s5=&s6=8404&s7=&s8="; startswith; fast_pattern; http.host; content:"landing.azeiteeoliva.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002170; classtype:social-engineering; sid:6002170; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.officemodels.gr/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.officemodels.gr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002171; classtype:social-engineering; sid:6002171; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.greetings.pictures/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"mail.greetings.pictures"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002172; classtype:social-engineering; sid:6002172; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vraltem-biz-plurnik-glarnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vraltem-biz-plurnik-glarnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002173; classtype:social-engineering; sid:6002173; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-trurnex-biz-vralnik-glotor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-trurnex-biz-vralnik-glotor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002174; classtype:social-engineering; sid:6002174; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-yaltek-biz-drumfa-korli.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-yaltek-biz-drumfa-korli.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002175; classtype:social-engineering; sid:6002175; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rbxliy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rbxliy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002176; classtype:social-engineering; sid:6002176; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ciqopd.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ciqopd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002177; classtype:social-engineering; sid:6002177; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (psc-whatsapps.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"psc-whatsapps.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002178; classtype:social-engineering; sid:6002178; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h5-zh-lols15.com/erhnxewq/)"; flow:established,to_server; http.uri; content:"/erhnxewq/"; startswith; fast_pattern; http.host; content:"h5-zh-lols15.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002179; classtype:social-engineering; sid:6002179; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ssl.creditunion-banking.org/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"ssl.creditunion-banking.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002180; classtype:social-engineering; sid:6002180; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.affthaimgf.net/user/login)"; flow:established,to_server; http.uri; content:"/user/login"; startswith; fast_pattern; http.host; content:"www.affthaimgf.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002181; classtype:social-engineering; sid:6002181; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-lirvak-biz-prosen-duxra.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-lirvak-biz-prosen-duxra.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002182; classtype:social-engineering; sid:6002182; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (omkar-dhamdhere.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"omkar-dhamdhere.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002183; classtype:social-engineering; sid:6002183; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeejkt737.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopeejkt737.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002184; classtype:social-engineering; sid:6002184; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vycbaqa.cn/icloudss)"; flow:established,to_server; http.uri; content:"/icloudss"; startswith; fast_pattern; http.host; content:"vycbaqa.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002185; classtype:social-engineering; sid:6002185; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qurnor-biz-vraltex-glanik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qurnor-biz-vraltex-glanik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002186; classtype:social-engineering; sid:6002186; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.officemodels.have-fun.gr/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.officemodels.have-fun.gr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002187; classtype:social-engineering; sid:6002187; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.spwindustrial.com/gigabyte-radeon-rx-6400-d6-low-profile-4g-hdmi-dp-video-card-gddr6-350w/)"; flow:established,to_server; http.uri; content:"/gigabyte-radeon-rx-6400-d6-low-profile-4g-hdmi-dp-video-card-gddr6-350w/"; startswith; fast_pattern; http.host; content:"www.spwindustrial.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002188; classtype:social-engineering; sid:6002188; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.b000555.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.b000555.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002189; classtype:social-engineering; sid:6002189; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-beryl-three.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-beryl-three.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002190; classtype:social-engineering; sid:6002190; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ptshopee990.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"ptshopee990.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002191; classtype:social-engineering; sid:6002191; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (daily-lynx-193002.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"daily-lynx-193002.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002192; classtype:social-engineering; sid:6002192; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (theflurry.info/41-1511-280526/?u=161C1515&e=fasel.arno%2540bluewin.ch&s3=Ursula&s4=Widmer&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/41-1511-280526/?u=161C1515&e=fasel.arno%2540bluewin.ch&s3=Ursula&s4=Widmer&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"theflurry.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002193; classtype:social-engineering; sid:6002193; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeejkt734.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopeejkt734.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002194; classtype:social-engineering; sid:6002194; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wedfew1.pages.dev/amz-books/discover?node=1)"; flow:established,to_server; http.uri; content:"/amz-books/discover?node=1"; startswith; fast_pattern; http.host; content:"wedfew1.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002195; classtype:social-engineering; sid:6002195; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (itupdatealert.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"itupdatealert.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002196; classtype:social-engineering; sid:6002196; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nab.439980.cc/au/rewards/)"; flow:established,to_server; http.uri; content:"/au/rewards/"; startswith; fast_pattern; http.host; content:"nab.439980.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002197; classtype:social-engineering; sid:6002197; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9268365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9268365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002198; classtype:social-engineering; sid:6002198; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-brenuk-biz-faltem-qurvo.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-brenuk-biz-faltem-qurvo.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002199; classtype:social-engineering; sid:6002199; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-cam.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-cam.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002200; classtype:social-engineering; sid:6002200; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeejkt734.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.shopeejkt734.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002201; classtype:social-engineering; sid:6002201; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (scriptmalware-alt.github.io/Dana_Special)"; flow:established,to_server; http.uri; content:"/Dana_Special"; startswith; fast_pattern; http.host; content:"scriptmalware-alt.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002202; classtype:social-engineering; sid:6002202; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glutek-biz-qarnor-slavnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glutek-biz-qarnor-slavnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002203; classtype:social-engineering; sid:6002203; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.galabet-resmi1.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.galabet-resmi1.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002204; classtype:social-engineering; sid:6002204; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-plurnik-biz-fravtor-glunex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-plurnik-biz-fravtor-glunex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002205; classtype:social-engineering; sid:6002205; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-gorven-biz-zamtri-felqo.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-gorven-biz-zamtri-felqo.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002206; classtype:social-engineering; sid:6002206; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.galabetgiris.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.galabetgiris.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002207; classtype:social-engineering; sid:6002207; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (datacompliancereview.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"datacompliancereview.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002208; classtype:social-engineering; sid:6002208; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (visual-polygon-325468.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"visual-polygon-325468.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002209; classtype:social-engineering; sid:6002209; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docs.creditunion-financial.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"docs.creditunion-financial.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002210; classtype:social-engineering; sid:6002210; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bdooc.cc/ph)"; flow:established,to_server; http.uri; content:"/ph"; startswith; fast_pattern; http.host; content:"bdooc.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002211; classtype:social-engineering; sid:6002211; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glavrix-biz-qarnex-vroltor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glavrix-biz-qarnex-vroltor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002212; classtype:social-engineering; sid:6002212; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (updateantivir.us/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"updateantivir.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002213; classtype:social-engineering; sid:6002213; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hadiahshopee286.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hadiahshopee286.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002214; classtype:social-engineering; sid:6002214; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cozy-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cozy-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002215; classtype:social-engineering; sid:6002215; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.giris-padisahbet-sabit.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.giris-padisahbet-sabit.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002216; classtype:social-engineering; sid:6002216; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maderistasouto.es/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"maderistasouto.es"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002217; classtype:social-engineering; sid:6002217; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-platem-biz-glurnor-vroltex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-platem-biz-glurnor-vroltex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002218; classtype:social-engineering; sid:6002218; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.irenechiang.com/interests)"; flow:established,to_server; http.uri; content:"/interests"; startswith; fast_pattern; http.host; content:"www.irenechiang.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002219; classtype:social-engineering; sid:6002219; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7t83kwq8goz9zkbc.23.32.qjgarden.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7t83kwq8goz9zkbc.23.32.qjgarden.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002220; classtype:social-engineering; sid:6002220; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17338.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17338.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002221; classtype:social-engineering; sid:6002221; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zh-paly-okooo.com/kofthqin/)"; flow:established,to_server; http.uri; content:"/kofthqin/"; startswith; fast_pattern; http.host; content:"zh-paly-okooo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002222; classtype:social-engineering; sid:6002222; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.phwamj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.phwamj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002223; classtype:social-engineering; sid:6002223; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pzszpng.cn/icloudss)"; flow:established,to_server; http.uri; content:"/icloudss"; startswith; fast_pattern; http.host; content:"pzszpng.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002224; classtype:social-engineering; sid:6002224; rev:1; metadata: signature_severity Major, created_et 2026_06_06, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (services-publics.grupozasacr.com/infospage.php)"; flow:established,to_server; http.uri; content:"/infospage.php"; startswith; fast_pattern; http.host; content:"services-publics.grupozasacr.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002225; classtype:social-engineering; sid:6002225; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ptshopee3677.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.ptshopee3677.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002226; classtype:social-engineering; sid:6002226; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gebyar-shope-2022.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gebyar-shope-2022.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002227; classtype:social-engineering; sid:6002227; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (owa.donationsnonprofit.com/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"owa.donationsnonprofit.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002228; classtype:social-engineering; sid:6002228; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qortem-biz-fralnix-vrolax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qortem-biz-fralnix-vrolax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002229; classtype:social-engineering; sid:6002229; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-druntex-biz-fralnix-plamvor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-druntex-biz-fralnix-plamvor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002230; classtype:social-engineering; sid:6002230; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.intzow.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.intzow.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002231; classtype:social-engineering; sid:6002231; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (techponds.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"techponds.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002232; classtype:social-engineering; sid:6002232; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coopmerlosl.com.ar/alexiscoulston/centerbase.html)"; flow:established,to_server; http.uri; content:"/alexiscoulston/centerbase.html"; startswith; fast_pattern; http.host; content:"coopmerlosl.com.ar"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002233; classtype:social-engineering; sid:6002233; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inxex-id.dgtlx.biz.id/xxdana/int.html)"; flow:established,to_server; http.uri; content:"/xxdana/int.html"; startswith; fast_pattern; http.host; content:"inxex-id.dgtlx.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002234; classtype:social-engineering; sid:6002234; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-drunvor-biz-qoltex-glarnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-drunvor-biz-qoltex-glarnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002235; classtype:social-engineering; sid:6002235; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.14152.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.14152.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002236; classtype:social-engineering; sid:6002236; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-slortik-biz-qravnex-glamvor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-slortik-biz-qravnex-glamvor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002237; classtype:social-engineering; sid:6002237; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qarnul-biz-vraxem-plortik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qarnul-biz-vraxem-plortik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002238; classtype:social-engineering; sid:6002238; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kleinanzeigen-deutsch.de-supservc.info/getpaymentm/247851809/m)"; flow:established,to_server; http.uri; content:"/getpaymentm/247851809/m"; startswith; fast_pattern; http.host; content:"kleinanzeigen-deutsch.de-supservc.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002239; classtype:social-engineering; sid:6002239; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-fralnex-biz-glurnor-platik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-fralnex-biz-glurnor-platik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002240; classtype:social-engineering; sid:6002240; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-plarnov-biz-glunex-vratem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-plarnov-biz-glunex-vratem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002241; classtype:social-engineering; sid:6002241; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.360967365756.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.360967365756.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002242; classtype:social-engineering; sid:6002242; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glurnax-biz-vroltek-pranix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glurnax-biz-vroltek-pranix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002243; classtype:social-engineering; sid:6002243; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glarnik-biz-slurnor-qurnax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glarnik-biz-slurnor-qurnax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002244; classtype:social-engineering; sid:6002244; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (able-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"able-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002245; classtype:social-engineering; sid:6002245; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fb-clone-new.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fb-clone-new.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002246; classtype:social-engineering; sid:6002246; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-drurnor-biz-framnik-plaqtex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-drurnor-biz-framnik-plaqtex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002247; classtype:social-engineering; sid:6002247; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-tronex-biz-vrolvik-plarnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-tronex-biz-vrolvik-plarnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002248; classtype:social-engineering; sid:6002248; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tanmoypanda2007-prog.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"tanmoypanda2007-prog.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002249; classtype:social-engineering; sid:6002249; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hivox.pk/wp-content/plugins/log/index/app/index.html)"; flow:established,to_server; http.uri; content:"/wp-content/plugins/log/index/app/index.html"; startswith; fast_pattern; http.host; content:"hivox.pk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002250; classtype:social-engineering; sid:6002250; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-glarnor-biz-framtex-slurnax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-glarnor-biz-framtex-slurnax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002251; classtype:social-engineering; sid:6002251; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-glortik-biz-slarnex-dravvor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-glortik-biz-slarnex-dravvor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002252; classtype:social-engineering; sid:6002252; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-slurnik-biz-fralvor-plarnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-slurnik-biz-fralvor-plarnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002253; classtype:social-engineering; sid:6002253; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cc512031.tw1.ru/info000departemen/)"; flow:established,to_server; http.uri; content:"/info000departemen/"; startswith; fast_pattern; http.host; content:"cc512031.tw1.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002254; classtype:social-engineering; sid:6002254; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-vraxtek-biz-qravnix-glarnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-vraxtek-biz-qravnix-glarnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002255; classtype:social-engineering; sid:6002255; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-vrolvor-biz-fralnik-glarnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-vrolvor-biz-fralnik-glarnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002256; classtype:social-engineering; sid:6002256; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glarnor-biz-qurnex-vroltex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glarnor-biz-qurnex-vroltex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002257; classtype:social-engineering; sid:6002257; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bigcvoucher.corporatereward.net/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"bigcvoucher.corporatereward.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002258; classtype:social-engineering; sid:6002258; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-glurnor-biz-fraltek-plaqnix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-glurnor-biz-fraltek-plaqnix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002259; classtype:social-engineering; sid:6002259; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecstacy231104.github.io/NETFLIX-UI-CLONE)"; flow:established,to_server; http.uri; content:"/NETFLIX-UI-CLONE"; startswith; fast_pattern; http.host; content:"ecstacy231104.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002260; classtype:social-engineering; sid:6002260; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xmlf-ag9n-th11.mgeorgatos-netw1-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xmlf-ag9n-th11.mgeorgatos-netw1-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002261; classtype:social-engineering; sid:6002261; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail.premisp.net/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"webmail.premisp.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002262; classtype:social-engineering; sid:6002262; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spongebob30k.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"spongebob30k.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002263; classtype:social-engineering; sid:6002263; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365bet199.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365bet199.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002264; classtype:social-engineering; sid:6002264; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-naxver-biz-turqen-dosmi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-naxver-biz-turqen-dosmi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002265; classtype:social-engineering; sid:6002265; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h224-v0en-q6qs.scott-treasuredropz-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"h224-v0en-q6qs.scott-treasuredropz-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002266; classtype:social-engineering; sid:6002266; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hizli-erisim-meritbet.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hizli-erisim-meritbet.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002267; classtype:social-engineering; sid:6002267; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.pmeimg8.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"mail.pmeimg8.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002268; classtype:social-engineering; sid:6002268; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-slarnor-biz-qolnix-tramtek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-slarnor-biz-qolnix-tramtek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002269; classtype:social-engineering; sid:6002269; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (finance1.expensenotifications.com/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/secure/training/6422c2/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"finance1.expensenotifications.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002270; classtype:social-engineering; sid:6002270; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p28z.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p28z.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002271; classtype:social-engineering; sid:6002271; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cool-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cool-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002272; classtype:social-engineering; sid:6002272; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee-tbk489.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee-tbk489.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002273; classtype:social-engineering; sid:6002273; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.e-serviceparts.info/landingpage/a92eca60-2cb8-444d-9623-dfa436879834/cygk1vk6hdnc_hdqkp4oz9wy-rwmw2t-8xdcs_5k-m)"; flow:established,to_server; http.uri; content:"/landingpage/a92eca60-2cb8-444d-9623-dfa436879834/cygk1vk6hdnc_hdqkp4oz9wy-rwmw2t-8xdcs_5k-m"; startswith; fast_pattern; http.host; content:"www.e-serviceparts.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002274; classtype:social-engineering; sid:6002274; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail.367450.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"webmail.367450.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002275; classtype:social-engineering; sid:6002275; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-qolnex-biz-glortik-vramtex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-qolnex-biz-glortik-vramtex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002276; classtype:social-engineering; sid:6002276; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abhishek-codelab.github.io/Amazon-Homepage-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Homepage-Clone/"; startswith; fast_pattern; http.host; content:"abhishek-codelab.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002277; classtype:social-engineering; sid:6002277; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-platik-biz-qurnex-glarnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-platik-biz-qurnex-glarnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002278; classtype:social-engineering; sid:6002278; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail.allaccesspass.xyz/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"webmail.allaccesspass.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002279; classtype:social-engineering; sid:6002279; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17205.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17205.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002280; classtype:social-engineering; sid:6002280; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-drantem-biz-glurnik-fralnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-drantem-biz-glurnik-fralnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002281; classtype:social-engineering; sid:6002281; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qoltem-biz-plurnex-fravik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qoltem-biz-plurnex-fravik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002282; classtype:social-engineering; sid:6002282; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-tralvik-biz-frunex-qormax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-tralvik-biz-frunex-qormax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002283; classtype:social-engineering; sid:6002283; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-drunvax-biz-slortek-qravlor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-drunvax-biz-slortek-qravlor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002284; classtype:social-engineering; sid:6002284; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lejj-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lejj-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002285; classtype:social-engineering; sid:6002285; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee-tbk489.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee-tbk489.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002286; classtype:social-engineering; sid:6002286; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t70f.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"t70f.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002287; classtype:social-engineering; sid:6002287; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-dravor-biz-qurnik-fralnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-dravor-biz-qurnik-fralnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002288; classtype:social-engineering; sid:6002288; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bet6612.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bet6612.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002289; classtype:social-engineering; sid:6002289; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezzore-suiite-en.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezzore-suiite-en.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002290; classtype:social-engineering; sid:6002290; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glurnik-biz-qortem-vrolax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glurnik-biz-qortem-vrolax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002291; classtype:social-engineering; sid:6002291; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (serviziome1ntar.justns.ru/de/)"; flow:established,to_server; http.uri; content:"/de/"; startswith; fast_pattern; http.host; content:"serviziome1ntar.justns.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002292; classtype:social-engineering; sid:6002292; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-qravtor-biz-plaqnik-glurnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-qravtor-biz-plaqnik-glurnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002293; classtype:social-engineering; sid:6002293; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-plaqvor-biz-glarnik-fraltex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-plaqvor-biz-glarnik-fraltex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002294; classtype:social-engineering; sid:6002294; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wilsongroup.in/Docusign/Mac/utility.php)"; flow:established,to_server; http.uri; content:"/Docusign/Mac/utility.php"; startswith; fast_pattern; http.host; content:"wilsongroup.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002295; classtype:social-engineering; sid:6002295; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (879myproductcidsbbpass.wasmer.app/login.php)"; flow:established,to_server; http.uri; content:"/login.php"; startswith; fast_pattern; http.host; content:"879myproductcidsbbpass.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002296; classtype:social-engineering; sid:6002296; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-plaqnix-biz-dranvor-vroltek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-plaqnix-biz-dranvor-vroltek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002297; classtype:social-engineering; sid:6002297; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qurnex-biz-fralnor-platem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qurnex-biz-fralnor-platem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002298; classtype:social-engineering; sid:6002298; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (join-eligible-ede8.oppome7272.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"join-eligible-ede8.oppome7272.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002299; classtype:social-engineering; sid:6002299; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dynamic-panda-bb5b17.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dynamic-panda-bb5b17.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002300; classtype:social-engineering; sid:6002300; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-fruntor-biz-slarnik-dravnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-fruntor-biz-slarnik-dravnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002301; classtype:social-engineering; sid:6002301; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (logs.netaccess-management.net/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"logs.netaccess-management.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002302; classtype:social-engineering; sid:6002302; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.skillplatformworking.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.skillplatformworking.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002303; classtype:social-engineering; sid:6002303; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-qravvik-biz-vroltor-plaqnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-qravvik-biz-vroltor-plaqnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002304; classtype:social-engineering; sid:6002304; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x21v.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"x21v.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002305; classtype:social-engineering; sid:6002305; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (finance-binance.org.hedgefunds-investment.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"finance-binance.org.hedgefunds-investment.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002306; classtype:social-engineering; sid:6002306; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.14267.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.14267.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002307; classtype:social-engineering; sid:6002307; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hsbc-batalkan.transaksi.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hsbc-batalkan.transaksi.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002308; classtype:social-engineering; sid:6002308; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail.careerpostings.org/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"webmail.careerpostings.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002309; classtype:social-engineering; sid:6002309; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (snifferip.com/25vd4.png)"; flow:established,to_server; http.uri; content:"/25vd4.png"; startswith; fast_pattern; http.host; content:"snifferip.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002310; classtype:social-engineering; sid:6002310; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-drantex-biz-slurnik-fravor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-drantex-biz-slurnik-fravor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002311; classtype:social-engineering; sid:6002311; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ayushhanand07.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"ayushhanand07.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002312; classtype:social-engineering; sid:6002312; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloud.com.hr/Vbj/lzIR)"; flow:established,to_server; http.uri; content:"/Vbj/lzIR"; startswith; fast_pattern; http.host; content:"icloud.com.hr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002313; classtype:social-engineering; sid:6002313; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (claims-fraud-esl-org.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"claims-fraud-esl-org.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002314; classtype:social-engineering; sid:6002314; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17211.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17211.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002315; classtype:social-engineering; sid:6002315; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-plurnor-biz-vraltem-glurnax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-plurnor-biz-vraltem-glurnax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002316; classtype:social-engineering; sid:6002316; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zctkrs.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zctkrs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002317; classtype:social-engineering; sid:6002317; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crafty-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"crafty-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002318; classtype:social-engineering; sid:6002318; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-virid-two-23.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-virid-two-23.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002319; classtype:social-engineering; sid:6002319; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail.sendpicz.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"webmail.sendpicz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002320; classtype:social-engineering; sid:6002320; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-glortor-biz-qravtek-slarnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-glortor-biz-qravtek-slarnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002321; classtype:social-engineering; sid:6002321; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appleoficial.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"appleoficial.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002322; classtype:social-engineering; sid:6002322; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-tramnex-biz-vraqtor-slarnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-tramnex-biz-vraqtor-slarnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002323; classtype:social-engineering; sid:6002323; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-frurnax-biz-vrolnik-platem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-frurnax-biz-vrolnik-platem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002324; classtype:social-engineering; sid:6002324; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-undianresmishopee.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info-undianresmishopee.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002325; classtype:social-engineering; sid:6002325; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (capable-article-728685.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"capable-article-728685.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002326; classtype:social-engineering; sid:6002326; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-veltro-biz-ganfur-zimka.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-veltro-biz-ganfur-zimka.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002327; classtype:social-engineering; sid:6002327; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whitepanda.info/48-1466-160526/?u=83C1466&e=igor_1979%40o2.pl&)"; flow:established,to_server; http.uri; content:"/48-1466-160526/?u=83C1466&e=igor_1979%40o2.pl&"; startswith; fast_pattern; http.host; content:"whitepanda.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002328; classtype:social-engineering; sid:6002328; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-fralvor-biz-vrolnax-qravtor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-fralvor-biz-vrolnax-qravtor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002329; classtype:social-engineering; sid:6002329; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-fruntax-biz-glortik-slarnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-fruntax-biz-glortik-slarnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002330; classtype:social-engineering; sid:6002330; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vroltor-biz-slatem-qurnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vroltor-biz-slatem-qurnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002331; classtype:social-engineering; sid:6002331; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login-facebook-facebook.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login-facebook-facebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002332; classtype:social-engineering; sid:6002332; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17209.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17209.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002333; classtype:social-engineering; sid:6002333; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faecbook.vn/timbannaygapngay05062026?a)"; flow:established,to_server; http.uri; content:"/timbannaygapngay05062026?a"; startswith; fast_pattern; http.host; content:"faecbook.vn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002334; classtype:social-engineering; sid:6002334; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (piosadn.info/PL-1466-160526/?u=97C1466&e=paulus71%40wp.pl&s3=P)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?u=97C1466&e=paulus71%40wp.pl&s3=P"; startswith; fast_pattern; http.host; content:"piosadn.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002335; classtype:social-engineering; sid:6002335; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hadiahresmishopee2022.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hadiahresmishopee2022.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002336; classtype:social-engineering; sid:6002336; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-tralnik-biz-qravlor-framtex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-tralnik-biz-qravlor-framtex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002337; classtype:social-engineering; sid:6002337; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p27t.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p27t.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002338; classtype:social-engineering; sid:6002338; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (afilianbismillah-coder.github.io/Pusat-bantuan-dana-resmi/)"; flow:established,to_server; http.uri; content:"/Pusat-bantuan-dana-resmi/"; startswith; fast_pattern; http.host; content:"afilianbismillah-coder.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002339; classtype:social-engineering; sid:6002339; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17206.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17206.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002340; classtype:social-engineering; sid:6002340; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-plavrix-biz-glarnek-vortam.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-plavrix-biz-glarnek-vortam.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002341; classtype:social-engineering; sid:6002341; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-dravor-biz-vroltex-fratem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-dravor-biz-vroltex-fratem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002342; classtype:social-engineering; sid:6002342; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-dravik-biz-qoltem-frurnax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-dravik-biz-qoltem-frurnax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002343; classtype:social-engineering; sid:6002343; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.pl-oferta47377753.sbs/oferta/Garmin-Fenix-7X-Pro-Sapphire-Solar?id=4z8V8V5I9m6u9y7K1O8j9p0v4B0M5V9F)"; flow:established,to_server; http.uri; content:"/oferta/Garmin-Fenix-7X-Pro-Sapphire-Solar?id=4z8V8V5I9m6u9y7K1O8j9p0v4B0M5V9F"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-oferta47377753.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002344; classtype:social-engineering; sid:6002344; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-qarnik-biz-glortex-vraltor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-qarnik-biz-glortex-vraltor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002345; classtype:social-engineering; sid:6002345; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sudo-thanos.github.io/Learnable22-Netflix_Clone/)"; flow:established,to_server; http.uri; content:"/Learnable22-Netflix_Clone/"; startswith; fast_pattern; http.host; content:"sudo-thanos.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002346; classtype:social-engineering; sid:6002346; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (okx-24c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"okx-24c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002347; classtype:social-engineering; sid:6002347; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vrolnex-biz-plurnik-glarnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vrolnex-biz-plurnik-glarnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002348; classtype:social-engineering; sid:6002348; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-drurnik-biz-fralor-slurnex-3m9.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-drurnik-biz-fralor-slurnex-3m9.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002349; classtype:social-engineering; sid:6002349; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17210.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17210.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002350; classtype:social-engineering; sid:6002350; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-travnik-biz-drantex-frultor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-travnik-biz-drantex-frultor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002351; classtype:social-engineering; sid:6002351; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vroltex-biz-slurnor-glatem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vroltex-biz-slurnor-glatem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002352; classtype:social-engineering; sid:6002352; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.finance-binance.org.hedgefunds-investment.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.finance-binance.org.hedgefunds-investment.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002353; classtype:social-engineering; sid:6002353; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-dorvik-biz-lamzen-prusko.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-dorvik-biz-lamzen-prusko.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002354; classtype:social-engineering; sid:6002354; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-slornor-biz-vraxnix-glavtek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-slornor-biz-vraxnix-glavtek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002355; classtype:social-engineering; sid:6002355; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-holvik-biz-crensa-vupra.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-holvik-biz-crensa-vupra.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002356; classtype:social-engineering; sid:6002356; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-travqor-biz-vrolnik-slarnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-travqor-biz-vrolnik-slarnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002357; classtype:social-engineering; sid:6002357; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-prexon-biz-talvex-nurki.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-prexon-biz-talvex-nurki.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002358; classtype:social-engineering; sid:6002358; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-dravtek-biz-glanvor-xurnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-dravtek-biz-glanvor-xurnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002359; classtype:social-engineering; sid:6002359; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (caring-kangaroo-307519.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"caring-kangaroo-307519.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002360; classtype:social-engineering; sid:6002360; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pemenangshopee-97.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pemenangshopee-97.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002361; classtype:social-engineering; sid:6002361; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365bet277.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365bet277.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002362; classtype:social-engineering; sid:6002362; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.wakacje-2026-14302.click/oferta/Steam-deck-oled-1tb?id=0v3b5I1R3p6W1p2B4k1l0k3n2X2n1o1Q)"; flow:established,to_server; http.uri; content:"/oferta/Steam-deck-oled-1tb?id=0v3b5I1R3p6W1p2B4k1l0k3n2X2n1o1Q"; startswith; fast_pattern; http.host; content:"allegrolokalnie.wakacje-2026-14302.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002363; classtype:social-engineering; sid:6002363; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-dravix-biz-kolten-yurfa.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-dravix-biz-kolten-yurfa.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002364; classtype:social-engineering; sid:6002364; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glurnor-biz-vrolax-slatem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glurnor-biz-vrolax-slatem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002365; classtype:social-engineering; sid:6002365; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17298.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17298.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002366; classtype:social-engineering; sid:6002366; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (central-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"central-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002367; classtype:social-engineering; sid:6002367; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-norvek-biz-jalmin-crofa.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-norvek-biz-jalmin-crofa.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002368; classtype:social-engineering; sid:6002368; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-braltex-biz-vorqan-glunor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-braltex-biz-vorqan-glunor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002369; classtype:social-engineering; sid:6002369; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-jorvek-biz-luntra-pexdi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-jorvek-biz-luntra-pexdi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002370; classtype:social-engineering; sid:6002370; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.applm.org.mx/KEAssociates/CharleneFleming.html)"; flow:established,to_server; http.uri; content:"/KEAssociates/CharleneFleming.html"; startswith; fast_pattern; http.host; content:"www.applm.org.mx"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002371; classtype:social-engineering; sid:6002371; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-fravik-biz-qoltem-vrolnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-fravik-biz-qoltem-vrolnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002372; classtype:social-engineering; sid:6002372; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.program-resmi115.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.program-resmi115.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002373; classtype:social-engineering; sid:6002373; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (veiw-desktop.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"veiw-desktop.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002374; classtype:social-engineering; sid:6002374; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.getrewardslogin.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.getrewardslogin.online"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002375; classtype:social-engineering; sid:6002375; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mereche.hub5723511.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mereche.hub5723511.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002376; classtype:social-engineering; sid:6002376; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.rezerwacja7692.sbs/oferta/nowa-elektryczna-hulajnoga-kukirin-g2-master-2025--stacyjka--gwarancja/702497734)"; flow:established,to_server; http.uri; content:"/oferta/nowa-elektryczna-hulajnoga-kukirin-g2-master-2025--stacyjka--gwarancja/702497734"; startswith; fast_pattern; http.host; content:"allegrolokalnie.rezerwacja7692.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002377; classtype:social-engineering; sid:6002377; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (getrewardslogin.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"getrewardslogin.online"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002378; classtype:social-engineering; sid:6002378; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.12312989834h340.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.12312989834h340.xyz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002379; classtype:social-engineering; sid:6002379; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amaz.hub5723511.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amaz.hub5723511.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002380; classtype:social-engineering; sid:6002380; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (putard.ext843252.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"putard.ext843252.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002381; classtype:social-engineering; sid:6002381; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eitababado.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eitababado.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002382; classtype:social-engineering; sid:6002382; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cloud.ext843252.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cloud.ext843252.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002383; classtype:social-engineering; sid:6002383; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sg-activation.bolt.host/~/index.html)"; flow:established,to_server; http.uri; content:"/~/index.html"; startswith; fast_pattern; http.host; content:"sg-activation.bolt.host"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002384; classtype:social-engineering; sid:6002384; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreictvr4yo2a5r3y4i6dsfyg5b5qvfmxztsykx2xcwgfw5ikb6zvdau.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreictvr4yo2a5r3y4i6dsfyg5b5qvfmxztsykx2xcwgfw5ikb6zvdau.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002385; classtype:social-engineering; sid:6002385; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (king-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"king-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002386; classtype:social-engineering; sid:6002386; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (volmyactive.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"volmyactive.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002387; classtype:social-engineering; sid:6002387; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sundancecabinetdesign.com/wp/docusign/me/Windows/utility.php/download/download/index.php)"; flow:established,to_server; http.uri; content:"/wp/docusign/me/Windows/utility.php/download/download/index.php"; startswith; fast_pattern; http.host; content:"sundancecabinetdesign.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002388; classtype:social-engineering; sid:6002388; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortnitezone.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortnitezone.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002389; classtype:social-engineering; sid:6002389; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vranex-biz-plurnik-slatem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vranex-biz-plurnik-slatem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002390; classtype:social-engineering; sid:6002390; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sarsdar.assuredwebtest.info/ga/click/2-6627976-9-9824-19244-10568-0e851c108c-638966a0fb)"; flow:established,to_server; http.uri; content:"/ga/click/2-6627976-9-9824-19244-10568-0e851c108c-638966a0fb"; startswith; fast_pattern; http.host; content:"sarsdar.assuredwebtest.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002391; classtype:social-engineering; sid:6002391; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-drunor-biz-slarnex-fratik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-drunor-biz-slarnex-fratik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002392; classtype:social-engineering; sid:6002392; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (riben16.github.io/sayana/)"; flow:established,to_server; http.uri; content:"/sayana/"; startswith; fast_pattern; http.host; content:"riben16.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002393; classtype:social-engineering; sid:6002393; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blackwater.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"blackwater.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002394; classtype:social-engineering; sid:6002394; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.trustbastion.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.trustbastion.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002395; classtype:social-engineering; sid:6002395; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deeply.kileycsz.info/ga/click/2-6797747-9-9907-19357-10719-a0bdb08903-0a55634c5b)"; flow:established,to_server; http.uri; content:"/ga/click/2-6797747-9-9907-19357-10719-a0bdb08903-0a55634c5b"; startswith; fast_pattern; http.host; content:"deeply.kileycsz.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002396; classtype:social-engineering; sid:6002396; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-qarnex-biz-slortor-glavnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-qarnex-biz-slortor-glavnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002397; classtype:social-engineering; sid:6002397; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-tralnix-biz-vroltex-glarnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-tralnix-biz-vroltex-glarnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002398; classtype:social-engineering; sid:6002398; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vsilex.com/docusign/Windows/utility.php/download/download/index.php)"; flow:established,to_server; http.uri; content:"/docusign/Windows/utility.php/download/download/index.php"; startswith; fast_pattern; http.host; content:"vsilex.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002399; classtype:social-engineering; sid:6002399; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17105.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17105.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002400; classtype:social-engineering; sid:6002400; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-plurnik-biz-frurnax-qurnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-plurnik-biz-frurnax-qurnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002401; classtype:social-engineering; sid:6002401; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-plaqtor-biz-fralvik-qravnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-plaqtor-biz-fralvik-qravnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002402; classtype:social-engineering; sid:6002402; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (789greeting.com/2513501.doc/18a80a/fad0f483-81b2-45c6-ad47-7272058d9cb6/)"; flow:established,to_server; http.uri; content:"/2513501.doc/18a80a/fad0f483-81b2-45c6-ad47-7272058d9cb6/"; startswith; fast_pattern; http.host; content:"789greeting.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002403; classtype:social-engineering; sid:6002403; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danaa-iindonesiaa.olgk.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danaa-iindonesiaa.olgk.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002404; classtype:social-engineering; sid:6002404; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.securefilestorage.net/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"login.securefilestorage.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002405; classtype:social-engineering; sid:6002405; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bdovipqi.com/ph/personal/)"; flow:established,to_server; http.uri; content:"/ph/personal/"; startswith; fast_pattern; http.host; content:"bdovipqi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002406; classtype:social-engineering; sid:6002406; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-slornik-biz-platem-frurnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-slornik-biz-platem-frurnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002407; classtype:social-engineering; sid:6002407; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreibhsdme4xafylyd264qskjwlrmuabh4egs3kyznjgaitzniuwwytm.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreibhsdme4xafylyd264qskjwlrmuabh4egs3kyznjgaitzniuwwytm.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002408; classtype:social-engineering; sid:6002408; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17117.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17117.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002409; classtype:social-engineering; sid:6002409; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (daodapps.netlify.app/wallets/)"; flow:established,to_server; http.uri; content:"/wallets/"; startswith; fast_pattern; http.host; content:"daodapps.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002410; classtype:social-engineering; sid:6002410; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (infoshopee2022.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"infoshopee2022.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002411; classtype:social-engineering; sid:6002411; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-frenzo-biz-kelmar-vudri.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-frenzo-biz-kelmar-vudri.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002412; classtype:social-engineering; sid:6002412; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roh-it05.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"roh-it05.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002413; classtype:social-engineering; sid:6002413; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-fraltem-biz-platik-slurnax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-fraltem-biz-platik-slurnax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002414; classtype:social-engineering; sid:6002414; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (876sytemverapcostchid.wasmer.app/login.php)"; flow:established,to_server; http.uri; content:"/login.php"; startswith; fast_pattern; http.host; content:"876sytemverapcostchid.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002415; classtype:social-engineering; sid:6002415; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.klzjsx.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.klzjsx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002416; classtype:social-engineering; sid:6002416; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-fralnex-biz-dravqor-vraxtik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-fralnex-biz-dravqor-vraxtik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002417; classtype:social-engineering; sid:6002417; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hvcurrent.info/PL-1466-160526/?u=97C1466&e=vicente%40ontinet.com&s3=&s4=&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?u=97C1466&e=vicente%40ontinet.com&s3=&s4=&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"hvcurrent.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002418; classtype:social-engineering; sid:6002418; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vrolnor-biz-slatik-glurnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vrolnor-biz-slatik-glurnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002419; classtype:social-engineering; sid:6002419; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-framtor-biz-vrolnix-dravtek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-framtor-biz-vrolnix-dravtek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002420; classtype:social-engineering; sid:6002420; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portal-coinsquar-com.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portal-coinsquar-com.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002421; classtype:social-engineering; sid:6002421; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezorsuites-io.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezorsuites-io.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002422; classtype:social-engineering; sid:6002422; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17110.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17110.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002423; classtype:social-engineering; sid:6002423; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hadiahshopeebigsale12.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hadiahshopeebigsale12.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002424; classtype:social-engineering; sid:6002424; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glurnex-biz-vrolor-fraltem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glurnex-biz-vrolor-fraltem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002425; classtype:social-engineering; sid:6002425; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (office365elementos.fwh.is/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"office365elementos.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002426; classtype:social-engineering; sid:6002426; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kynticsha.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kynticsha.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002427; classtype:social-engineering; sid:6002427; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-slavtor-biz-glarnex-plurnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-slavtor-biz-glarnex-plurnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002428; classtype:social-engineering; sid:6002428; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.365bet277.com/eng/home/index)"; flow:established,to_server; http.uri; content:"/eng/home/index"; startswith; fast_pattern; http.host; content:"m.365bet277.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002429; classtype:social-engineering; sid:6002429; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.netaccess-management.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"mail.netaccess-management.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002430; classtype:social-engineering; sid:6002430; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (26l5-mgd0-4s1q.tri-le-mtek-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"26l5-mgd0-4s1q.tri-le-mtek-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002431; classtype:social-engineering; sid:6002431; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.phanpay.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app.phanpay.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002432; classtype:social-engineering; sid:6002432; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fraud-claims-esl.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fraud-claims-esl.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002433; classtype:social-engineering; sid:6002433; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (teste.atualizacao-empresas.com/inicio)"; flow:established,to_server; http.uri; content:"/inicio"; startswith; fast_pattern; http.host; content:"teste.atualizacao-empresas.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002434; classtype:social-engineering; sid:6002434; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vorlan-biz-plortem-qurnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vorlan-biz-plortem-qurnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002435; classtype:social-engineering; sid:6002435; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.m20r.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.m20r.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002436; classtype:social-engineering; sid:6002436; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-bugfix.pages.dev/js/web3.js/)"; flow:established,to_server; http.uri; content:"/js/web3.js/"; startswith; fast_pattern; http.host; content:"web-bugfix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002437; classtype:social-engineering; sid:6002437; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-framtex-biz-vrolnik-qarnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-framtex-biz-vrolnik-qarnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002438; classtype:social-engineering; sid:6002438; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (owa.supersaverdining.com/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second/8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"owa.supersaverdining.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002439; classtype:social-engineering; sid:6002439; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ben-ammar-ahmed.github.io/cybersecurity_phishing)"; flow:established,to_server; http.uri; content:"/cybersecurity_phishing"; startswith; fast_pattern; http.host; content:"ben-ammar-ahmed.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002440; classtype:social-engineering; sid:6002440; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (worker-sweet-thunder-0bd5.jdl71756.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"worker-sweet-thunder-0bd5.jdl71756.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002441; classtype:social-engineering; sid:6002441; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (decentranet.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"decentranet.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002442; classtype:social-engineering; sid:6002442; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.infoshopee-10.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.infoshopee-10.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002443; classtype:social-engineering; sid:6002443; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (promohadiah-shopee12.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"promohadiah-shopee12.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002444; classtype:social-engineering; sid:6002444; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (devhouda.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"devhouda.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002445; classtype:social-engineering; sid:6002445; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (securedbankfinancing.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"securedbankfinancing.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002446; classtype:social-engineering; sid:6002446; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galeryshopee2022.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"galeryshopee2022.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002447; classtype:social-engineering; sid:6002447; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-fralnix-biz-slurnor-platem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-fralnix-biz-slurnor-platem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002448; classtype:social-engineering; sid:6002448; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fromncostumerxid.revolusioner.web.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fromncostumerxid.revolusioner.web.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002449; classtype:social-engineering; sid:6002449; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-platik-biz-slurnex-vroltor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-platik-biz-slurnex-vroltor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002450; classtype:social-engineering; sid:6002450; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jawad-devpk.github.io/whatsapp-clone)"; flow:established,to_server; http.uri; content:"/whatsapp-clone"; startswith; fast_pattern; http.host; content:"jawad-devpk.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002451; classtype:social-engineering; sid:6002451; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-dranvik-biz-qoltex-frunax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-dranvik-biz-qoltex-frunax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002452; classtype:social-engineering; sid:6002452; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-fralqax-biz-slurnor-qarnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-fralqax-biz-slurnor-qarnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002453; classtype:social-engineering; sid:6002453; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kczim.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kczim.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002454; classtype:social-engineering; sid:6002454; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblux2026.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.roblux2026.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002455; classtype:social-engineering; sid:6002455; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (claim-alert-esl.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"claim-alert-esl.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002456; classtype:social-engineering; sid:6002456; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeejkt337.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopeejkt337.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002457; classtype:social-engineering; sid:6002457; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (keoindia.com/jvibuagr/)"; flow:established,to_server; http.uri; content:"/jvibuagr/"; startswith; fast_pattern; http.host; content:"keoindia.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002458; classtype:social-engineering; sid:6002458; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sunny-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sunny-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002459; classtype:social-engineering; sid:6002459; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreigdm2txbgx2janmzdmdnezvdfa7i5kiajzltxpx7tj5nvjxikqvhq.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreigdm2txbgx2janmzdmdnezvdfa7i5kiajzltxpx7tj5nvjxikqvhq.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002460; classtype:social-engineering; sid:6002460; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (navyfederall.us/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"navyfederall.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002461; classtype:social-engineering; sid:6002461; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-qolnix-biz-glortor-fraltek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-qolnix-biz-glortor-fraltek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002462; classtype:social-engineering; sid:6002462; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kanhyakkushwaha.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"kanhyakkushwaha.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002463; classtype:social-engineering; sid:6002463; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (claim-alert-esl.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"claim-alert-esl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002464; classtype:social-engineering; sid:6002464; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (manazil3.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"manazil3.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002465; classtype:social-engineering; sid:6002465; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-tranik-biz-fraltem-qurnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-tranik-biz-fraltem-qurnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002466; classtype:social-engineering; sid:6002466; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mssdold.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mssdold.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002467; classtype:social-engineering; sid:6002467; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.promohadiah-shopee12.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.promohadiah-shopee12.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002468; classtype:social-engineering; sid:6002468; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vrolnix-biz-frurnor-platem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vrolnix-biz-frurnor-platem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002469; classtype:social-engineering; sid:6002469; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-franov-biz-qurnex-vroltor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-franov-biz-qurnex-vroltor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002470; classtype:social-engineering; sid:6002470; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.galeryshopee11-11.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.galeryshopee11-11.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002471; classtype:social-engineering; sid:6002471; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onlineratingwork.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"onlineratingwork.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002472; classtype:social-engineering; sid:6002472; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeejkt337.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopeejkt337.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002473; classtype:social-engineering; sid:6002473; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17200.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17200.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002474; classtype:social-engineering; sid:6002474; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.auth-webang.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.auth-webang.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002475; classtype:social-engineering; sid:6002475; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-slornex-biz-dranvik-glurtor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-slornex-biz-dranvik-glurtor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002476; classtype:social-engineering; sid:6002476; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hadiahresmishopeeindonesia.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hadiahresmishopeeindonesia.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002477; classtype:social-engineering; sid:6002477; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (httpbjlv.com/xdnpwbin/)"; flow:established,to_server; http.uri; content:"/xdnpwbin/"; startswith; fast_pattern; http.host; content:"httpbjlv.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002478; classtype:social-engineering; sid:6002478; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-narvik-biz-plortex-franul.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-narvik-biz-plortex-franul.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002479; classtype:social-engineering; sid:6002479; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gebyar-shope-2022.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.gebyar-shope-2022.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002480; classtype:social-engineering; sid:6002480; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (esl-claim-alert.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"esl-claim-alert.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002481; classtype:social-engineering; sid:6002481; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (magnitudenunmain.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"magnitudenunmain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002482; classtype:social-engineering; sid:6002482; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreibhsdme4xafylyd264qskjwlrmuabh4egs3kyznjgaitzniuwwytm.ipfs.nftstorage.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreibhsdme4xafylyd264qskjwlrmuabh4egs3kyznjgaitzniuwwytm.ipfs.nftstorage.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002483; classtype:social-engineering; sid:6002483; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.programundianshopee11.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.programundianshopee11.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002484; classtype:social-engineering; sid:6002484; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qurnik-biz-glatem-slornex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qurnik-biz-glatem-slornex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002485; classtype:social-engineering; sid:6002485; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (draw88.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"draw88.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002486; classtype:social-engineering; sid:6002486; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-dranqor-biz-fruntex-slavrix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-dranqor-biz-fruntex-slavrix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002487; classtype:social-engineering; sid:6002487; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-plurnik-biz-frurnex-glatem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-plurnik-biz-frurnex-glatem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002488; classtype:social-engineering; sid:6002488; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hadiah-resmishopee2022.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hadiah-resmishopee2022.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002489; classtype:social-engineering; sid:6002489; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (validated-box-4c63.rwqgy3zd.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"validated-box-4c63.rwqgy3zd.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002490; classtype:social-engineering; sid:6002490; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17189.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17189.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002491; classtype:social-engineering; sid:6002491; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.brfekw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.brfekw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002492; classtype:social-engineering; sid:6002492; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (plan-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"plan-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002493; classtype:social-engineering; sid:6002493; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pablodaniel1779812892380.2091781.meusitehostgator.com.br/pp/P/log.php)"; flow:established,to_server; http.uri; content:"/pp/P/log.php"; startswith; fast_pattern; http.host; content:"pablodaniel1779812892380.2091781.meusitehostgator.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002494; classtype:social-engineering; sid:6002494; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (litmawers.pro/connect/web)"; flow:established,to_server; http.uri; content:"/connect/web"; startswith; fast_pattern; http.host; content:"litmawers.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002495; classtype:social-engineering; sid:6002495; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prteccionsgrddmcroffchtwh.iceiy.com/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"prteccionsgrddmcroffchtwh.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002496; classtype:social-engineering; sid:6002496; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.daftar-pemenang57.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.daftar-pemenang57.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002497; classtype:social-engineering; sid:6002497; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365bet833.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365bet833.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002498; classtype:social-engineering; sid:6002498; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mansi2oo4.github.io/Amazon-UI-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-UI-Clone"; startswith; fast_pattern; http.host; content:"mansi2oo4.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002499; classtype:social-engineering; sid:6002499; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (face-book.com.vn/timbannaygapcohautaailienhe?a)"; flow:established,to_server; http.uri; content:"/timbannaygapcohautaailienhe?a"; startswith; fast_pattern; http.host; content:"face-book.com.vn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002500; classtype:social-engineering; sid:6002500; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store.communitysectiongame.shop/item/AWP-AncientHeritage/)"; flow:established,to_server; http.uri; content:"/item/AWP-AncientHeritage/"; startswith; fast_pattern; http.host; content:"store.communitysectiongame.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002501; classtype:social-engineering; sid:6002501; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365bet838.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365bet838.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002502; classtype:social-engineering; sid:6002502; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vraltex-biz-glurnor-qolvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vraltex-biz-glurnor-qolvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002503; classtype:social-engineering; sid:6002503; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreicwavswq5o6zqdqq5kao6qpkb7bsq3lb7qraovbaah6646q3c75ee.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreicwavswq5o6zqdqq5kao6qpkb7bsq3lb7qraovbaah6646q3c75ee.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002504; classtype:social-engineering; sid:6002504; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qarnex-biz-glurnik-slurnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qarnex-biz-glurnik-slurnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002505; classtype:social-engineering; sid:6002505; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (capitana.co.il/korea.html)"; flow:established,to_server; http.uri; content:"/korea.html"; startswith; fast_pattern; http.host; content:"capitana.co.il"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002506; classtype:social-engineering; sid:6002506; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (navya639.github.io/Amazon_clone/)"; flow:established,to_server; http.uri; content:"/Amazon_clone/"; startswith; fast_pattern; http.host; content:"navya639.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002507; classtype:social-engineering; sid:6002507; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (saba-fatimaa.github.io/clone-Amazon/)"; flow:established,to_server; http.uri; content:"/clone-Amazon/"; startswith; fast_pattern; http.host; content:"saba-fatimaa.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002508; classtype:social-engineering; sid:6002508; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shared-document-cfb9de.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shared-document-cfb9de.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002509; classtype:social-engineering; sid:6002509; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17192.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17192.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002510; classtype:social-engineering; sid:6002510; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meek-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meek-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002511; classtype:social-engineering; sid:6002511; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (claims-fraud-esl-org.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"claims-fraud-esl-org.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002512; classtype:social-engineering; sid:6002512; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h23t.top/m/)"; flow:established,to_server; http.uri; content:"/m/"; startswith; fast_pattern; http.host; content:"h23t.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002513; classtype:social-engineering; sid:6002513; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rfv-internal-dev.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rfv-internal-dev.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002514; classtype:social-engineering; sid:6002514; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiarebs6fzk2fdl7nwihhbwejvw5pwuhytyqvpy7375stgw6m32haa.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiarebs6fzk2fdl7nwihhbwejvw5pwuhytyqvpy7375stgw6m32haa.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002515; classtype:social-engineering; sid:6002515; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.masssegner-dubai-nnew24h.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.masssegner-dubai-nnew24h.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002516; classtype:social-engineering; sid:6002516; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pemenangshopee-2022.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.pemenangshopee-2022.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002517; classtype:social-engineering; sid:6002517; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vroltem-biz-plarnik-qurnax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vroltem-biz-plarnik-qurnax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002518; classtype:social-engineering; sid:6002518; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinityweb-transform101010101.company/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinityweb-transform101010101.company"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002519; classtype:social-engineering; sid:6002519; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.js44553.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.js44553.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002520; classtype:social-engineering; sid:6002520; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-plavtek-biz-fralnor-slunix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-plavtek-biz-fralnor-slunix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002521; classtype:social-engineering; sid:6002521; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-fraltex-biz-plurnik-vranor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-fraltex-biz-plurnik-vranor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002522; classtype:social-engineering; sid:6002522; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiawo4tjsyxl3iviikfjzfd2b66wkhmmr2zrmr3yfsqf75iyxzkj7e.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiawo4tjsyxl3iviikfjzfd2b66wkhmmr2zrmr3yfsqf75iyxzkj7e.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002523; classtype:social-engineering; sid:6002523; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.galeryshopee22.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.galeryshopee22.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002524; classtype:social-engineering; sid:6002524; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zentro.top/PL-1466-160526/?e=xxx&s3=Adam&s4=Machaj&)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?e=xxx&s3=Adam&s4=Machaj&"; startswith; fast_pattern; http.host; content:"zentro.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002525; classtype:social-engineering; sid:6002525; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-slurnex-biz-vrolnik-glatem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-slurnex-biz-vrolnik-glatem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002526; classtype:social-engineering; sid:6002526; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (938673888.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"938673888.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002527; classtype:social-engineering; sid:6002527; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fedex-mx.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fedex-mx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002528; classtype:social-engineering; sid:6002528; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (esl-claim-alert.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"esl-claim-alert.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002529; classtype:social-engineering; sid:6002529; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.infoshopee2022.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.infoshopee2022.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002530; classtype:social-engineering; sid:6002530; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (programundianshopee11.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"programundianshopee11.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002531; classtype:social-engineering; sid:6002531; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docsonlineshare.hbhasnen.com/docsign/d0cs/Windows/utility.php)"; flow:established,to_server; http.uri; content:"/docsign/d0cs/Windows/utility.php"; startswith; fast_pattern; http.host; content:"docsonlineshare.hbhasnen.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002532; classtype:social-engineering; sid:6002532; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (devgupta-in.github.io/Amazon-homepage-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-homepage-clone/"; startswith; fast_pattern; http.host; content:"devgupta-in.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002533; classtype:social-engineering; sid:6002533; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-plurnor-biz-qoltem-glatik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-plurnor-biz-qoltem-glatik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002534; classtype:social-engineering; sid:6002534; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-vralqor-biz-fruntax-slarnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-vralqor-biz-fruntax-slarnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002535; classtype:social-engineering; sid:6002535; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (microsoftword.programgridsoft.com/?etext=2202.HLgk-IrqSjzkv-DTQsIXn2JjaW5xeXdxZmJ6Z3hzd3Y.d183d827e94e2ec2b53557a380b30d2f364fa6d9)"; flow:established,to_server; http.uri; content:"/?etext=2202.HLgk-IrqSjzkv-DTQsIXn2JjaW5xeXdxZmJ6Z3hzd3Y.d183d827e94e2ec2b53557a380b30d2f364fa6d9"; startswith; fast_pattern; http.host; content:"microsoftword.programgridsoft.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002536; classtype:social-engineering; sid:6002536; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whatsaplusoriginal.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsaplusoriginal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002537; classtype:social-engineering; sid:6002537; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortport.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortport.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002538; classtype:social-engineering; sid:6002538; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (infoshopee-10.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"infoshopee-10.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002539; classtype:social-engineering; sid:6002539; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (claims-fraud-esl-org.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"claims-fraud-esl-org.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002540; classtype:social-engineering; sid:6002540; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-slurnor-biz-vrolnik-glatix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-slurnor-biz-vrolnik-glatix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002541; classtype:social-engineering; sid:6002541; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwwwmgzineeluiza.online/produto&)"; flow:established,to_server; http.uri; content:"/produto&"; startswith; fast_pattern; http.host; content:"wwwwmgzineeluiza.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002542; classtype:social-engineering; sid:6002542; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jaioez.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jaioez.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002543; classtype:social-engineering; sid:6002543; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hadiahresmishopeeindonesia.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"hadiahresmishopeeindonesia.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002544; classtype:social-engineering; sid:6002544; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.galeryshopee2022.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.galeryshopee2022.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002545; classtype:social-engineering; sid:6002545; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (27842636365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"27842636365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002546; classtype:social-engineering; sid:6002546; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-wheat-three.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-wheat-three.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002547; classtype:social-engineering; sid:6002547; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1dmaisluzawww.site/loading.php?token=PneuSeguro)"; flow:established,to_server; http.uri; content:"/loading.php?token=PneuSeguro"; startswith; fast_pattern; http.host; content:"1dmaisluzawww.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002548; classtype:social-engineering; sid:6002548; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pemenang-shopee-22.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.pemenang-shopee-22.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002549; classtype:social-engineering; sid:6002549; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-plaqtex-biz-vralnik-qarnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-plaqtex-biz-vralnik-qarnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002550; classtype:social-engineering; sid:6002550; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (phldgn.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"phldgn.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002551; classtype:social-engineering; sid:6002551; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-plurnax-biz-vratem-fralvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-plurnax-biz-vratem-fralvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002552; classtype:social-engineering; sid:6002552; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (g18m.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"g18m.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002553; classtype:social-engineering; sid:6002553; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glurnax-biz-vroltex-dranor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glurnax-biz-vroltex-dranor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002554; classtype:social-engineering; sid:6002554; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblux2026.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"roblux2026.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002555; classtype:social-engineering; sid:6002555; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (antoinettegaudin.info/PL-1466-160526/?u=97C1466&e=tanumhub@54af9e7b9624c8c5622c7c73b2f5c19443b2.com&s3=&s4=&s5=%25%EF%BF%BDdress%25%25&s6=%25%25Zip%25%25&s7=%25%25City%25%25&s8=%25%25Phone%25%25)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?u=97C1466&e=tanumhub@54af9e7b9624c8c5622c7c73b2f5c19443b2.com&s3=&s4=&s5=%25%EF%BF%BDdress%25%25&s6=%25%25Zip%25%25&s7=%25%25City%25%25&s8=%25%25Phone%25%25"; startswith; fast_pattern; http.host; content:"antoinettegaudin.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002556; classtype:social-engineering; sid:6002556; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-trurnik-biz-glavtor-plunex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-trurnik-biz-glavtor-plunex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002557; classtype:social-engineering; sid:6002557; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (intverncertinvert.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"intverncertinvert.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002558; classtype:social-engineering; sid:6002558; rev:1; metadata: signature_severity Major, created_et 2026_06_07, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www-deutschen-kreditban-de.91-218-65-223.plesk.page/intel/)"; flow:established,to_server; http.uri; content:"/intel/"; startswith; fast_pattern; http.host; content:"www-deutschen-kreditban-de.91-218-65-223.plesk.page"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002559; classtype:social-engineering; sid:6002559; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ssomyuholldcdnapps.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"ssomyuholldcdnapps.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002560; classtype:social-engineering; sid:6002560; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (desktop-ledgrs.wixstudio.com/desktop)"; flow:established,to_server; http.uri; content:"/desktop"; startswith; fast_pattern; http.host; content:"desktop-ledgrs.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002561; classtype:social-engineering; sid:6002561; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (new-moon-peye.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"new-moon-peye.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002562; classtype:social-engineering; sid:6002562; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (homeapps-trezosuite.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"homeapps-trezosuite.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002563; classtype:social-engineering; sid:6002563; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bitunixx.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"bitunixx.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002564; classtype:social-engineering; sid:6002564; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.olutionsgro.com/curewaenopen/)"; flow:established,to_server; http.uri; content:"/curewaenopen/"; startswith; fast_pattern; http.host; content:"www.olutionsgro.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002565; classtype:social-engineering; sid:6002565; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dkde239rikozefri.g18.email/webcard/de/4J6I-94E9B5D2A0/)"; flow:established,to_server; http.uri; content:"/webcard/de/4J6I-94E9B5D2A0/"; startswith; fast_pattern; http.host; content:"dkde239rikozefri.g18.email"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002566; classtype:social-engineering; sid:6002566; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.maclenumerique.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.maclenumerique.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002567; classtype:social-engineering; sid:6002567; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (learn-kerkenapp.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"learn-kerkenapp.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002568; classtype:social-engineering; sid:6002568; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mpi03b-6a.myshopify.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mpi03b-6a.myshopify.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002569; classtype:social-engineering; sid:6002569; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bcaxe-reward.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bcaxe-reward.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002570; classtype:social-engineering; sid:6002570; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (swisspostrack.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"swisspostrack.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002571; classtype:social-engineering; sid:6002571; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (parthivx1.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"parthivx1.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002572; classtype:social-engineering; sid:6002572; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (antttas.szm.sk/up/home.htm?vje9yijqula38x98zj81p2zdp5zw3levfatx6fsx39zajibsu6)"; flow:established,to_server; http.uri; content:"/up/home.htm?vje9yijqula38x98zj81p2zdp5zw3levfatx6fsx39zajibsu6"; startswith; fast_pattern; http.host; content:"antttas.szm.sk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002573; classtype:social-engineering; sid:6002573; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.js9851.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.js9851.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002574; classtype:social-engineering; sid:6002574; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prime-videosfrance.com/index.php/suivi)"; flow:established,to_server; http.uri; content:"/index.php/suivi"; startswith; fast_pattern; http.host; content:"prime-videosfrance.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002575; classtype:social-engineering; sid:6002575; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vxsct1811.avnam.net/ser/wordpress/wp-admin/includes/secr/Idsp3984762836/app/index.php?view=main&id=eb0ccaeffefa590d16ee6afaba918c68)"; flow:established,to_server; http.uri; content:"/ser/wordpress/wp-admin/includes/secr/Idsp3984762836/app/index.php?view=main&id=eb0ccaeffefa590d16ee6afaba918c68"; startswith; fast_pattern; http.host; content:"vxsct1811.avnam.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002576; classtype:social-engineering; sid:6002576; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.coinbase_prologin_log.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.coinbase_prologin_log.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002577; classtype:social-engineering; sid:6002577; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cordialcertmain.wasmer.app/mobile)"; flow:established,to_server; http.uri; content:"/mobile"; startswith; fast_pattern; http.host; content:"cordialcertmain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002578; classtype:social-engineering; sid:6002578; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uurl.at/g9qQLi)"; flow:established,to_server; http.uri; content:"/g9qQLi"; startswith; fast_pattern; http.host; content:"uurl.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002579; classtype:social-engineering; sid:6002579; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (varnika6-hub.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"varnika6-hub.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002580; classtype:social-engineering; sid:6002580; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.galabet-guncelaff.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.galabet-guncelaff.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002581; classtype:social-engineering; sid:6002581; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (harshkeni.github.io/instagram_login_page_clone/)"; flow:established,to_server; http.uri; content:"/instagram_login_page_clone/"; startswith; fast_pattern; http.host; content:"harshkeni.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002582; classtype:social-engineering; sid:6002582; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h23u.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"h23u.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002583; classtype:social-engineering; sid:6002583; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thecourierguydept.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"thecourierguydept.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002584; classtype:social-engineering; sid:6002584; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-trezo-ai.zapier.app/help)"; flow:established,to_server; http.uri; content:"/help"; startswith; fast_pattern; http.host; content:"secure-trezo-ai.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002585; classtype:social-engineering; sid:6002585; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (outconfiadd.webcindario.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"outconfiadd.webcindario.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002586; classtype:social-engineering; sid:6002586; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qravtem-biz-vrolnix-slarnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qravtem-biz-vrolnix-slarnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002587; classtype:social-engineering; sid:6002587; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.yhcp668.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.yhcp668.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002588; classtype:social-engineering; sid:6002588; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.yh87766.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.yh87766.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002589; classtype:social-engineering; sid:6002589; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rdg.non-steam.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rdg.non-steam.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002590; classtype:social-engineering; sid:6002590; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adminveri.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"adminveri.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002591; classtype:social-engineering; sid:6002591; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (non-steam.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"non-steam.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002592; classtype:social-engineering; sid:6002592; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (egurrolea.com/azx/owa/owa.html)"; flow:established,to_server; http.uri; content:"/azx/owa/owa.html"; startswith; fast_pattern; http.host; content:"egurrolea.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002593; classtype:social-engineering; sid:6002593; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (segurapaymentsonline.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"segurapaymentsonline.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002594; classtype:social-engineering; sid:6002594; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (madinirusufmain.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"madinirusufmain.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002595; classtype:social-engineering; sid:6002595; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agardepo.com.tr/crosco-tech/pastries/index.html)"; flow:established,to_server; http.uri; content:"/crosco-tech/pastries/index.html"; startswith; fast_pattern; http.host; content:"agardepo.com.tr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002596; classtype:social-engineering; sid:6002596; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ynk.rocks/voice/)"; flow:established,to_server; http.uri; content:"/voice/"; startswith; fast_pattern; http.host; content:"www.ynk.rocks"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002597; classtype:social-engineering; sid:6002597; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aman365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aman365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002598; classtype:social-engineering; sid:6002598; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (haber7546.shop/auth)"; flow:established,to_server; http.uri; content:"/auth"; startswith; fast_pattern; http.host; content:"haber7546.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002599; classtype:social-engineering; sid:6002599; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17103.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17103.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002600; classtype:social-engineering; sid:6002600; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ridt.site.je/up/index.htm?i=1)"; flow:established,to_server; http.uri; content:"/up/index.htm?i=1"; startswith; fast_pattern; http.host; content:"ridt.site.je"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002601; classtype:social-engineering; sid:6002601; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mohdnafisalam.github.io/AMAZON-CLONE/)"; flow:established,to_server; http.uri; content:"/AMAZON-CLONE/"; startswith; fast_pattern; http.host; content:"mohdnafisalam.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002602; classtype:social-engineering; sid:6002602; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-frunov-biz-qarnex-platem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-frunov-biz-qarnex-platem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002603; classtype:social-engineering; sid:6002603; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mesnager-bussinesss1008f9725.netlify.app/home)"; flow:established,to_server; http.uri; content:"/home"; startswith; fast_pattern; http.host; content:"mesnager-bussinesss1008f9725.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002604; classtype:social-engineering; sid:6002604; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shanasyed.github.io/amazon-interface-clone/)"; flow:established,to_server; http.uri; content:"/amazon-interface-clone/"; startswith; fast_pattern; http.host; content:"shanasyed.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002605; classtype:social-engineering; sid:6002605; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (regulatory-review.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"regulatory-review.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002606; classtype:social-engineering; sid:6002606; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (goshenmedia.co.ls/.well-known/axa.ch-26/axa.ch-ba/axa.ch/login.php)"; flow:established,to_server; http.uri; content:"/.well-known/axa.ch-26/axa.ch-ba/axa.ch/login.php"; startswith; fast_pattern; http.host; content:"goshenmedia.co.ls"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002607; classtype:social-engineering; sid:6002607; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (l0glnn-m1croqx0qftcom-0utloolx1drvvefil3es.fwh.is/index.html?email=lorumlab@49a20767dfe6cd447667491d2770bdd532c5.org)"; flow:established,to_server; http.uri; content:"/index.html?email=lorumlab@49a20767dfe6cd447667491d2770bdd532c5.org"; startswith; fast_pattern; http.host; content:"l0glnn-m1croqx0qftcom-0utloolx1drvvefil3es.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002608; classtype:social-engineering; sid:6002608; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-surnex-biz-kavtri-molza.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-surnex-biz-kavtri-molza.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002609; classtype:social-engineering; sid:6002609; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fsyinglilai.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fsyinglilai.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002610; classtype:social-engineering; sid:6002610; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cast-production-0209.up.railway.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cast-production-0209.up.railway.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002611; classtype:social-engineering; sid:6002611; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hearingassociates.s3.nl-ams.scw.cloud/den.html)"; flow:established,to_server; http.uri; content:"/den.html"; startswith; fast_pattern; http.host; content:"hearingassociates.s3.nl-ams.scw.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002612; classtype:social-engineering; sid:6002612; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (workouts.mystagingwebsite.com/wp-content/plugins/vinvourist/public/index.php)"; flow:established,to_server; http.uri; content:"/wp-content/plugins/vinvourist/public/index.php"; startswith; fast_pattern; http.host; content:"workouts.mystagingwebsite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002613; classtype:social-engineering; sid:6002613; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bnbhomes.in/Korea.html)"; flow:established,to_server; http.uri; content:"/Korea.html"; startswith; fast_pattern; http.host; content:"bnbhomes.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002614; classtype:social-engineering; sid:6002614; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (resarch.markusscholz.info/ga/click/2-9798776-10-8494-16604-9112-17afc9ad5f-f5e7bc8c21)"; flow:established,to_server; http.uri; content:"/ga/click/2-9798776-10-8494-16604-9112-17afc9ad5f-f5e7bc8c21"; startswith; fast_pattern; http.host; content:"resarch.markusscholz.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002615; classtype:social-engineering; sid:6002615; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cooltentregas.com.br/cumm/AMENCN-1/?email=galik2@ba305364ca4b31676ba03fa3849404cea7b8.com)"; flow:established,to_server; http.uri; content:"/cumm/AMENCN-1/?email=galik2@ba305364ca4b31676ba03fa3849404cea7b8.com"; startswith; fast_pattern; http.host; content:"cooltentregas.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002616; classtype:social-engineering; sid:6002616; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hadiah-resmishopee2022.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hadiah-resmishopee2022.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002617; classtype:social-engineering; sid:6002617; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mfacebook.com.vn/78eup3szuoi?a&l)"; flow:established,to_server; http.uri; content:"/78eup3szuoi?a&l"; startswith; fast_pattern; http.host; content:"mfacebook.com.vn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002618; classtype:social-engineering; sid:6002618; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.popandc.be/wp-admin/js/cgi-ent/index--000)"; flow:established,to_server; http.uri; content:"/wp-admin/js/cgi-ent/index--000"; startswith; fast_pattern; http.host; content:"www.popandc.be"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002619; classtype:social-engineering; sid:6002619; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amnaakhtar15.github.io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"amnaakhtar15.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002620; classtype:social-engineering; sid:6002620; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (joel-eapen.github.io/javascript-amazon-project/amazon.html)"; flow:established,to_server; http.uri; content:"/javascript-amazon-project/amazon.html"; startswith; fast_pattern; http.host; content:"joel-eapen.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002621; classtype:social-engineering; sid:6002621; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (akash24303.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"akash24303.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002622; classtype:social-engineering; sid:6002622; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wetransfer-customize-files-shared.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wetransfer-customize-files-shared.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002623; classtype:social-engineering; sid:6002623; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (16504.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"16504.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002624; classtype:social-engineering; sid:6002624; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sqs.non-steam.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.sqs.non-steam.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002625; classtype:social-engineering; sid:6002625; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (php-bf442ch.wasmer.app/login.php)"; flow:established,to_server; http.uri; content:"/login.php"; startswith; fast_pattern; http.host; content:"php-bf442ch.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002626; classtype:social-engineering; sid:6002626; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (casinoseon.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"casinoseon.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002627; classtype:social-engineering; sid:6002627; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-fralvox-biz-qortem-dranix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-fralvox-biz-qortem-dranix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002628; classtype:social-engineering; sid:6002628; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cuuibase_prou_logi.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cuuibase_prou_logi.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002629; classtype:social-engineering; sid:6002629; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.microsoft-1ogin.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.microsoft-1ogin.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002630; classtype:social-engineering; sid:6002630; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paypal-c.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paypal-c.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002631; classtype:social-engineering; sid:6002631; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fnclaim.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fnclaim.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002632; classtype:social-engineering; sid:6002632; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cuuibase_prou_logi.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cuuibase_prou_logi.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002633; classtype:social-engineering; sid:6002633; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inlnk.co/VHjVN)"; flow:established,to_server; http.uri; content:"/VHjVN"; startswith; fast_pattern; http.host; content:"inlnk.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002634; classtype:social-engineering; sid:6002634; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (official-exodas.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"official-exodas.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002635; classtype:social-engineering; sid:6002635; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glortex-biz-fralnor-qurnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glortex-biz-fralnor-qurnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002636; classtype:social-engineering; sid:6002636; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s3.eu-north-1.amazonaws.com/us-east-3.console.aws.amazon.com007/Dhll.html)"; flow:established,to_server; http.uri; content:"/us-east-3.console.aws.amazon.com007/Dhll.html"; startswith; fast_pattern; http.host; content:"s3.eu-north-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002637; classtype:social-engineering; sid:6002637; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-pralzo-biz-velnik-dorqu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-pralzo-biz-velnik-dorqu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002638; classtype:social-engineering; sid:6002638; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (studentska-zadruga.ba/proctal/EN-G.html)"; flow:established,to_server; http.uri; content:"/proctal/EN-G.html"; startswith; fast_pattern; http.host; content:"studentska-zadruga.ba"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002639; classtype:social-engineering; sid:6002639; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (global-package-tracking.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"global-package-tracking.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002640; classtype:social-engineering; sid:6002640; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-vraxlor-biz-druntek-fralnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-vraxlor-biz-druntek-fralnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002641; classtype:social-engineering; sid:6002641; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mrluwas25.bubbleapps.io/version-test/111)"; flow:established,to_server; http.uri; content:"/version-test/111"; startswith; fast_pattern; http.host; content:"mrluwas25.bubbleapps.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002642; classtype:social-engineering; sid:6002642; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreifjwfze2ce74zbj6xilrzf3wixlub5w7ixt2iofzkd72vtndj7c2a.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreifjwfze2ce74zbj6xilrzf3wixlub5w7ixt2iofzkd72vtndj7c2a.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002643; classtype:social-engineering; sid:6002643; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ellisgroupofma.info/PL-1466-160526/?e=tanio7@8097e2947133de380a5724d8d70d208a5950.com&s3=Artur&s4=Plaskowski&s5=&s6=&s7=&s8=&u=97C1466)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?e=tanio7@8097e2947133de380a5724d8d70d208a5950.com&s3=Artur&s4=Plaskowski&s5=&s6=&s7=&s8=&u=97C1466"; startswith; fast_pattern; http.host; content:"ellisgroupofma.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002644; classtype:social-engineering; sid:6002644; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.vdhedheb-etws.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.vdhedheb-etws.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002645; classtype:social-engineering; sid:6002645; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-qoltor-biz-glarnor-vraltex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-qoltor-biz-glarnor-vraltex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002646; classtype:social-engineering; sid:6002646; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeebig777.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopeebig777.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002647; classtype:social-engineering; sid:6002647; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mrtm-ywoc-dm31.rdials-compasslabservices-com-s-account.workers.dev/api/session/init)"; flow:established,to_server; http.uri; content:"/api/session/init"; startswith; fast_pattern; http.host; content:"mrtm-ywoc-dm31.rdials-compasslabservices-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002648; classtype:social-engineering; sid:6002648; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-druntex-biz-glarnov-frutik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-druntex-biz-glarnov-frutik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002649; classtype:social-engineering; sid:6002649; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinbase_prologin_log.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coinbase_prologin_log.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002650; classtype:social-engineering; sid:6002650; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-vromtek-biz-slortik-plarnix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-vromtek-biz-slortik-plarnix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002651; classtype:social-engineering; sid:6002651; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17092.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17092.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002652; classtype:social-engineering; sid:6002652; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aclearplace.ch/PL-1466-160526/?u=97C1466&e=tomek%40elt.pl&s3=&s4=&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/PL-1466-160526/?u=97C1466&e=tomek%40elt.pl&s3=&s4=&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"aclearplace.ch"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002653; classtype:social-engineering; sid:6002653; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrio.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrio.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002654; classtype:social-engineering; sid:6002654; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yuzuapp.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yuzuapp.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002655; classtype:social-engineering; sid:6002655; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (informacion-034--validar2901.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"informacion-034--validar2901.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002656; classtype:social-engineering; sid:6002656; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-plarnex-biz-frutek-vrolix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-plarnex-biz-frutek-vrolix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002657; classtype:social-engineering; sid:6002657; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qornex-biz-vroltem-glurnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qornex-biz-vroltem-glurnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002658; classtype:social-engineering; sid:6002658; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bdovawvip.com/ph/personal/)"; flow:established,to_server; http.uri; content:"/ph/personal/"; startswith; fast_pattern; http.host; content:"bdovawvip.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002659; classtype:social-engineering; sid:6002659; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verificar--seguridad884.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"verificar--seguridad884.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002660; classtype:social-engineering; sid:6002660; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tsgateway.non-steam.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tsgateway.non-steam.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002661; classtype:social-engineering; sid:6002661; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sdgf9af72f31706769d32bf1ff66cdec1d1gkj5jg95jg5k0hkg95kg0tk.pages.dev/NHQ031202LETTER.pdf)"; flow:established,to_server; http.uri; content:"/NHQ031202LETTER.pdf"; startswith; fast_pattern; http.host; content:"sdgf9af72f31706769d32bf1ff66cdec1d1gkj5jg95jg5k0hkg95kg0tk.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002662; classtype:social-engineering; sid:6002662; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (forms.logiforms.com/formdata/user_forms/94306_544262/417129/page1.html)"; flow:established,to_server; http.uri; content:"/formdata/user_forms/94306_544262/417129/page1.html"; startswith; fast_pattern; http.host; content:"forms.logiforms.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002663; classtype:social-engineering; sid:6002663; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (silent-dust-b567.elymatldielwa4741.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"silent-dust-b567.elymatldielwa4741.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002664; classtype:social-engineering; sid:6002664; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kqinbasepro_iogin.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kqinbasepro_iogin.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002665; classtype:social-engineering; sid:6002665; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hellpdesk.at/?r=d614261b-37fd-45ba-aea9-b8c120f1bc86)"; flow:established,to_server; http.uri; content:"/?r=d614261b-37fd-45ba-aea9-b8c120f1bc86"; startswith; fast_pattern; http.host; content:"hellpdesk.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002666; classtype:social-engineering; sid:6002666; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qurnik-biz-glarnex-fratem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qurnik-biz-glarnex-fratem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002667; classtype:social-engineering; sid:6002667; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreifdr7lz6qv44cqosz75kwam7x6gta3izhq5vqxyyeharddpacresi.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreifdr7lz6qv44cqosz75kwam7x6gta3izhq5vqxyyeharddpacresi.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002668; classtype:social-engineering; sid:6002668; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365-notifcation.com/93132a08184/0e7994f46ef77d17999eceef/index.php?id=263bdbd4879cc1000096daec31a771e7)"; flow:established,to_server; http.uri; content:"/93132a08184/0e7994f46ef77d17999eceef/index.php?id=263bdbd4879cc1000096daec31a771e7"; startswith; fast_pattern; http.host; content:"365-notifcation.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002669; classtype:social-engineering; sid:6002669; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9945670.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9945670.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002670; classtype:social-engineering; sid:6002670; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unepsop.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"unepsop.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002671; classtype:social-engineering; sid:6002671; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galaxysurabaya.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galaxysurabaya.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002672; classtype:social-engineering; sid:6002672; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.s29j.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.s29j.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002673; classtype:social-engineering; sid:6002673; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (programme-hup.m365-microsoft.com/i/d721e212eb3094bfd99c9d047a94edaeb)"; flow:established,to_server; http.uri; content:"/i/d721e212eb3094bfd99c9d047a94edaeb"; startswith; fast_pattern; http.host; content:"programme-hup.m365-microsoft.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002674; classtype:social-engineering; sid:6002674; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fv-gigorder.forum/project/confirmation-order)"; flow:established,to_server; http.uri; content:"/project/confirmation-order"; startswith; fast_pattern; http.host; content:"fv-gigorder.forum"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002675; classtype:social-engineering; sid:6002675; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.airbnb-clone-theta-ruddy.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.airbnb-clone-theta-ruddy.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002676; classtype:social-engineering; sid:6002676; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreicgti5vthrvld3r7msmtanxoxgciool3sqmvgprctp5krdrehfcvu.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreicgti5vthrvld3r7msmtanxoxgciool3sqmvgprctp5krdrehfcvu.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002677; classtype:social-engineering; sid:6002677; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vrolor-biz-slatem-qurnax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vrolor-biz-slatem-qurnax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002678; classtype:social-engineering; sid:6002678; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fgzxcn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fgzxcn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002679; classtype:social-engineering; sid:6002679; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stmarygj.info/41-1511-280526/?u=161C1515&e=crossier%2540etik.com&s3=Christophe&s4=Rossier&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/41-1511-280526/?u=161C1515&e=crossier%2540etik.com&s3=Christophe&s4=Rossier&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"stmarygj.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002680; classtype:social-engineering; sid:6002680; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (test-12-satr.github.io/test/)"; flow:established,to_server; http.uri; content:"/test/"; startswith; fast_pattern; http.host; content:"test-12-satr.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002681; classtype:social-engineering; sid:6002681; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kai-robot-middle-irrigation.trycloudflare.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kai-robot-middle-irrigation.trycloudflare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002682; classtype:social-engineering; sid:6002682; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (panel.charsooq.com/newnaver.html)"; flow:established,to_server; http.uri; content:"/newnaver.html"; startswith; fast_pattern; http.host; content:"panel.charsooq.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002683; classtype:social-engineering; sid:6002683; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox.com.ge/login/)"; flow:established,to_server; http.uri; content:"/login/"; startswith; fast_pattern; http.host; content:"www.roblox.com.ge"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002684; classtype:social-engineering; sid:6002684; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.imtokevn.im/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.imtokevn.im"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002685; classtype:social-engineering; sid:6002685; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mmbxcdfg.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mmbxcdfg.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002686; classtype:social-engineering; sid:6002686; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.doeusignsafe.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.doeusignsafe.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002687; classtype:social-engineering; sid:6002687; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-xolmer-biz-trevik-nasqu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-xolmer-biz-trevik-nasqu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002688; classtype:social-engineering; sid:6002688; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreia7m7wyi7xnltk5kqkoy4m3nssthp2vnjertouskbhqknycjtb2o4.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreia7m7wyi7xnltk5kqkoy4m3nssthp2vnjertouskbhqknycjtb2o4.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002689; classtype:social-engineering; sid:6002689; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.yh87755.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.yh87755.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002690; classtype:social-engineering; sid:6002690; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (terzor-io.gitlab.io/begin)"; flow:established,to_server; http.uri; content:"/begin"; startswith; fast_pattern; http.host; content:"terzor-io.gitlab.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002691; classtype:social-engineering; sid:6002691; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-pelnor-biz-vextar-jumli.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-pelnor-biz-vextar-jumli.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002692; classtype:social-engineering; sid:6002692; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store-steampowered.online/gift_card)"; flow:established,to_server; http.uri; content:"/gift_card"; startswith; fast_pattern; http.host; content:"store-steampowered.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002693; classtype:social-engineering; sid:6002693; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-frontek-biz-slavqor-dramnix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-frontek-biz-slavqor-dramnix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002694; classtype:social-engineering; sid:6002694; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pro_coinbaslogin-io.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pro_coinbaslogin-io.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002695; classtype:social-engineering; sid:6002695; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tinyurl.com/Paypal727362/)"; flow:established,to_server; http.uri; content:"/Paypal727362/"; startswith; fast_pattern; http.host; content:"www.tinyurl.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002696; classtype:social-engineering; sid:6002696; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365bet002.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365bet002.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002697; classtype:social-engineering; sid:6002697; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee1969.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee1969.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002698; classtype:social-engineering; sid:6002698; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (manyhotels.com.ng/mvcogjy/Veri.html)"; flow:established,to_server; http.uri; content:"/mvcogjy/Veri.html"; startswith; fast_pattern; http.host; content:"manyhotels.com.ng"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002699; classtype:social-engineering; sid:6002699; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (72264.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"72264.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002700; classtype:social-engineering; sid:6002700; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17106.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17106.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002701; classtype:social-engineering; sid:6002701; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allbestads.com/sign-in?op_token=5uDn296H92rPrYiwWwnVlDb0IiLK7ooomlZ2wta8I5hKXL0TAfeyrNQHVVxsNnqUI685CK8Tp5eMnnT80p8pyweso7d3FJA6DPV&uuid=921eea32-fe6a-4445-9a13-bde8d63cc8e7&hash=2&language=en)"; flow:established,to_server; http.uri; content:"/sign-in?op_token=5uDn296H92rPrYiwWwnVlDb0IiLK7ooomlZ2wta8I5hKXL0TAfeyrNQHVVxsNnqUI685CK8Tp5eMnnT80p8pyweso7d3FJA6DPV&uuid=921eea32-fe6a-4445-9a13-bde8d63cc8e7&hash=2&language=en"; startswith; fast_pattern; http.host; content:"allbestads.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002702; classtype:social-engineering; sid:6002702; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hindigame37-create.github.io/Instagram-)"; flow:established,to_server; http.uri; content:"/Instagram-"; startswith; fast_pattern; http.host; content:"hindigame37-create.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002703; classtype:social-engineering; sid:6002703; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortex.life/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortex.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002704; classtype:social-engineering; sid:6002704; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinbase_v_login.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coinbase_v_login.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002705; classtype:social-engineering; sid:6002705; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pgijrcloud.non-steam.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pgijrcloud.non-steam.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002706; classtype:social-engineering; sid:6002706; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (esl-claim-alert.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"esl-claim-alert.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002707; classtype:social-engineering; sid:6002707; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17094.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17094.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002708; classtype:social-engineering; sid:6002708; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enlacedecertificacionout.zya.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"enlacedecertificacionout.zya.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002709; classtype:social-engineering; sid:6002709; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coin-bse-app.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coin-bse-app.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002710; classtype:social-engineering; sid:6002710; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mussa-esliman.github.io/Responsive--Apple--Website-/)"; flow:established,to_server; http.uri; content:"/Responsive--Apple--Website-/"; startswith; fast_pattern; http.host; content:"mussa-esliman.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002711; classtype:social-engineering; sid:6002711; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhaarathinesan.github.io/netflix-clone-js/)"; flow:established,to_server; http.uri; content:"/netflix-clone-js/"; startswith; fast_pattern; http.host; content:"bhaarathinesan.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002712; classtype:social-engineering; sid:6002712; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-plavnor-biz-fruntik-qalrex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-plavnor-biz-fruntik-qalrex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002713; classtype:social-engineering; sid:6002713; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.xpj5s.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.xpj5s.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002714; classtype:social-engineering; sid:6002714; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (study.orsapaz.info/ga/click/2-6736491-9-8129-15917-8736-9d12ccec80-8e042984f4)"; flow:established,to_server; http.uri; content:"/ga/click/2-6736491-9-8129-15917-8736-9d12ccec80-8e042984f4"; startswith; fast_pattern; http.host; content:"study.orsapaz.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002715; classtype:social-engineering; sid:6002715; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-qolvrax-biz-slurnik-vromtek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-qolvrax-biz-slurnik-vromtek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002716; classtype:social-engineering; sid:6002716; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreici6nv56agv2t5tpzzcn4y4mpqu4fgfac7rnpn2vudtxg7gu76afu.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreici6nv56agv2t5tpzzcn4y4mpqu4fgfac7rnpn2vudtxg7gu76afu.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002717; classtype:social-engineering; sid:6002717; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prime-videos2026.com/suivi)"; flow:established,to_server; http.uri; content:"/suivi"; startswith; fast_pattern; http.host; content:"prime-videos2026.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002718; classtype:social-engineering; sid:6002718; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-notification.link/landing/form/67191dd7-6877-4f52-8995-8cb4330e825a)"; flow:established,to_server; http.uri; content:"/landing/form/67191dd7-6877-4f52-8995-8cb4330e825a"; startswith; fast_pattern; http.host; content:"secure-notification.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002719; classtype:social-engineering; sid:6002719; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (memnunpendcert.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"memnunpendcert.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002720; classtype:social-engineering; sid:6002720; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-fralqor-biz-vrontek-plamnix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-fralqor-biz-vrontek-plamnix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002721; classtype:social-engineering; sid:6002721; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shivaa.kiinoasnacks.info/ga/click/2-9843369-10-8685-16975-9310-1ae25ff4a6-d6714bdb7f)"; flow:established,to_server; http.uri; content:"/ga/click/2-9843369-10-8685-16975-9310-1ae25ff4a6-d6714bdb7f"; startswith; fast_pattern; http.host; content:"shivaa.kiinoasnacks.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002722; classtype:social-engineering; sid:6002722; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (esl-org-claims2.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"esl-org-claims2.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002723; classtype:social-engineering; sid:6002723; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (conto.servizi.avivos290.t.mydomain.zone/VERIFICA-DATI/conto/conto)"; flow:established,to_server; http.uri; content:"/VERIFICA-DATI/conto/conto"; startswith; fast_pattern; http.host; content:"conto.servizi.avivos290.t.mydomain.zone"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002724; classtype:social-engineering; sid:6002724; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcast-production-a95e.up.railway.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcast-production-a95e.up.railway.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002725; classtype:social-engineering; sid:6002725; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (scotiawealthmanagement.com.cobblestonesw.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"scotiawealthmanagement.com.cobblestonesw.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002726; classtype:social-engineering; sid:6002726; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (antas.szm.sk/up/home.htm?knuzjyvrpclivcuiqwz3hopf9rerq2fnir3ghtmp8qz6psni6c)"; flow:established,to_server; http.uri; content:"/up/home.htm?knuzjyvrpclivcuiqwz3hopf9rerq2fnir3ghtmp8qz6psni6c"; startswith; fast_pattern; http.host; content:"antas.szm.sk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002727; classtype:social-engineering; sid:6002727; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee2444.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopee2444.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002728; classtype:social-engineering; sid:6002728; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hkttxpayments.non-steam.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hkttxpayments.non-steam.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002729; classtype:social-engineering; sid:6002729; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qolnix-biz-vroltor-glantek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qolnix-biz-vroltor-glantek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002730; classtype:social-engineering; sid:6002730; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kqinbasepro_iogin.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kqinbasepro_iogin.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002731; classtype:social-engineering; sid:6002731; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-dravtem-biz-vrolnik-qarnex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-dravtem-biz-vrolnik-qarnex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002732; classtype:social-engineering; sid:6002732; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anttas.szm.sk/up/home.htm?fr2jp9yed0bg1b9dkaelargkxtzmpean6zq7qfk5c250ay2mj9)"; flow:established,to_server; http.uri; content:"/up/home.htm?fr2jp9yed0bg1b9dkaelargkxtzmpean6zq7qfk5c250ay2mj9"; startswith; fast_pattern; http.host; content:"anttas.szm.sk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002733; classtype:social-engineering; sid:6002733; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (admbyb.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"admbyb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002734; classtype:social-engineering; sid:6002734; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (generalhubservice.com/985205/)"; flow:established,to_server; http.uri; content:"/985205/"; startswith; fast_pattern; http.host; content:"generalhubservice.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002735; classtype:social-engineering; sid:6002735; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (top-top-rho.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"top-top-rho.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002736; classtype:social-engineering; sid:6002736; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.adminveri-forn.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.adminveri-forn.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002737; classtype:social-engineering; sid:6002737; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-glamtor-biz-vroltex-qarnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-glamtor-biz-vroltex-qarnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002738; classtype:social-engineering; sid:6002738; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qurnex-biz-slurnor-vrolax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qurnex-biz-slurnor-vrolax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002739; classtype:social-engineering; sid:6002739; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (22-abhi.github.io/netflix-clone-optimized)"; flow:established,to_server; http.uri; content:"/netflix-clone-optimized"; startswith; fast_pattern; http.host; content:"22-abhi.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002740; classtype:social-engineering; sid:6002740; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth-wetrhug.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auth-wetrhug.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002741; classtype:social-engineering; sid:6002741; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.amazonpk-clone.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazonpk-clone.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002742; classtype:social-engineering; sid:6002742; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.invfn.live/id/login)"; flow:established,to_server; http.uri; content:"/id/login"; startswith; fast_pattern; http.host; content:"www.invfn.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002743; classtype:social-engineering; sid:6002743; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maroon-info-652456.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"maroon-info-652456.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002744; classtype:social-engineering; sid:6002744; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (upce0.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"upce0.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002745; classtype:social-engineering; sid:6002745; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rwenzoritechub.com/doublec/po/rabi/v76IP9F/bm9taW5hdGluZ2NvbW1pdHRlZUB1a3JhaW5pYW5jdS5jb20=)"; flow:established,to_server; http.uri; content:"/doublec/po/rabi/v76IP9F/bm9taW5hdGluZ2NvbW1pdHRlZUB1a3JhaW5pYW5jdS5jb20="; startswith; fast_pattern; http.host; content:"rwenzoritechub.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002746; classtype:social-engineering; sid:6002746; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verifysbc-55787c.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"verifysbc-55787c.webflow.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002747; classtype:social-engineering; sid:6002747; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (io-coin-tracker.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"io-coin-tracker.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002748; classtype:social-engineering; sid:6002748; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prime-videofacture.com/suivi)"; flow:established,to_server; http.uri; content:"/suivi"; startswith; fast_pattern; http.host; content:"prime-videofacture.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002749; classtype:social-engineering; sid:6002749; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail--support.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webmail--support.framer.website"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002750; classtype:social-engineering; sid:6002750; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (informationenkontaktdkb1.sviluppo.host/de/content/login.php)"; flow:established,to_server; http.uri; content:"/de/content/login.php"; startswith; fast_pattern; http.host; content:"informationenkontaktdkb1.sviluppo.host"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002751; classtype:social-engineering; sid:6002751; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home-cdnblofin.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"home-cdnblofin.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002752; classtype:social-engineering; sid:6002752; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.realdecorralejo.com/cgi-admin/signer.html)"; flow:established,to_server; http.uri; content:"/cgi-admin/signer.html"; startswith; fast_pattern; http.host; content:"www.realdecorralejo.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002753; classtype:social-engineering; sid:6002753; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nhgo-2xnx-cw12.jennifer-jencrosslaw-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nhgo-2xnx-cw12.jennifer-jencrosslaw-com-s-account.workers.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002754; classtype:social-engineering; sid:6002754; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e-ucenje-fsb-hr.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e-ucenje-fsb-hr.framer.website"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002755; classtype:social-engineering; sid:6002755; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (indexmxhwnvfiu4wu29174vfm4odq2fqwt6pnfzup3iwdwxy.restaurantedugandolfo.com.br/404.html)"; flow:established,to_server; http.uri; content:"/404.html"; startswith; fast_pattern; http.host; content:"indexmxhwnvfiu4wu29174vfm4odq2fqwt6pnfzup3iwdwxy.restaurantedugandolfo.com.br"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002756; classtype:social-engineering; sid:6002756; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2802124695-tt76vnpt-invoice.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2802124695-tt76vnpt-invoice.framer.website"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002757; classtype:social-engineering; sid:6002757; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (safemanagementatforiawdfield.vu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"safemanagementatforiawdfield.vu"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002758; classtype:social-engineering; sid:6002758; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rhinomadeusainc.shop/index.php/campaigns/at92141hxec2a/web-version/py271ebhay099)"; flow:established,to_server; http.uri; content:"/index.php/campaigns/at92141hxec2a/web-version/py271ebhay099"; startswith; fast_pattern; http.host; content:"rhinomadeusainc.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002759; classtype:social-engineering; sid:6002759; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aetherion921.github.io/homepage-practice-project/)"; flow:established,to_server; http.uri; content:"/homepage-practice-project/"; startswith; fast_pattern; http.host; content:"aetherion921.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002760; classtype:social-engineering; sid:6002760; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dytaln.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dytaln.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002761; classtype:social-engineering; sid:6002761; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tiwdve.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tiwdve.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002762; classtype:social-engineering; sid:6002762; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17067.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17067.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002763; classtype:social-engineering; sid:6002763; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.t70r.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.t70r.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002764; classtype:social-engineering; sid:6002764; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.outconfiadd.webcindario.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.outconfiadd.webcindario.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002765; classtype:social-engineering; sid:6002765; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vofxuw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vofxuw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002766; classtype:social-engineering; sid:6002766; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x21d.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"x21d.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002767; classtype:social-engineering; sid:6002767; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.elxdnz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.elxdnz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002768; classtype:social-engineering; sid:6002768; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (grameenasevakendra.com/tobi/kl/lk/)"; flow:established,to_server; http.uri; content:"/tobi/kl/lk/"; startswith; fast_pattern; http.host; content:"grameenasevakendra.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002769; classtype:social-engineering; sid:6002769; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blockchnanlogin.gitbook.io/usa/)"; flow:established,to_server; http.uri; content:"/usa/"; startswith; fast_pattern; http.host; content:"blockchnanlogin.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002770; classtype:social-engineering; sid:6002770; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabet.galay.cam/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabet.galay.cam"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002771; classtype:social-engineering; sid:6002771; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15908.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15908.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002772; classtype:social-engineering; sid:6002772; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (markin.github.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"markin.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002773; classtype:social-engineering; sid:6002773; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gateway.breezehost.xyz/OE9D9ravE9vpi3v/)"; flow:established,to_server; http.uri; content:"/OE9D9ravE9vpi3v/"; startswith; fast_pattern; http.host; content:"gateway.breezehost.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002774; classtype:social-engineering; sid:6002774; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.arvjmx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.arvjmx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002775; classtype:social-engineering; sid:6002775; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bwrzke.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bwrzke.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002776; classtype:social-engineering; sid:6002776; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3659b.win/lottery.html)"; flow:established,to_server; http.uri; content:"/lottery.html"; startswith; fast_pattern; http.host; content:"3659b.win"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002777; classtype:social-engineering; sid:6002777; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zenin.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zenin.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002778; classtype:social-engineering; sid:6002778; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zicwxq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zicwxq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002779; classtype:social-engineering; sid:6002779; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tasuki.net/wp-content/meta-online-fb/login/)"; flow:established,to_server; http.uri; content:"/wp-content/meta-online-fb/login/"; startswith; fast_pattern; http.host; content:"tasuki.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002780; classtype:social-engineering; sid:6002780; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kjimpx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kjimpx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002781; classtype:social-engineering; sid:6002781; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (espaceclientorange.jimdofree.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"espaceclientorange.jimdofree.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002782; classtype:social-engineering; sid:6002782; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (postnlpakketten.beepleapp.eu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"postnlpakketten.beepleapp.eu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002783; classtype:social-engineering; sid:6002783; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roevalleyresort.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"roevalleyresort.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002784; classtype:social-engineering; sid:6002784; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17195.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17195.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002785; classtype:social-engineering; sid:6002785; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (narrenschlag.de/authl/)"; flow:established,to_server; http.uri; content:"/authl/"; startswith; fast_pattern; http.host; content:"narrenschlag.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002786; classtype:social-engineering; sid:6002786; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-main.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-main.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002787; classtype:social-engineering; sid:6002787; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jptxus.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jptxus.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002788; classtype:social-engineering; sid:6002788; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-plornik-biz-travqor-vrultek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-plornik-biz-travqor-vrultek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002789; classtype:social-engineering; sid:6002789; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lw.ldxbch.com/xinfinifix/xinfini/)"; flow:established,to_server; http.uri; content:"/xinfinifix/xinfini/"; startswith; fast_pattern; http.host; content:"lw.ldxbch.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002790; classtype:social-engineering; sid:6002790; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vrolnik-biz-glurnex-qortem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vrolnik-biz-glurnex-qortem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002791; classtype:social-engineering; sid:6002791; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cqsssnwtj.com/instert/login.in)"; flow:established,to_server; http.uri; content:"/instert/login.in"; startswith; fast_pattern; http.host; content:"cqsssnwtj.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002792; classtype:social-engineering; sid:6002792; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.fidgob.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.fidgob.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002793; classtype:social-engineering; sid:6002793; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (desktop-ledgre.zapier.app/live/)"; flow:established,to_server; http.uri; content:"/live/"; startswith; fast_pattern; http.host; content:"desktop-ledgre.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002794; classtype:social-engineering; sid:6002794; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflixclone-chi-ten.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflixclone-chi-ten.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002795; classtype:social-engineering; sid:6002795; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.aunyjl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.aunyjl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002796; classtype:social-engineering; sid:6002796; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-3iy3nxf8t.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-3iy3nxf8t.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002797; classtype:social-engineering; sid:6002797; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (887790.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"887790.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002798; classtype:social-engineering; sid:6002798; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mbauik.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mbauik.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002799; classtype:social-engineering; sid:6002799; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meetamaskcriptologin.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meetamaskcriptologin.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002800; classtype:social-engineering; sid:6002800; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pessoleldept.com/?r=5a30fa6a-7f58-4a98-aae0-7e4257f7cdd5)"; flow:established,to_server; http.uri; content:"/?r=5a30fa6a-7f58-4a98-aae0-7e4257f7cdd5"; startswith; fast_pattern; http.host; content:"pessoleldept.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002801; classtype:social-engineering; sid:6002801; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (swer-e7csdkeahwashebs.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"swer-e7csdkeahwashebs.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002802; classtype:social-engineering; sid:6002802; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jylxiq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jylxiq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002803; classtype:social-engineering; sid:6002803; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (msportal-pagos-grupos.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"msportal-pagos-grupos.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002804; classtype:social-engineering; sid:6002804; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (net-flix-verif.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"net-flix-verif.bolt.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002805; classtype:social-engineering; sid:6002805; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (outceb.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"outceb.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002806; classtype:social-engineering; sid:6002806; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.krmdhg.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.krmdhg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002807; classtype:social-engineering; sid:6002807; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.xbb.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.xbb.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002808; classtype:social-engineering; sid:6002808; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uhj-zgfcsa.wasmer.app/instapro)"; flow:established,to_server; http.uri; content:"/instapro"; startswith; fast_pattern; http.host; content:"uhj-zgfcsa.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002809; classtype:social-engineering; sid:6002809; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eng-ledgr-com.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eng-ledgr-com.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002810; classtype:social-engineering; sid:6002810; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (recent1.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"recent1.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002811; classtype:social-engineering; sid:6002811; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (darioandreella.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"darioandreella.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002812; classtype:social-engineering; sid:6002812; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreibeyykwgcztu75t7jipqbjliizpkwlkpdaqarxgmph35coirknoxu.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreibeyykwgcztu75t7jipqbjliizpkwlkpdaqarxgmph35coirknoxu.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002813; classtype:social-engineering; sid:6002813; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pc.fintrexc.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pc.fintrexc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002814; classtype:social-engineering; sid:6002814; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8847bet.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8847bet.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002815; classtype:social-engineering; sid:6002815; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dailyalokitodesh.com/cgi/service/maintain/update/webmin.html)"; flow:established,to_server; http.uri; content:"/cgi/service/maintain/update/webmin.html"; startswith; fast_pattern; http.host; content:"dailyalokitodesh.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002816; classtype:social-engineering; sid:6002816; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.galabet-tr158.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.galabet-tr158.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002817; classtype:social-engineering; sid:6002817; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.txqlrk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.txqlrk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002818; classtype:social-engineering; sid:6002818; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zdksqw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zdksqw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002819; classtype:social-engineering; sid:6002819; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (new-messeges-bird-dacc.kristina1080.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"new-messeges-bird-dacc.kristina1080.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002820; classtype:social-engineering; sid:6002820; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lfpnay.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lfpnay.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002821; classtype:social-engineering; sid:6002821; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zasebt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zasebt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002822; classtype:social-engineering; sid:6002822; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.vniswap-v3-interface.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.vniswap-v3-interface.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002823; classtype:social-engineering; sid:6002823; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gqowtm.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gqowtm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002824; classtype:social-engineering; sid:6002824; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.xlkgjb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.xlkgjb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002825; classtype:social-engineering; sid:6002825; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gtjzyv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gtjzyv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002826; classtype:social-engineering; sid:6002826; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gqtmprwa.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gqtmprwa.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002827; classtype:social-engineering; sid:6002827; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gebyarhadiah1010.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.gebyarhadiah1010.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002828; classtype:social-engineering; sid:6002828; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.epbiqk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.epbiqk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002829; classtype:social-engineering; sid:6002829; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tdqjmc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tdqjmc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002830; classtype:social-engineering; sid:6002830; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mtrxqvlp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mtrxqvlp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002831; classtype:social-engineering; sid:6002831; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stage.myfidelitysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"stage.myfidelitysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002832; classtype:social-engineering; sid:6002832; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.czplwnvr.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.czplwnvr.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002833; classtype:social-engineering; sid:6002833; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bdosqx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bdosqx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002834; classtype:social-engineering; sid:6002834; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.lzbhap.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.lzbhap.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002835; classtype:social-engineering; sid:6002835; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.igwrdq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.igwrdq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002836; classtype:social-engineering; sid:6002836; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.croatiapools.com/DK/DKB/dkb/login.php/)"; flow:established,to_server; http.uri; content:"/DK/DKB/dkb/login.php/"; startswith; fast_pattern; http.host; content:"www.croatiapools.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002837; classtype:social-engineering; sid:6002837; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-uh4bkufsi.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-uh4bkufsi.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002838; classtype:social-engineering; sid:6002838; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hg937.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hg937.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002839; classtype:social-engineering; sid:6002839; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.paypal-c.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.paypal-c.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002840; classtype:social-engineering; sid:6002840; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (combscustoms.com/instert/login.in)"; flow:established,to_server; http.uri; content:"/instert/login.in"; startswith; fast_pattern; http.host; content:"combscustoms.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002841; classtype:social-engineering; sid:6002841; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3115ss.cc/agent.html)"; flow:established,to_server; http.uri; content:"/agent.html"; startswith; fast_pattern; http.host; content:"3115ss.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002842; classtype:social-engineering; sid:6002842; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.plqcbj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.plqcbj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002843; classtype:social-engineering; sid:6002843; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jprzwlnq.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jprzwlnq.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002844; classtype:social-engineering; sid:6002844; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.mhjrai.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.mhjrai.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002845; classtype:social-engineering; sid:6002845; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.airbnb-style-clone.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.airbnb-style-clone.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002846; classtype:social-engineering; sid:6002846; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (golink.evn.my.id/JfkbL)"; flow:established,to_server; http.uri; content:"/JfkbL"; startswith; fast_pattern; http.host; content:"golink.evn.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002847; classtype:social-engineering; sid:6002847; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pyatmo.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pyatmo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002848; classtype:social-engineering; sid:6002848; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gezmvt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gezmvt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002849; classtype:social-engineering; sid:6002849; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jqliwz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jqliwz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002850; classtype:social-engineering; sid:6002850; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.irjboz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.irjboz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002851; classtype:social-engineering; sid:6002851; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bitoraexchange.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bitoraexchange.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002852; classtype:social-engineering; sid:6002852; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ueljtp.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ueljtp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002853; classtype:social-engineering; sid:6002853; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.cznlwrpt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.cznlwrpt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002854; classtype:social-engineering; sid:6002854; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fritzhost-001-site1.site4future.com/9HX0BJstlwqNOinTSZnTP7IUkFnJ8gmFqLB1C2XsPfeLzcAuZMFKKbYF2KanV3AcmKoHZlxLKBmpeX9aI6EGUaZ9bOutDx2b7CJt)"; flow:established,to_server; http.uri; content:"/9HX0BJstlwqNOinTSZnTP7IUkFnJ8gmFqLB1C2XsPfeLzcAuZMFKKbYF2KanV3AcmKoHZlxLKBmpeX9aI6EGUaZ9bOutDx2b7CJt"; startswith; fast_pattern; http.host; content:"fritzhost-001-site1.site4future.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002855; classtype:social-engineering; sid:6002855; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9000-firebase-cloudstorage-1777303669425.cluster-thle3dudhffpwss7zs5hxaeu2o.cloudworkstations.dev/?eta=%20elan@275a73551d9cb59ac300f755426c8fb5c115.com)"; flow:established,to_server; http.uri; content:"/?eta=%20elan@275a73551d9cb59ac300f755426c8fb5c115.com"; startswith; fast_pattern; http.host; content:"9000-firebase-cloudstorage-1777303669425.cluster-thle3dudhffpwss7zs5hxaeu2o.cloudworkstations.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002856; classtype:social-engineering; sid:6002856; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.keqmnh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.keqmnh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002857; classtype:social-engineering; sid:6002857; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.frwdit.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.frwdit.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002858; classtype:social-engineering; sid:6002858; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gqhbcl.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gqhbcl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002859; classtype:social-engineering; sid:6002859; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.shopledgerapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app.shopledgerapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002860; classtype:social-engineering; sid:6002860; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-glarnex-biz-slurnik-vrolax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-glarnex-biz-slurnik-vrolax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002861; classtype:social-engineering; sid:6002861; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rkqeaw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rkqeaw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002862; classtype:social-engineering; sid:6002862; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jwtxqlrp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jwtxqlrp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002863; classtype:social-engineering; sid:6002863; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365556.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365556.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002864; classtype:social-engineering; sid:6002864; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dancing-tapioca-a460d0.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dancing-tapioca-a460d0.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002865; classtype:social-engineering; sid:6002865; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.global-package-tracking.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.global-package-tracking.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002866; classtype:social-engineering; sid:6002866; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.oupjxt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.oupjxt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002867; classtype:social-engineering; sid:6002867; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.jbqspi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.jbqspi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002868; classtype:social-engineering; sid:6002868; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3115yy.cc/agent.html)"; flow:established,to_server; http.uri; content:"/agent.html"; startswith; fast_pattern; http.host; content:"3115yy.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002869; classtype:social-engineering; sid:6002869; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (holy-rain-1022.ceiltt0khkennedy42944.workers.dev/email-notification-meta-security-center)"; flow:established,to_server; http.uri; content:"/email-notification-meta-security-center"; startswith; fast_pattern; http.host; content:"holy-rain-1022.ceiltt0khkennedy42944.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002870; classtype:social-engineering; sid:6002870; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nikitatitung053.github.io/amazon_clone/)"; flow:established,to_server; http.uri; content:"/amazon_clone/"; startswith; fast_pattern; http.host; content:"nikitatitung053.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002871; classtype:social-engineering; sid:6002871; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater4.resmi-hkv2.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater4.resmi-hkv2.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002872; classtype:social-engineering; sid:6002872; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.blockex.world/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.blockex.world"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002873; classtype:social-engineering; sid:6002873; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qravnik-biz-glurnor-fraltex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qravnik-biz-glurnor-fraltex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002874; classtype:social-engineering; sid:6002874; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17065.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17065.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002875; classtype:social-engineering; sid:6002875; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.bvnwzqp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.bvnwzqp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002876; classtype:social-engineering; sid:6002876; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bnmhgy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bnmhgy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002877; classtype:social-engineering; sid:6002877; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiew7fbnac76pnq2nkw5you7mrwbzcgmgdb664vklfxmjb75p2xq2e.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiew7fbnac76pnq2nkw5you7mrwbzcgmgdb664vklfxmjb75p2xq2e.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002878; classtype:social-engineering; sid:6002878; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hvxsp.paskj.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hvxsp.paskj.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002879; classtype:social-engineering; sid:6002879; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xapp-inline105003.com/app/appline/)"; flow:established,to_server; http.uri; content:"/app/appline/"; startswith; fast_pattern; http.host; content:"xapp-inline105003.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002880; classtype:social-engineering; sid:6002880; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.deiwbc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.deiwbc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002881; classtype:social-engineering; sid:6002881; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.zfreyw.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.zfreyw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002882; classtype:social-engineering; sid:6002882; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (getrobux16win.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"getrobux16win.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002883; classtype:social-engineering; sid:6002883; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqznwptl.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqznwptl.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002884; classtype:social-engineering; sid:6002884; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marianne-docschiffre.leitungsen.de/mmssmaumaki/)"; flow:established,to_server; http.uri; content:"/mmssmaumaki/"; startswith; fast_pattern; http.host; content:"marianne-docschiffre.leitungsen.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002885; classtype:social-engineering; sid:6002885; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sanria40.github.io/Netflix-login-page-front-end-/)"; flow:established,to_server; http.uri; content:"/Netflix-login-page-front-end-/"; startswith; fast_pattern; http.host; content:"sanria40.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002886; classtype:social-engineering; sid:6002886; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.kdrmxv.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.kdrmxv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002887; classtype:social-engineering; sid:6002887; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.aoizrb.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.aoizrb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002888; classtype:social-engineering; sid:6002888; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.rqzlknwp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.rqzlknwp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002889; classtype:social-engineering; sid:6002889; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.top-top-rho.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.top-top-rho.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002890; classtype:social-engineering; sid:6002890; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.qgrbxs.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.qgrbxs.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002891; classtype:social-engineering; sid:6002891; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17054.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17054.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002892; classtype:social-engineering; sid:6002892; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flips.abuit.info/?app_vl=ZYFwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=tomek%40elt.pl&sui=%7Bsui%7D&fn=Piotr&ln=Maliszewski&p=&z=PLNAMERAW-3005-IND1)"; flow:established,to_server; http.uri; content:"/?app_vl=ZYFwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=tomek%40elt.pl&sui=%7Bsui%7D&fn=Piotr&ln=Maliszewski&p=&z=PLNAMERAW-3005-IND1"; startswith; fast_pattern; http.host; content:"flips.abuit.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002893; classtype:social-engineering; sid:6002893; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ycgvpx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ycgvpx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002894; classtype:social-engineering; sid:6002894; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreig5dqrnyeb7z4hoz3qqfkbfgtcppfxrafvarjmwisxplboureoesa.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreig5dqrnyeb7z4hoz3qqfkbfgtcppfxrafvarjmwisxplboureoesa.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002895; classtype:social-engineering; sid:6002895; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (peteradedokun1.github.io/netflix/)"; flow:established,to_server; http.uri; content:"/netflix/"; startswith; fast_pattern; http.host; content:"peteradedokun1.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002896; classtype:social-engineering; sid:6002896; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabetguncel.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabetguncel.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002897; classtype:social-engineering; sid:6002897; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ghtrack.help/gh)"; flow:established,to_server; http.uri; content:"/gh"; startswith; fast_pattern; http.host; content:"ghtrack.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002898; classtype:social-engineering; sid:6002898; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gfdtgbjas.itsaol.com/rmb)"; flow:established,to_server; http.uri; content:"/rmb"; startswith; fast_pattern; http.host; content:"gfdtgbjas.itsaol.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002899; classtype:social-engineering; sid:6002899; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bxcwun.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bxcwun.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002900; classtype:social-engineering; sid:6002900; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newseasonmaterials.web.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"newseasonmaterials.web.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002901; classtype:social-engineering; sid:6002901; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (falling-sea-cdd6.ceiltt0khkennedy42944.workers.dev/email-notification-meta-security-center)"; flow:established,to_server; http.uri; content:"/email-notification-meta-security-center"; startswith; fast_pattern; http.host; content:"falling-sea-cdd6.ceiltt0khkennedy42944.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002902; classtype:social-engineering; sid:6002902; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cq989737.tw1.ru/nqs/)"; flow:established,to_server; http.uri; content:"/nqs/"; startswith; fast_pattern; http.host; content:"cq989737.tw1.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002903; classtype:social-engineering; sid:6002903; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vniswap-v3-interface.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vniswap-v3-interface.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002904; classtype:social-engineering; sid:6002904; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.89240.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.89240.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002905; classtype:social-engineering; sid:6002905; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tvpxky.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tvpxky.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002906; classtype:social-engineering; sid:6002906; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.gfakcx.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.gfakcx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002907; classtype:social-engineering; sid:6002907; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (somesubhranayak.github.io/NETFLIX/)"; flow:established,to_server; http.uri; content:"/NETFLIX/"; startswith; fast_pattern; http.host; content:"somesubhranayak.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002908; classtype:social-engineering; sid:6002908; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.24ml.de/2q/)"; flow:established,to_server; http.uri; content:"/2q/"; startswith; fast_pattern; http.host; content:"www.24ml.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002909; classtype:social-engineering; sid:6002909; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clear-https-nrxwo2lofzzgc2lgmzsws43fnyxgg2a.proxy.gigablast.org/it?applicationId=ebanking)"; flow:established,to_server; http.uri; content:"/it?applicationId=ebanking"; startswith; fast_pattern; http.host; content:"clear-https-nrxwo2lofzzgc2lgmzsws43fnyxgg2a.proxy.gigablast.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002910; classtype:social-engineering; sid:6002910; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mlltop.com/content/boaml/en_us/home.html)"; flow:established,to_server; http.uri; content:"/content/boaml/en_us/home.html"; startswith; fast_pattern; http.host; content:"mlltop.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002911; classtype:social-engineering; sid:6002911; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.pqkamj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.pqkamj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002912; classtype:social-engineering; sid:6002912; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bet365k16.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bet365k16.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002913; classtype:social-engineering; sid:6002913; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-main.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-main.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002914; classtype:social-engineering; sid:6002914; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (148624343.hs-sites-eu1.com/it/)"; flow:established,to_server; http.uri; content:"/it/"; startswith; fast_pattern; http.host; content:"148624343.hs-sites-eu1.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002915; classtype:social-engineering; sid:6002915; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kf.ognnwn.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kf.ognnwn.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002916; classtype:social-engineering; sid:6002916; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingek.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingek.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002917; classtype:social-engineering; sid:6002917; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xghjc.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xghjc.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002918; classtype:social-engineering; sid:6002918; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-leger-us.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-leger-us.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002919; classtype:social-engineering; sid:6002919; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webauto.sk/js/body.html)"; flow:established,to_server; http.uri; content:"/js/body.html"; startswith; fast_pattern; http.host; content:"webauto.sk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002920; classtype:social-engineering; sid:6002920; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.yeplfz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.yeplfz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002921; classtype:social-engineering; sid:6002921; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mt-swift.com-ustf.us/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mt-swift.com-ustf.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002922; classtype:social-engineering; sid:6002922; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hgqdet.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hgqdet.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002923; classtype:social-engineering; sid:6002923; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hwspuy.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hwspuy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002924; classtype:social-engineering; sid:6002924; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hostmyclaudehtml.com/p/QU_im40Uxk)"; flow:established,to_server; http.uri; content:"/p/QU_im40Uxk"; startswith; fast_pattern; http.host; content:"hostmyclaudehtml.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002925; classtype:social-engineering; sid:6002925; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nysclj.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nysclj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002926; classtype:social-engineering; sid:6002926; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tonkotsutaro.info/41-1511-280526/?u=161C1515&e=test%2540example.com&s3=&s4=&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/41-1511-280526/?u=161C1515&e=test%2540example.com&s3=&s4=&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"tonkotsutaro.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002927; classtype:social-engineering; sid:6002927; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vrolor-biz-glurnik-slatem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vrolor-biz-glurnik-slatem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002928; classtype:social-engineering; sid:6002928; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiciaij2qznniztu7ofqnyoatv7tuuonnqbdm3v76jiqz3x2jhifka.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiciaij2qznniztu7ofqnyoatv7tuuonnqbdm3v76jiqz3x2jhifka.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002929; classtype:social-engineering; sid:6002929; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ldgrinyhgj.azalea1.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ldgrinyhgj.azalea1.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002930; classtype:social-engineering; sid:6002930; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.spotify-client-beta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.spotify-client-beta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002931; classtype:social-engineering; sid:6002931; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.84123.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.84123.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002932; classtype:social-engineering; sid:6002932; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rhfupq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rhfupq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002933; classtype:social-engineering; sid:6002933; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fotra-sentra-biz-lomra-dokfi-sp19ct3mur.pages.dev/*)"; flow:established,to_server; http.uri; content:"/*"; startswith; fast_pattern; http.host; content:"fotra-sentra-biz-lomra-dokfi-sp19ct3mur.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002934; classtype:social-engineering; sid:6002934; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeesale1010.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopeesale1010.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002935; classtype:social-engineering; sid:6002935; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (theatre.binaryinfohub.info/?app_vl=ZYFwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=user@example.com&sui=%7Bsui%7D&fn=&ln=&p=&z=PLNAMERAW-0106-digi9)"; flow:established,to_server; http.uri; content:"/?app_vl=ZYFwlHFpbWKEmLqxy5qmnnx0YsC2wa-TpaiVYsBxj2phmqOgnLFwrYw&e=user@example.com&sui=%7Bsui%7D&fn=&ln=&p=&z=PLNAMERAW-0106-digi9"; startswith; fast_pattern; http.host; content:"theatre.binaryinfohub.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002936; classtype:social-engineering; sid:6002936; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.sfrgmu.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.sfrgmu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002937; classtype:social-engineering; sid:6002937; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.ujpkfi.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.ujpkfi.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002938; classtype:social-engineering; sid:6002938; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (palakjha3004-ux.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"palakjha3004-ux.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002939; classtype:social-engineering; sid:6002939; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.squjwr.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.squjwr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002940; classtype:social-engineering; sid:6002940; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.eqfpgt.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.eqfpgt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002941; classtype:social-engineering; sid:6002941; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.tezjda.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.tezjda.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002942; classtype:social-engineering; sid:6002942; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3659o.win/lottery.html)"; flow:established,to_server; http.uri; content:"/lottery.html"; startswith; fast_pattern; http.host; content:"3659o.win"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002943; classtype:social-engineering; sid:6002943; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (platforms.markusscholz.info/ga/click/2-6761812-10-8903-17422-9574-49708d3a5d-195e42334e)"; flow:established,to_server; http.uri; content:"/ga/click/2-6761812-10-8903-17422-9574-49708d3a5d-195e42334e"; startswith; fast_pattern; http.host; content:"platforms.markusscholz.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002944; classtype:social-engineering; sid:6002944; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-trurnor-biz-qurnex-fraltem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-trurnor-biz-qurnex-fraltem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002945; classtype:social-engineering; sid:6002945; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.uvv.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.uvv.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002946; classtype:social-engineering; sid:6002946; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.vjigbn.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.vjigbn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002947; classtype:social-engineering; sid:6002947; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uyqtsm.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.uyqtsm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002948; classtype:social-engineering; sid:6002948; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ghtrack.buzz/gh)"; flow:established,to_server; http.uri; content:"/gh"; startswith; fast_pattern; http.host; content:"ghtrack.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002949; classtype:social-engineering; sid:6002949; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreidapp6cd2dymyd7jbl7xwpiqrdg77ldysyqrkzumqctmrvnldfjbq.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreidapp6cd2dymyd7jbl7xwpiqrdg77ldysyqrkzumqctmrvnldfjbq.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002950; classtype:social-engineering; sid:6002950; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fcs-gapxr.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fcs-gapxr.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002951; classtype:social-engineering; sid:6002951; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.stainedconcretefloorsbymichael.com/44dewp/bkd/)"; flow:established,to_server; http.uri; content:"/44dewp/bkd/"; startswith; fast_pattern; http.host; content:"www.stainedconcretefloorsbymichael.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002952; classtype:social-engineering; sid:6002952; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nljawh.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nljawh.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002953; classtype:social-engineering; sid:6002953; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gopay-help.official-ind0nesia-help.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gopay-help.official-ind0nesia-help.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002954; classtype:social-engineering; sid:6002954; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreihmdhypsmoquydwxxl6takzwne63rldqiphkgcmtztfvpx3yzmfpq.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreihmdhypsmoquydwxxl6takzwne63rldqiphkgcmtztfvpx3yzmfpq.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002955; classtype:social-engineering; sid:6002955; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agri-mobile4.bolt.host/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"agri-mobile4.bolt.host"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002956; classtype:social-engineering; sid:6002956; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atjimhaweralhwaaste40d3d.myclickfunnels.com/ficeally)"; flow:established,to_server; http.uri; content:"/ficeally"; startswith; fast_pattern; http.host; content:"atjimhaweralhwaaste40d3d.myclickfunnels.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002957; classtype:social-engineering; sid:6002957; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rodovias-dr9.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rodovias-dr9.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002958; classtype:social-engineering; sid:6002958; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faf-cuni-cz.bdpf-pf.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faf-cuni-cz.bdpf-pf.online"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002959; classtype:social-engineering; sid:6002959; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wearebio.com/.well-known/-/.dihhd/)"; flow:established,to_server; http.uri; content:"/.well-known/-/.dihhd/"; startswith; fast_pattern; http.host; content:"wearebio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002960; classtype:social-engineering; sid:6002960; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (psychiatria-kalisz.pl/wp-content/languages/DKB_new/loading_1.php)"; flow:established,to_server; http.uri; content:"/wp-content/languages/DKB_new/loading_1.php"; startswith; fast_pattern; http.host; content:"psychiatria-kalisz.pl"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002961; classtype:social-engineering; sid:6002961; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chatgpt.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chatgpt.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002962; classtype:social-engineering; sid:6002962; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ajustarnovastaxas.uk/?LY3gZd98O9bJ3ZVGiT6g)"; flow:established,to_server; http.uri; content:"/?LY3gZd98O9bJ3ZVGiT6g"; startswith; fast_pattern; http.host; content:"ajustarnovastaxas.uk"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002963; classtype:social-engineering; sid:6002963; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (idxbillings-567804.com/it-26/)"; flow:established,to_server; http.uri; content:"/it-26/"; startswith; fast_pattern; http.host; content:"idxbillings-567804.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002964; classtype:social-engineering; sid:6002964; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (information-ameli.help/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"information-ameli.help"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6002965; classtype:social-engineering; sid:6002965; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docusign-electronicsignature.remote-otp.com/ID74591NF/html/ap0785185?rid=oFMAfF5)"; flow:established,to_server; http.uri; content:"/ID74591NF/html/ap0785185?rid=oFMAfF5"; startswith; fast_pattern; http.host; content:"docusign-electronicsignature.remote-otp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002966; classtype:social-engineering; sid:6002966; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wetransfer-shares-documents-of-hzb.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wetransfer-shares-documents-of-hzb.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002967; classtype:social-engineering; sid:6002967; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pahdidj.one/gh)"; flow:established,to_server; http.uri; content:"/gh"; startswith; fast_pattern; http.host; content:"pahdidj.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002968; classtype:social-engineering; sid:6002968; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kqnlpwrt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kqnlpwrt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002969; classtype:social-engineering; sid:6002969; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeeid152.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopeeid152.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002970; classtype:social-engineering; sid:6002970; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiclx2rtmk2k77tsbghnjtvuk3tio7rsh6douxrekuvo4hkmogx7uy.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiclx2rtmk2k77tsbghnjtvuk3tio7rsh6douxrekuvo4hkmogx7uy.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002971; classtype:social-engineering; sid:6002971; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (awsapprunner-s0uth0dnscom-dp6hagq0og1y.edgeone.dev/webindex.html)"; flow:established,to_server; http.uri; content:"/webindex.html"; startswith; fast_pattern; http.host; content:"awsapprunner-s0uth0dnscom-dp6hagq0og1y.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002972; classtype:social-engineering; sid:6002972; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (perfilseleto.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"perfilseleto.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002973; classtype:social-engineering; sid:6002973; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.klxqmrvp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.klxqmrvp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002974; classtype:social-engineering; sid:6002974; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (158-158-8-83.cprapid.com/de/update.php?bnfv9ys33x7oz6zhe9ck)"; flow:established,to_server; http.uri; content:"/de/update.php?bnfv9ys33x7oz6zhe9ck"; startswith; fast_pattern; http.host; content:"158-158-8-83.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002975; classtype:social-engineering; sid:6002975; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hsyflq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hsyflq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002976; classtype:social-engineering; sid:6002976; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ntombifuthi-mashinini.github.io/Neflix-Landing-Page/)"; flow:established,to_server; http.uri; content:"/Neflix-Landing-Page/"; startswith; fast_pattern; http.host; content:"ntombifuthi-mashinini.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002977; classtype:social-engineering; sid:6002977; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mqtrvpkx.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mqtrvpkx.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002978; classtype:social-engineering; sid:6002978; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lnstagramchecker.github.io/AccCheck/)"; flow:established,to_server; http.uri; content:"/AccCheck/"; startswith; fast_pattern; http.host; content:"lnstagramchecker.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002979; classtype:social-engineering; sid:6002979; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (quitarbloqueocuenta.iceiy.com/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"quitarbloqueocuenta.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002980; classtype:social-engineering; sid:6002980; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (track.globaltracklabs.com/3d84a4ea-5516-4d68-a723-8d3512e364e6)"; flow:established,to_server; http.uri; content:"/3d84a4ea-5516-4d68-a723-8d3512e364e6"; startswith; fast_pattern; http.host; content:"track.globaltracklabs.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002981; classtype:social-engineering; sid:6002981; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja64.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja64.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002982; classtype:social-engineering; sid:6002982; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.35391986365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.35391986365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002983; classtype:social-engineering; sid:6002983; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x8pshdpfonzje43.s3-website-us-east-1.amazonaws.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"x8pshdpfonzje43.s3-website-us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002984; classtype:social-engineering; sid:6002984; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ushiejohn29-boop.github.io/on)"; flow:established,to_server; http.uri; content:"/on"; startswith; fast_pattern; http.host; content:"ushiejohn29-boop.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002985; classtype:social-engineering; sid:6002985; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6a018e4588b9f91c8adf0a0b--velvety-churros-49cd43.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6a018e4588b9f91c8adf0a0b--velvety-churros-49cd43.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002986; classtype:social-engineering; sid:6002986; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chrjtm.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chrjtm.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002987; classtype:social-engineering; sid:6002987; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-slavnik-biz-vroltex-glamtor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-slavnik-biz-vroltex-glamtor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002988; classtype:social-engineering; sid:6002988; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supersetapp.mystagingwebsite.com/wp-content/plugins/creative/public/index.php)"; flow:established,to_server; http.uri; content:"/wp-content/plugins/creative/public/index.php"; startswith; fast_pattern; http.host; content:"supersetapp.mystagingwebsite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002989; classtype:social-engineering; sid:6002989; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santander.atualizacao-seguranca.com/inicio/)"; flow:established,to_server; http.uri; content:"/inicio/"; startswith; fast_pattern; http.host; content:"santander.atualizacao-seguranca.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002990; classtype:social-engineering; sid:6002990; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (new-recovery.info-meta-noreply.com/pemulihan/code.php)"; flow:established,to_server; http.uri; content:"/pemulihan/code.php"; startswith; fast_pattern; http.host; content:"new-recovery.info-meta-noreply.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002991; classtype:social-engineering; sid:6002991; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.myfidelitysite.com/Deborah/deborah-heart---lung-center/13623)"; flow:established,to_server; http.uri; content:"/Deborah/deborah-heart---lung-center/13623"; startswith; fast_pattern; http.host; content:"www.myfidelitysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002992; classtype:social-engineering; sid:6002992; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suncoastcreditunion.at/login.php)"; flow:established,to_server; http.uri; content:"/login.php"; startswith; fast_pattern; http.host; content:"suncoastcreditunion.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002993; classtype:social-engineering; sid:6002993; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (teams.cloud-server.net.in/app/9TSMAH5wbCutuBSaCrMqQB)"; flow:established,to_server; http.uri; content:"/app/9TSMAH5wbCutuBSaCrMqQB"; startswith; fast_pattern; http.host; content:"teams.cloud-server.net.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002994; classtype:social-engineering; sid:6002994; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (noble-crimson-je1qnkwv.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"noble-crimson-je1qnkwv.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002995; classtype:social-engineering; sid:6002995; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (n44yg.app.link/hPm3PAV4O3b)"; flow:established,to_server; http.uri; content:"/hPm3PAV4O3b"; startswith; fast_pattern; http.host; content:"n44yg.app.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002996; classtype:social-engineering; sid:6002996; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloudoficial.com/cMKqu/)"; flow:established,to_server; http.uri; content:"/cMKqu/"; startswith; fast_pattern; http.host; content:"icloudoficial.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002997; classtype:social-engineering; sid:6002997; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (engagement-v3.mektor.eu/?auth2=ARFiHrqpCW9rM1XqEaXGJvSjjjr7trfS)"; flow:established,to_server; http.uri; content:"/?auth2=ARFiHrqpCW9rM1XqEaXGJvSjjjr7trfS"; startswith; fast_pattern; http.host; content:"engagement-v3.mektor.eu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002998; classtype:social-engineering; sid:6002998; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x.gd/Lafaj)"; flow:established,to_server; http.uri; content:"/Lafaj"; startswith; fast_pattern; http.host; content:"x.gd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6002999; classtype:social-engineering; sid:6002999; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (umusidiz.myhostpoint.ch/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"umusidiz.myhostpoint.ch"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003000; classtype:social-engineering; sid:6003000; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-d68525cbc6144dcaaac2fc0354aa17dd.r2.dev/New-DocusignRedir2.html)"; flow:established,to_server; http.uri; content:"/New-DocusignRedir2.html"; startswith; fast_pattern; http.host; content:"pub-d68525cbc6144dcaaac2fc0354aa17dd.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003001; classtype:social-engineering; sid:6003001; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8868v8.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8868v8.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003002; classtype:social-engineering; sid:6003002; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.gala-girisler.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.gala-girisler.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003003; classtype:social-engineering; sid:6003003; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (compact-tan-u27htcil.edgeone.app/?%24web_only=true&_branch_match_id=1593106289862315862&_branch_referrer=H4sIAAAAAAAAA8soKSkottLXzzMxqUzXSywo0MvJzMvWzwjINQ5wDDPxN06yrytKTUstKsrMS49PKsovL04tsnXOKMrPTQUANQ56qjwAAAA%3D)"; flow:established,to_server; http.uri; content:"/?%24web_only=true&_branch_match_id=1593106289862315862&_branch_referrer=H4sIAAAAAAAAA8soKSkottLXzzMxqUzXSywo0MvJzMvWzwjINQ5wDDPxN06yrytKTUstKsrMS49PKsovL04tsnXOKMrPTQUANQ56qjwAAAA%3D"; startswith; fast_pattern; http.host; content:"compact-tan-u27htcil.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003004; classtype:social-engineering; sid:6003004; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rnicrosoft-support.human-resources.services/i/a67010b9a3b8c49f89eca04a28761a129)"; flow:established,to_server; http.uri; content:"/i/a67010b9a3b8c49f89eca04a28761a129"; startswith; fast_pattern; http.host; content:"rnicrosoft-support.human-resources.services"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003005; classtype:social-engineering; sid:6003005; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t9jz-rz7w-mzfi.rsadler.workers.dev/885c4c3684518ddc?email=delexhub@74749dcf9f33ccdf898fcfc7af671045b691.net)"; flow:established,to_server; http.uri; content:"/885c4c3684518ddc?email=delexhub@74749dcf9f33ccdf898fcfc7af671045b691.net"; startswith; fast_pattern; http.host; content:"t9jz-rz7w-mzfi.rsadler.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003006; classtype:social-engineering; sid:6003006; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wilsonhousecamden.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wilsonhousecamden.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003007; classtype:social-engineering; sid:6003007; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kdzuwiojef.yoga/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kdzuwiojef.yoga"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003008; classtype:social-engineering; sid:6003008; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cpgtestwebapp.azurewebsites.net/wizard/start_submit)"; flow:established,to_server; http.uri; content:"/wizard/start_submit"; startswith; fast_pattern; http.host; content:"cpgtestwebapp.azurewebsites.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003009; classtype:social-engineering; sid:6003009; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cerberrtecrossmein.wasmer.app/checkout)"; flow:established,to_server; http.uri; content:"/checkout"; startswith; fast_pattern; http.host; content:"cerberrtecrossmein.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003010; classtype:social-engineering; sid:6003010; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (daanaiindonesiia.mll.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"daanaiindonesiia.mll.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003011; classtype:social-engineering; sid:6003011; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onedriveronedriveo.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"onedriveronedriveo.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003012; classtype:social-engineering; sid:6003012; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.enjscaffolding.co.uk/82F67135F75D00A/index.html)"; flow:established,to_server; http.uri; content:"/82F67135F75D00A/index.html"; startswith; fast_pattern; http.host; content:"www.enjscaffolding.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003013; classtype:social-engineering; sid:6003013; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.lmvxtrpq.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.lmvxtrpq.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003014; classtype:social-engineering; sid:6003014; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cautious-garbanzo-eight.vercel.app/mdatubinesocom2083.html)"; flow:established,to_server; http.uri; content:"/mdatubinesocom2083.html"; startswith; fast_pattern; http.host; content:"cautious-garbanzo-eight.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003015; classtype:social-engineering; sid:6003015; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (knowledgeable.edu.sa/profil/?id=lastupdate2026n3e05d)"; flow:established,to_server; http.uri; content:"/profil/?id=lastupdate2026n3e05d"; startswith; fast_pattern; http.host; content:"knowledgeable.edu.sa"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003016; classtype:social-engineering; sid:6003016; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hotelproorlandotrial-whatsapp.herokuapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hotelproorlandotrial-whatsapp.herokuapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003017; classtype:social-engineering; sid:6003017; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.progran-shopee14.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.progran-shopee14.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003018; classtype:social-engineering; sid:6003018; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.program-resmi189.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.program-resmi189.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003019; classtype:social-engineering; sid:6003019; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.assettradeinc.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.assettradeinc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003020; classtype:social-engineering; sid:6003020; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.txqmrlaq.cfd/com/#/index)"; flow:established,to_server; http.uri; content:"/com/#/index"; startswith; fast_pattern; http.host; content:"dpd.txqmrlaq.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003021; classtype:social-engineering; sid:6003021; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.js92266.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.js92266.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003022; classtype:social-engineering; sid:6003022; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreifuiu3tudoctwygusc7lktugtwmwhfh7uqn2xafijbcgvbtknc5tu.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreifuiu3tudoctwygusc7lktugtwmwhfh7uqn2xafijbcgvbtknc5tu.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003023; classtype:social-engineering; sid:6003023; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (piedrasdecolon.com.ar/docusign/DAM_Trade_Group_May-Contract.pdf)"; flow:established,to_server; http.uri; content:"/docusign/DAM_Trade_Group_May-Contract.pdf"; startswith; fast_pattern; http.host; content:"piedrasdecolon.com.ar"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003024; classtype:social-engineering; sid:6003024; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go.sparkpostmail1.com/f/a/3Mk15eaYdJlYKOgUjaHb5Q~~/AAW0yBA~/PSrbl-_NOQq9JJ9opDznwHLvqvcu6CJCkR8XfcIrYIG97QuV4CG67OhbZH6gUA4C1CT6Qwhtd4aQ_A4wyAwObDTqTiddKQE2Pa1BclMS8yJ0aE0g_f8piI0CTzVheqP2zKc8wAmynD75_JKWLwNLkKldpipJOTY085LlldBI5XVbD77CMyqq_cAEIklTv9cXV-Q3rnizn6fVGfOVXwLcYjtIyVMiAxtybKJUGQBuT5w~)"; flow:established,to_server; http.uri; content:"/f/a/3Mk15eaYdJlYKOgUjaHb5Q~~/AAW0yBA~/PSrbl-_NOQq9JJ9opDznwHLvqvcu6CJCkR8XfcIrYIG97QuV4CG67OhbZH6gUA4C1CT6Qwhtd4aQ_A4wyAwObDTqTiddKQE2Pa1BclMS8yJ0aE0g_f8piI0CTzVheqP2zKc8wAmynD75_JKWLwNLkKldpipJOTY085LlldBI5XVbD77CMyqq_cAEIklTv9cXV-Q3rnizn6fVGfOVXwLcYjtIyVMiAxtybKJUGQBuT5w~"; startswith; fast_pattern; http.host; content:"go.sparkpostmail1.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003025; classtype:social-engineering; sid:6003025; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.n-project-2025-netflix.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.n-project-2025-netflix.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003026; classtype:social-engineering; sid:6003026; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inicio-sesionverifimail829.zya.me/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"inicio-sesionverifimail829.zya.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003027; classtype:social-engineering; sid:6003027; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafybeiemb5z6so2dakuqswuqwoaoci3ifrulyygkdpoexmtv63lu4qrhai.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafybeiemb5z6so2dakuqswuqwoaoci3ifrulyygkdpoexmtv63lu4qrhai.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003028; classtype:social-engineering; sid:6003028; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook.mumbaiairlines.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook.mumbaiairlines.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003029; classtype:social-engineering; sid:6003029; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3capjiecp3qtjcx.s3-website-us-east-1.amazonaws.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3capjiecp3qtjcx.s3-website-us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003030; classtype:social-engineering; sid:6003030; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sporternaehrung-lambertz.de/jtl.php)"; flow:established,to_server; http.uri; content:"/jtl.php"; startswith; fast_pattern; http.host; content:"www.sporternaehrung-lambertz.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003031; classtype:social-engineering; sid:6003031; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (binancelivetrade.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"binancelivetrade.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003032; classtype:social-engineering; sid:6003032; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bussiness-center.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bussiness-center.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003033; classtype:social-engineering; sid:6003033; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jwrzqxlp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jwrzqxlp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003034; classtype:social-engineering; sid:6003034; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dbsbanklfc2025.com/?entity=31321)"; flow:established,to_server; http.uri; content:"/?entity=31321"; startswith; fast_pattern; http.host; content:"dbsbanklfc2025.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003035; classtype:social-engineering; sid:6003035; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hosxtk.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hosxtk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003036; classtype:social-engineering; sid:6003036; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-acco.github.io/insta/)"; flow:established,to_server; http.uri; content:"/insta/"; startswith; fast_pattern; http.host; content:"account-acco.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003037; classtype:social-engineering; sid:6003037; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bdlimon063-creator.github.io/facebook.com/)"; flow:established,to_server; http.uri; content:"/facebook.com/"; startswith; fast_pattern; http.host; content:"bdlimon063-creator.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003038; classtype:social-engineering; sid:6003038; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wang1-hhg8cfabceg7c4b6.z02.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wang1-hhg8cfabceg7c4b6.z02.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003039; classtype:social-engineering; sid:6003039; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hostingoo.sviluppo.host/ss/)"; flow:established,to_server; http.uri; content:"/ss/"; startswith; fast_pattern; http.host; content:"hostingoo.sviluppo.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003040; classtype:social-engineering; sid:6003040; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.84899286365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.84899286365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003041; classtype:social-engineering; sid:6003041; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sabapar22.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"sabapar22.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003042; classtype:social-engineering; sid:6003042; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (track-ghk.help/gh)"; flow:established,to_server; http.uri; content:"/gh"; startswith; fast_pattern; http.host; content:"track-ghk.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003043; classtype:social-engineering; sid:6003043; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1nstagra.mooo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1nstagra.mooo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003044; classtype:social-engineering; sid:6003044; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (by8662.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"by8662.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003045; classtype:social-engineering; sid:6003045; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook.mumbaiairlines.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook.mumbaiairlines.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003046; classtype:social-engineering; sid:6003046; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jzlwqntv.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jzlwqntv.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003047; classtype:social-engineering; sid:6003047; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-pi-nine.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-pi-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003048; classtype:social-engineering; sid:6003048; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.luagwq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.luagwq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003049; classtype:social-engineering; sid:6003049; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flirt-contacts.com/views/fb.php?lang=us&set=s2&domain=track.globaltracklabs.com&cep=TXrR0Fwoh-40RgZHMH8FEY5dqaICu2c47bG9mZhbgYdvw0LrP4tSOtFj7n0UJh9wLFHtK2HAt5hc6z8dya9mjn_HRoMOOYwfEf8Ut-nNhzGepjATSLlpBBNn9proUkRug9N-4ZCF1gEKjGhUi2wM7E34UAoNQx-zsqRfPzeb40_0WrBC6ew0C0vcn-EjFM34RGe6fFsWqaBqaftbUnxlHCezpg4-VWX_aOTs01OCAtQqPyOJac-hXlBzaFmucsvU2l7YtTclDWul9K0x1mKF-ToKdAHYEo3fTJfmeyqDNooEe9yL2kGrpvzQf0wtrih30Un2ZNlnibQTDGjKe0lXIcZXv9Ns1UcVzWY0Tp1yHK9YLI9ajrM4vrMlB7Cw1OXL&lptoken=17a1818506d5432a04dc)"; flow:established,to_server; http.uri; content:"/views/fb.php?lang=us&set=s2&domain=track.globaltracklabs.com&cep=TXrR0Fwoh-40RgZHMH8FEY5dqaICu2c47bG9mZhbgYdvw0LrP4tSOtFj7n0UJh9wLFHtK2HAt5hc6z8dya9mjn_HRoMOOYwfEf8Ut-nNhzGepjATSLlpBBNn9proUkRug9N-4ZCF1gEKjGhUi2wM7E34UAoNQx-zsqRfPzeb40_0WrBC6ew0C0vcn-EjFM34RGe6fFsWqaBqaftbUnxlHCezpg4-VWX_aOTs01OCAtQqPyOJac-hXlBzaFmucsvU2l7YtTclDWul9K0x1mKF-ToKdAHYEo3fTJfmeyqDNooEe9yL2kGrpvzQf0wtrih30Un2ZNlnibQTDGjKe0lXIcZXv9Ns1UcVzWY0Tp1yHK9YLI9ajrM4vrMlB7Cw1OXL&lptoken=17a1818506d5432a04dc"; startswith; fast_pattern; http.host; content:"flirt-contacts.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003050; classtype:social-engineering; sid:6003050; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (krishnanishad05.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"krishnanishad05.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003051; classtype:social-engineering; sid:6003051; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bunkbrisbane.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bunkbrisbane.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003052; classtype:social-engineering; sid:6003052; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bdi-mfghs.wasmer.app/eaglerefining)"; flow:established,to_server; http.uri; content:"/eaglerefining"; startswith; fast_pattern; http.host; content:"bdi-mfghs.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003053; classtype:social-engineering; sid:6003053; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verificar-s3guromxx.zya.me/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"verificar-s3guromxx.zya.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003054; classtype:social-engineering; sid:6003054; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeeid152.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopeeid152.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003055; classtype:social-engineering; sid:6003055; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-clone-teal-iota.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-teal-iota.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003056; classtype:social-engineering; sid:6003056; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creatinginfinity.github.io/Mini-Airbnb)"; flow:established,to_server; http.uri; content:"/Mini-Airbnb"; startswith; fast_pattern; http.host; content:"creatinginfinity.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003057; classtype:social-engineering; sid:6003057; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loandinvaliti.fwh.is/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"loandinvaliti.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003058; classtype:social-engineering; sid:6003058; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mitha-imascko-llgin.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mitha-imascko-llgin.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003059; classtype:social-engineering; sid:6003059; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rd8x6w8uco7mjx9.s3-website-us-east-1.amazonaws.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rd8x6w8uco7mjx9.s3-website-us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003060; classtype:social-engineering; sid:6003060; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (att03899.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"att03899.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003061; classtype:social-engineering; sid:6003061; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (office-docusign-net.tammy-e82.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"office-docusign-net.tammy-e82.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003062; classtype:social-engineering; sid:6003062; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (progran-shopee14.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"progran-shopee14.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003063; classtype:social-engineering; sid:6003063; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-netflix-clone-nine.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"my-netflix-clone-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003064; classtype:social-engineering; sid:6003064; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shorter.gg/VYxNEt)"; flow:established,to_server; http.uri; content:"/VYxNEt"; startswith; fast_pattern; http.host; content:"shorter.gg"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003065; classtype:social-engineering; sid:6003065; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinbaseru.ru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coinbaseru.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003066; classtype:social-engineering; sid:6003066; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabetbet.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabetbet.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003067; classtype:social-engineering; sid:6003067; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9000-firebase-ship-1779913820229.cluster-zti5ytzhlffjiqj6bp4giuli3u.cloudworkstations.dev/?monospaceUid=444857/)"; flow:established,to_server; http.uri; content:"/?monospaceUid=444857/"; startswith; fast_pattern; http.host; content:"9000-firebase-ship-1779913820229.cluster-zti5ytzhlffjiqj6bp4giuli3u.cloudworkstations.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003068; classtype:social-engineering; sid:6003068; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hvyasq.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hvyasq.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003069; classtype:social-engineering; sid:6003069; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (selalu.me/rhS7B5)"; flow:established,to_server; http.uri; content:"/rhS7B5"; startswith; fast_pattern; http.host; content:"selalu.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003070; classtype:social-engineering; sid:6003070; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ortonhall.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ortonhall.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003071; classtype:social-engineering; sid:6003071; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vpu9v6w044xfmvu.s3-website-us-east-1.amazonaws.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vpu9v6w044xfmvu.s3-website-us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003072; classtype:social-engineering; sid:6003072; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kltqvxtp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kltqvxtp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003073; classtype:social-engineering; sid:6003073; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (au2n02frx5v32wo.s3-website-us-east-1.amazonaws.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"au2n02frx5v32wo.s3-website-us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003074; classtype:social-engineering; sid:6003074; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-resmi189.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"program-resmi189.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003075; classtype:social-engineering; sid:6003075; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (temiloluwatestimony981-create.github.io/Netflix/)"; flow:established,to_server; http.uri; content:"/Netflix/"; startswith; fast_pattern; http.host; content:"temiloluwatestimony981-create.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003076; classtype:social-engineering; sid:6003076; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mxtqvrlp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mxtqvrlp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003077; classtype:social-engineering; sid:6003077; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alameenmuhd1.github.io/NetflixHomepage/)"; flow:established,to_server; http.uri; content:"/NetflixHomepage/"; startswith; fast_pattern; http.host; content:"alameenmuhd1.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003078; classtype:social-engineering; sid:6003078; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.opensea-mintslive98.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.opensea-mintslive98.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003079; classtype:social-engineering; sid:6003079; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-132755649dce44fe95257f08abf4c1b6.r2.dev/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-132755649dce44fe95257f08abf4c1b6.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003080; classtype:social-engineering; sid:6003080; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ep-it-mq5kky6hr1dw3-b0gbaad7eghchacz.z02.azurefd.net/Win20Errfb020/index.html)"; flow:established,to_server; http.uri; content:"/Win20Errfb020/index.html"; startswith; fast_pattern; http.host; content:"ep-it-mq5kky6hr1dw3-b0gbaad7eghchacz.z02.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003081; classtype:social-engineering; sid:6003081; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xyros-01.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"xyros-01.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003082; classtype:social-engineering; sid:6003082; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.mqvzlxpt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.mqvzlxpt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003083; classtype:social-engineering; sid:6003083; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (raniattri.github.io/amazon-clone-project)"; flow:established,to_server; http.uri; content:"/amazon-clone-project"; startswith; fast_pattern; http.host; content:"raniattri.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003084; classtype:social-engineering; sid:6003084; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (leeabbeylondon.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"leeabbeylondon.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003085; classtype:social-engineering; sid:6003085; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qevvax.courses/75775dd/)"; flow:established,to_server; http.uri; content:"/75775dd/"; startswith; fast_pattern; http.host; content:"qevvax.courses"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003086; classtype:social-engineering; sid:6003086; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.next-netflix-23rd-kappa.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.next-netflix-23rd-kappa.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003087; classtype:social-engineering; sid:6003087; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chrome-extension-dfhsdfhjgsjsgjsyuou.airdrop.investments/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chrome-extension-dfhsdfhjgsjsgjsyuou.airdrop.investments"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003088; classtype:social-engineering; sid:6003088; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pnelcds.ezzzybos.us/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pnelcds.ezzzybos.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003089; classtype:social-engineering; sid:6003089; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agrotrade.co.in/g/ddfghhj/gffg/alibaba/)"; flow:established,to_server; http.uri; content:"/g/ddfghhj/gffg/alibaba/"; startswith; fast_pattern; http.host; content:"agrotrade.co.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003090; classtype:social-engineering; sid:6003090; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (occidentes.web-colombia.org/occidente/)"; flow:established,to_server; http.uri; content:"/occidente/"; startswith; fast_pattern; http.host; content:"occidentes.web-colombia.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003091; classtype:social-engineering; sid:6003091; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bill.remote-otp.com/?rid=jY2jrPo)"; flow:established,to_server; http.uri; content:"/?rid=jY2jrPo"; startswith; fast_pattern; http.host; content:"bill.remote-otp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003092; classtype:social-engineering; sid:6003092; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bcpaym.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bcpaym.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003093; classtype:social-engineering; sid:6003093; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blockfi-docs-net.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"blockfi-docs-net.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003094; classtype:social-engineering; sid:6003094; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram.sitaci.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram.sitaci.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003095; classtype:social-engineering; sid:6003095; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (track-ghk.top/gh)"; flow:established,to_server; http.uri; content:"/gh"; startswith; fast_pattern; http.host; content:"track-ghk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003096; classtype:social-engineering; sid:6003096; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sparkasseonline.my/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.sparkasseonline.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003097; classtype:social-engineering; sid:6003097; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cargacartola.timdai.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cargacartola.timdai.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003098; classtype:social-engineering; sid:6003098; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vgsgu2.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vgsgu2.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003099; classtype:social-engineering; sid:6003099; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (refacture-video.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"refacture-video.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003100; classtype:social-engineering; sid:6003100; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dwgr-8ug8-53to.rsadler.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dwgr-8ug8-53to.rsadler.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003101; classtype:social-engineering; sid:6003101; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreieumvwdihpbpflkla34r6jdnugdqpa2wwpq44qwfjchmm36g76z4i.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreieumvwdihpbpflkla34r6jdnugdqpa2wwpq44qwfjchmm36g76z4i.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003102; classtype:social-engineering; sid:6003102; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acopadomundoestaaivaiperde.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"acopadomundoestaaivaiperde.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003103; classtype:social-engineering; sid:6003103; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (softmicro.s3-website-us-east-1.amazonaws.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"softmicro.s3-website-us-east-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003104; classtype:social-engineering; sid:6003104; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.nwrqlptg.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.nwrqlptg.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003105; classtype:social-engineering; sid:6003105; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ilbcedu01mm.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ilbcedu01mm.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003106; classtype:social-engineering; sid:6003106; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (105655777.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"105655777.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003107; classtype:social-engineering; sid:6003107; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (twinkle-14.github.io/Movie-clone/)"; flow:established,to_server; http.uri; content:"/Movie-clone/"; startswith; fast_pattern; http.host; content:"twinkle-14.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003108; classtype:social-engineering; sid:6003108; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.kqrlpvat.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.kqrlpvat.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003109; classtype:social-engineering; sid:6003109; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (office-document-sign.tammy-e82.workers.dev/app)"; flow:established,to_server; http.uri; content:"/app"; startswith; fast_pattern; http.host; content:"office-document-sign.tammy-e82.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003110; classtype:social-engineering; sid:6003110; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myubs.ch-account.com/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"myubs.ch-account.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003111; classtype:social-engineering; sid:6003111; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usadailyletter.com/Pu/diff.html)"; flow:established,to_server; http.uri; content:"/Pu/diff.html"; startswith; fast_pattern; http.host; content:"usadailyletter.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003112; classtype:social-engineering; sid:6003112; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roank029.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"roank029.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003113; classtype:social-engineering; sid:6003113; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (track-ghk.click/gh)"; flow:established,to_server; http.uri; content:"/gh"; startswith; fast_pattern; http.host; content:"track-ghk.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003114; classtype:social-engineering; sid:6003114; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kajendiranm.github.io/Airbnb-Clone/)"; flow:established,to_server; http.uri; content:"/Airbnb-Clone/"; startswith; fast_pattern; http.host; content:"kajendiranm.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003115; classtype:social-engineering; sid:6003115; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rnejda.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rnejda.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003116; classtype:social-engineering; sid:6003116; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.surl.lu/kfniiu/)"; flow:established,to_server; http.uri; content:"/kfniiu/"; startswith; fast_pattern; http.host; content:"www.surl.lu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003117; classtype:social-engineering; sid:6003117; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eri0-dreayi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eri0-dreayi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003118; classtype:social-engineering; sid:6003118; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.pnzlwrqt.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.pnzlwrqt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003119; classtype:social-engineering; sid:6003119; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (admin.nbgstravel.co.za/redirec.htm)"; flow:established,to_server; http.uri; content:"/redirec.htm"; startswith; fast_pattern; http.host; content:"admin.nbgstravel.co.za"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003120; classtype:social-engineering; sid:6003120; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (officeally.mystagingwebsite.com/wp-content/plugins/agoriasuio/public/index.php)"; flow:established,to_server; http.uri; content:"/wp-content/plugins/agoriasuio/public/index.php"; startswith; fast_pattern; http.host; content:"officeally.mystagingwebsite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003121; classtype:social-engineering; sid:6003121; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cripthub.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cripthub.org"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003122; classtype:social-engineering; sid:6003122; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rebbywllet.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"rebbywllet.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003123; classtype:social-engineering; sid:6003123; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home-rubyycdn.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"home-rubyycdn.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003124; classtype:social-engineering; sid:6003124; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.redirection-france-colis.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.redirection-france-colis.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003125; classtype:social-engineering; sid:6003125; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (extensionwalletio.wixstudio.com/myextension)"; flow:established,to_server; http.uri; content:"/myextension"; startswith; fast_pattern; http.host; content:"extensionwalletio.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003126; classtype:social-engineering; sid:6003126; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c4ksw3.cfd/o/ws6l0/1768848617406)"; flow:established,to_server; http.uri; content:"/o/ws6l0/1768848617406"; startswith; fast_pattern; http.host; content:"c4ksw3.cfd"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003127; classtype:social-engineering; sid:6003127; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.40023i-s.shop/login.html)"; flow:established,to_server; http.uri; content:"/login.html"; startswith; fast_pattern; http.host; content:"allegro.40023i-s.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003128; classtype:social-engineering; sid:6003128; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eng-rabby.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eng-rabby.wasmer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003129; classtype:social-engineering; sid:6003129; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rabbe-extension.wixstudio.com/rabby-en)"; flow:established,to_server; http.uri; content:"/rabby-en"; startswith; fast_pattern; http.host; content:"rabbe-extension.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003130; classtype:social-engineering; sid:6003130; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (us-rabbyy.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"us-rabbyy.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003131; classtype:social-engineering; sid:6003131; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (homepage-rabbycdn.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"homepage-rabbycdn.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003132; classtype:social-engineering; sid:6003132; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trade-rabbyapps.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"trade-rabbyapps.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003133; classtype:social-engineering; sid:6003133; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (desktopap-live.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"desktopap-live.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003134; classtype:social-engineering; sid:6003134; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appstarted-ledgro.wixstudio.com/start)"; flow:established,to_server; http.uri; content:"/start"; startswith; fast_pattern; http.host; content:"appstarted-ledgro.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003135; classtype:social-engineering; sid:6003135; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (author-3lx.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"author-3lx.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003136; classtype:social-engineering; sid:6003136; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-login-page-two.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-login-page-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003137; classtype:social-engineering; sid:6003137; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rxppyy.github.io/discord-web)"; flow:established,to_server; http.uri; content:"/discord-web"; startswith; fast_pattern; http.host; content:"rxppyy.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003138; classtype:social-engineering; sid:6003138; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-eng-ndax---cdn-authh.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso-eng-ndax---cdn-authh.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003139; classtype:social-engineering; sid:6003139; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.osbjlt.shop/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.osbjlt.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003140; classtype:social-engineering; sid:6003140; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (httpssbc-net-signin.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"httpssbc-net-signin.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003141; classtype:social-engineering; sid:6003141; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kasmli313univ.github.io/bodanovismartoce/)"; flow:established,to_server; http.uri; content:"/bodanovismartoce/"; startswith; fast_pattern; http.host; content:"kasmli313univ.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003142; classtype:social-engineering; sid:6003142; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.creditoahoraconbdvenlinea.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.creditoahoraconbdvenlinea.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003143; classtype:social-engineering; sid:6003143; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (browse.sdton.info/ga/click/2-8871055-13-9888-19327-10831-91b6c4e01f-afed3a2c44/)"; flow:established,to_server; http.uri; content:"/ga/click/2-8871055-13-9888-19327-10831-91b6c4e01f-afed3a2c44/"; startswith; fast_pattern; http.host; content:"browse.sdton.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003144; classtype:social-engineering; sid:6003144; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (srv1540807.hstgr.cloud/wp-content/upgrade/home/login.html)"; flow:established,to_server; http.uri; content:"/wp-content/upgrade/home/login.html"; startswith; fast_pattern; http.host; content:"srv1540807.hstgr.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003145; classtype:social-engineering; sid:6003145; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (psee.io/96lbzj)"; flow:established,to_server; http.uri; content:"/96lbzj"; startswith; fast_pattern; http.host; content:"psee.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003146; classtype:social-engineering; sid:6003146; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.wojiaogg.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login.wojiaogg.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003147; classtype:social-engineering; sid:6003147; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lazaro277.github.io/spotify)"; flow:established,to_server; http.uri; content:"/spotify"; startswith; fast_pattern; http.host; content:"lazaro277.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003148; classtype:social-engineering; sid:6003148; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (underwave.digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"underwave.digital"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003149; classtype:social-engineering; sid:6003149; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abbey88bmuwatruc7-0fkvvedfqvd7mcbqx0sedb.vercel.app/bsaehwa34rhbsdfbda32s.html/)"; flow:established,to_server; http.uri; content:"/bsaehwa34rhbsdfbda32s.html/"; startswith; fast_pattern; http.host; content:"abbey88bmuwatruc7-0fkvvedfqvd7mcbqx0sedb.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003150; classtype:social-engineering; sid:6003150; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee1929.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopee1929.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003151; classtype:social-engineering; sid:6003151; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.web-git-06-09-fixwebtdpallnetworksoptionupdatest-619c96-uniswap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.web-git-06-09-fixwebtdpallnetworksoptionupdatest-619c96-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003152; classtype:social-engineering; sid:6003152; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creditoahoraconbdvenlinea.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"creditoahoraconbdvenlinea.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003153; classtype:social-engineering; sid:6003153; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (l6angk.top/o/ws6l0/1768848617406#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/ws6l0/1768848617406#selectedbank9"; startswith; fast_pattern; http.host; content:"l6angk.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003154; classtype:social-engineering; sid:6003154; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tiny.cc/jd94101/)"; flow:established,to_server; http.uri; content:"/jd94101/"; startswith; fast_pattern; http.host; content:"www.tiny.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003155; classtype:social-engineering; sid:6003155; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct6-dranik-biz-plurnor-fralqax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct6-dranik-biz-plurnor-fralqax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003156; classtype:social-engineering; sid:6003156; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sxteamcotmmunity.com/3757459994)"; flow:established,to_server; http.uri; content:"/3757459994"; startswith; fast_pattern; http.host; content:"sxteamcotmmunity.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003157; classtype:social-engineering; sid:6003157; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ravlix-biz-sentox-1425.pages.dev/heartily_welcome?id=103892392070173&page_name=Monica%20A%20Garcia/)"; flow:established,to_server; http.uri; content:"/heartily_welcome?id=103892392070173&page_name=Monica%20A%20Garcia/"; startswith; fast_pattern; http.host; content:"ravlix-biz-sentox-1425.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003158; classtype:social-engineering; sid:6003158; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fdsbu.forms.marketingsbu.com.uy/panel/login)"; flow:established,to_server; http.uri; content:"/panel/login"; startswith; fast_pattern; http.host; content:"fdsbu.forms.marketingsbu.com.uy"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003159; classtype:social-engineering; sid:6003159; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (track.amplatzgiving.info/ga/click/2-17094644-21-10227-20003-11079-6e0e4443c1-aa5d763999)"; flow:established,to_server; http.uri; content:"/ga/click/2-17094644-21-10227-20003-11079-6e0e4443c1-aa5d763999"; startswith; fast_pattern; http.host; content:"track.amplatzgiving.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003160; classtype:social-engineering; sid:6003160; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.zeropayment.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.zeropayment.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003161; classtype:social-engineering; sid:6003161; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.blueatlastesting.com/slonearchitects/)"; flow:established,to_server; http.uri; content:"/slonearchitects/"; startswith; fast_pattern; http.host; content:"www.blueatlastesting.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003162; classtype:social-engineering; sid:6003162; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (140bae.senes.at/bncearn/incnb.php/)"; flow:established,to_server; http.uri; content:"/bncearn/incnb.php/"; startswith; fast_pattern; http.host; content:"140bae.senes.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003163; classtype:social-engineering; sid:6003163; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sharepoint-upload-ndlv.donnelcady1.workers.dev/l/O8kUZFH377s)"; flow:established,to_server; http.uri; content:"/l/O8kUZFH377s"; startswith; fast_pattern; http.host; content:"sharepoint-upload-ndlv.donnelcady1.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003164; classtype:social-engineering; sid:6003164; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trplochu.carroll-230.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trplochu.carroll-230.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003165; classtype:social-engineering; sid:6003165; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reactjsinstagramclone.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"reactjsinstagramclone.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003166; classtype:social-engineering; sid:6003166; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (afnansaqib52-cpu.github.io/-amazon-clone-)"; flow:established,to_server; http.uri; content:"/-amazon-clone-"; startswith; fast_pattern; http.host; content:"afnansaqib52-cpu.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003167; classtype:social-engineering; sid:6003167; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-login-page-two.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-login-page-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003168; classtype:social-engineering; sid:6003168; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (se.nm.gnfkg.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"se.nm.gnfkg.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003169; classtype:social-engineering; sid:6003169; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onlineausde.andhrauniversity.edu.in/studentLogin/Payments/)"; flow:established,to_server; http.uri; content:"/studentLogin/Payments/"; startswith; fast_pattern; http.host; content:"onlineausde.andhrauniversity.edu.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003170; classtype:social-engineering; sid:6003170; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (payal135001-ship-it.github.io/amazon-project/)"; flow:established,to_server; http.uri; content:"/amazon-project/"; startswith; fast_pattern; http.host; content:"payal135001-ship-it.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003171; classtype:social-engineering; sid:6003171; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreidgb26kajtcksilisi2oifeijkz3hrctc4n7v2awrlqq4h7yv65le.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreidgb26kajtcksilisi2oifeijkz3hrctc4n7v2awrlqq4h7yv65le.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003172; classtype:social-engineering; sid:6003172; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (authorizedfixednode.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"authorizedfixednode.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003173; classtype:social-engineering; sid:6003173; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h5mijp.cfd/o/ws6l0/1768848617406#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/ws6l0/1768848617406#selectedbank9"; startswith; fast_pattern; http.host; content:"h5mijp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003174; classtype:social-engineering; sid:6003174; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pljnsad.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pljnsad.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003175; classtype:social-engineering; sid:6003175; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (o1p2x9d.lol/o/ws6l0/1768848617406#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/ws6l0/1768848617406#selectedbank9"; startswith; fast_pattern; http.host; content:"o1p2x9d.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003176; classtype:social-engineering; sid:6003176; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-clone-zeta-five.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-zeta-five.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003177; classtype:social-engineering; sid:6003177; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sikel-corn-sans.click/m/V5wc8ZpFM0osINI2-yMie5av)"; flow:established,to_server; http.uri; content:"/m/V5wc8ZpFM0osINI2-yMie5av"; startswith; fast_pattern; http.host; content:"sikel-corn-sans.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003178; classtype:social-engineering; sid:6003178; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (youngs147.courvillemayarde-wj-r-c4072.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"youngs147.courvillemayarde-wj-r-c4072.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003179; classtype:social-engineering; sid:6003179; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adithyac18.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"adithyac18.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003180; classtype:social-engineering; sid:6003180; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rodoviasdobrasil.digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rodoviasdobrasil.digital"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003181; classtype:social-engineering; sid:6003181; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (madeforthis.s-ed1.cloud.gcore.lu/xls/review-file.html)"; flow:established,to_server; http.uri; content:"/xls/review-file.html"; startswith; fast_pattern; http.host; content:"madeforthis.s-ed1.cloud.gcore.lu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003182; classtype:social-engineering; sid:6003182; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinbase_x_login.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coinbase_x_login.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003183; classtype:social-engineering; sid:6003183; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-clone-login.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-clone-login.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003184; classtype:social-engineering; sid:6003184; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-delta-two.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-delta-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003185; classtype:social-engineering; sid:6003185; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-git-arc-chain-support-uniswap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-git-arc-chain-support-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003186; classtype:social-engineering; sid:6003186; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (czxiqmvqgnsjnfkdj-gijoxucfyu5dwno1ulmt0m.vercel.app/bsaehwa34rhbsdfbda32s)"; flow:established,to_server; http.uri; content:"/bsaehwa34rhbsdfbda32s"; startswith; fast_pattern; http.host; content:"czxiqmvqgnsjnfkdj-gijoxucfyu5dwno1ulmt0m.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003187; classtype:social-engineering; sid:6003187; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (giftshopee79.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"giftshopee79.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003188; classtype:social-engineering; sid:6003188; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.eri0-dreayi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.eri0-dreayi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003189; classtype:social-engineering; sid:6003189; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shex7amuu-cmd.github.io/Apple)"; flow:established,to_server; http.uri; content:"/Apple"; startswith; fast_pattern; http.host; content:"shex7amuu-cmd.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003190; classtype:social-engineering; sid:6003190; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagramclone-umber.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagramclone-umber.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003191; classtype:social-engineering; sid:6003191; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-drab-nu.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-drab-nu.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003192; classtype:social-engineering; sid:6003192; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store.communitysectionsgames.shop/workshop/AK47-EternalDecay/)"; flow:established,to_server; http.uri; content:"/workshop/AK47-EternalDecay/"; startswith; fast_pattern; http.host; content:"store.communitysectionsgames.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003193; classtype:social-engineering; sid:6003193; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutsch.srvc-de834294.info/getpaymentm/226332644/m9)"; flow:established,to_server; http.uri; content:"/getpaymentm/226332644/m9"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutsch.srvc-de834294.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003194; classtype:social-engineering; sid:6003194; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (codenf.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"codenf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003195; classtype:social-engineering; sid:6003195; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vmozass.info/m/9JsKA9r3THwO7rlB27h0CbQb)"; flow:established,to_server; http.uri; content:"/m/9JsKA9r3THwO7rlB27h0CbQb"; startswith; fast_pattern; http.host; content:"vmozass.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003196; classtype:social-engineering; sid:6003196; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netcoins-login-sso-ca-x.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netcoins-login-sso-ca-x.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003197; classtype:social-engineering; sid:6003197; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (109tyesy.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"109tyesy.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003198; classtype:social-engineering; sid:6003198; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metameaslogiz.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metameaslogiz.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003199; classtype:social-engineering; sid:6003199; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-clone-xi-one.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-clone-xi-one.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003200; classtype:social-engineering; sid:6003200; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutsch.id90617.info/getpaymentm/216827172/m9)"; flow:established,to_server; http.uri; content:"/getpaymentm/216827172/m9"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutsch.id90617.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003201; classtype:social-engineering; sid:6003201; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-drab-nu.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-drab-nu.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003202; classtype:social-engineering; sid:6003202; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.munhdl.shop/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.munhdl.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003203; classtype:social-engineering; sid:6003203; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yxd2-wdbf-hch6.piyush-goti-soilengineersltd-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yxd2-wdbf-hch6.piyush-goti-soilengineersltd-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003204; classtype:social-engineering; sid:6003204; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.00057365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.00057365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003205; classtype:social-engineering; sid:6003205; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee1929.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.shopee1929.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003206; classtype:social-engineering; sid:6003206; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.25365x.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.25365x.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003207; classtype:social-engineering; sid:6003207; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.crestpointivsbk.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.crestpointivsbk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003208; classtype:social-engineering; sid:6003208; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreig6osgy7ndyfux3ma7lukuwogvviqc6nmpd62qrsvsamsgzg5hawa.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreig6osgy7ndyfux3ma7lukuwogvviqc6nmpd62qrsvsamsgzg5hawa.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003209; classtype:social-engineering; sid:6003209; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (msquarantainedmail.business-insights.live/wwwbp9005c6diurl/)"; flow:established,to_server; http.uri; content:"/wwwbp9005c6diurl/"; startswith; fast_pattern; http.host; content:"msquarantainedmail.business-insights.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003210; classtype:social-engineering; sid:6003210; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-coral-iota.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-coral-iota.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003211; classtype:social-engineering; sid:6003211; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dm8576.github.io/Amezon/)"; flow:established,to_server; http.uri; content:"/Amezon/"; startswith; fast_pattern; http.host; content:"dm8576.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003212; classtype:social-engineering; sid:6003212; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (page-roblox.com/users/257334741403/profile)"; flow:established,to_server; http.uri; content:"/users/257334741403/profile"; startswith; fast_pattern; http.host; content:"page-roblox.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003213; classtype:social-engineering; sid:6003213; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (68-210-204-122.cprapid.com/ch/update.php?gypf82q129bd8admgvjl)"; flow:established,to_server; http.uri; content:"/ch/update.php?gypf82q129bd8admgvjl"; startswith; fast_pattern; http.host; content:"68-210-204-122.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003214; classtype:social-engineering; sid:6003214; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (purple-beach-0cc85d910.7.azurestaticapps.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"purple-beach-0cc85d910.7.azurestaticapps.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003215; classtype:social-engineering; sid:6003215; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.bucota.shop/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.bucota.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003216; classtype:social-engineering; sid:6003216; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (track-device.help/QwJ)"; flow:established,to_server; http.uri; content:"/QwJ"; startswith; fast_pattern; http.host; content:"track-device.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003217; classtype:social-engineering; sid:6003217; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mybluecheck-verify-manager.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mybluecheck-verify-manager.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003218; classtype:social-engineering; sid:6003218; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi697.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info-resmi697.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003219; classtype:social-engineering; sid:6003219; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pvenu46.github.io/alfidotech-netflix-clone/)"; flow:established,to_server; http.uri; content:"/alfidotech-netflix-clone/"; startswith; fast_pattern; http.host; content:"pvenu46.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003220; classtype:social-engineering; sid:6003220; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flowersshopping.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"flowersshopping.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003221; classtype:social-engineering; sid:6003221; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brtzxv.sbs/HF)"; flow:established,to_server; http.uri; content:"/HF"; startswith; fast_pattern; http.host; content:"brtzxv.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003222; classtype:social-engineering; sid:6003222; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (good.coinbaseinv.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"good.coinbaseinv.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003223; classtype:social-engineering; sid:6003223; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiabtggf4pvukd6vsagw3bswoivyqet36ocb4ujr74e64gbfvqrz7u.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiabtggf4pvukd6vsagw3bswoivyqet36ocb4ujr74e64gbfvqrz7u.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003224; classtype:social-engineering; sid:6003224; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (safe-ejgup.top/m/FUEVhDxhmU5hOfy3fOcgCFM5)"; flow:established,to_server; http.uri; content:"/m/FUEVhDxhmU5hOfy3fOcgCFM5"; startswith; fast_pattern; http.host; content:"safe-ejgup.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003225; classtype:social-engineering; sid:6003225; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (microsoftweb365.fwh.is/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"microsoftweb365.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003226; classtype:social-engineering; sid:6003226; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bet365f.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bet365f.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003227; classtype:social-engineering; sid:6003227; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fr.bjjizhuangxiang.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fr.bjjizhuangxiang.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003228; classtype:social-engineering; sid:6003228; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shringdoc.shop/Adobe_Installer)"; flow:established,to_server; http.uri; content:"/Adobe_Installer"; startswith; fast_pattern; http.host; content:"shringdoc.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003229; classtype:social-engineering; sid:6003229; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (satyamsk05.github.io/instagram.site)"; flow:established,to_server; http.uri; content:"/instagram.site"; startswith; fast_pattern; http.host; content:"satyamsk05.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003230; classtype:social-engineering; sid:6003230; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (g20j-c9rv-o3yh.iris-investore-net-s-account.workers.dev/b7014589342fa525?email=/)"; flow:established,to_server; http.uri; content:"/b7014589342fa525?email=/"; startswith; fast_pattern; http.host; content:"g20j-c9rv-o3yh.iris-investore-net-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003231; classtype:social-engineering; sid:6003231; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sam-string.github.io/Amazon-website-clone-/)"; flow:established,to_server; http.uri; content:"/Amazon-website-clone-/"; startswith; fast_pattern; http.host; content:"sam-string.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003232; classtype:social-engineering; sid:6003232; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.reactjsinstagramclone.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.reactjsinstagramclone.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003233; classtype:social-engineering; sid:6003233; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutsch.srvc-de734294.info/getpaymentm/261733977/m9)"; flow:established,to_server; http.uri; content:"/getpaymentm/261733977/m9"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutsch.srvc-de734294.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003234; classtype:social-engineering; sid:6003234; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-clone-login.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-clone-login.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003235; classtype:social-engineering; sid:6003235; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.vdd.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.vdd.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003236; classtype:social-engineering; sid:6003236; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (billion-3f8.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"billion-3f8.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003237; classtype:social-engineering; sid:6003237; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreihidbjzgt4de5atwlyoqjqhxmzcabatdqn4kksec6f44ayjphls2q.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreihidbjzgt4de5atwlyoqjqhxmzcabatdqn4kksec6f44ayjphls2q.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003238; classtype:social-engineering; sid:6003238; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pocztowy-link.online/o/ws6l0/1768848617406#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/ws6l0/1768848617406#selectedbank9"; startswith; fast_pattern; http.host; content:"pocztowy-link.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003239; classtype:social-engineering; sid:6003239; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.adskin.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app.adskin.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003240; classtype:social-engineering; sid:6003240; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.coinbase_x_login.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.coinbase_x_login.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003241; classtype:social-engineering; sid:6003241; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wlt.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wlt.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003242; classtype:social-engineering; sid:6003242; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (forwox.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"forwox.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003243; classtype:social-engineering; sid:6003243; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (24761a05n2-netizen.github.io/netflix_webpage/)"; flow:established,to_server; http.uri; content:"/netflix_webpage/"; startswith; fast_pattern; http.host; content:"24761a05n2-netizen.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003244; classtype:social-engineering; sid:6003244; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiftx3ioy3hebqsyco4cp6r35k47joehzs4mv52ty7awn7qfq27e4y.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiftx3ioy3hebqsyco4cp6r35k47joehzs4mv52ty7awn7qfq27e4y.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003245; classtype:social-engineering; sid:6003245; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mt12352.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mt12352.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003246; classtype:social-engineering; sid:6003246; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (noticias.almacen.nodo12c.radiosnet.com.ar/Office/)"; flow:established,to_server; http.uri; content:"/Office/"; startswith; fast_pattern; http.host; content:"noticias.almacen.nodo12c.radiosnet.com.ar"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003247; classtype:social-engineering; sid:6003247; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (julian-wine-cleanup-searched.trycloudflare.com/login.html)"; flow:established,to_server; http.uri; content:"/login.html"; startswith; fast_pattern; http.host; content:"julian-wine-cleanup-searched.trycloudflare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003248; classtype:social-engineering; sid:6003248; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (infoval.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"infoval.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003249; classtype:social-engineering; sid:6003249; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gemnxixlogen.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gemnxixlogen.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003250; classtype:social-engineering; sid:6003250; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (safe-pvlox.cfd/m/eC514hH4eYS_4mY9l1MrII1z)"; flow:established,to_server; http.uri; content:"/m/eC514hH4eYS_4mY9l1MrII1z"; startswith; fast_pattern; http.host; content:"safe-pvlox.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003251; classtype:social-engineering; sid:6003251; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.a2zapk.co/1368404-spotify-music-and-podcasts-9-0-30-242-ab-experimental-cloned-armeabi-v7a-arm64-v8a-a2z.html)"; flow:established,to_server; http.uri; content:"/1368404-spotify-music-and-podcasts-9-0-30-242-ab-experimental-cloned-armeabi-v7a-arm64-v8a-a2z.html"; startswith; fast_pattern; http.host; content:"www.a2zapk.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003252; classtype:social-engineering; sid:6003252; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brtzxa.cfd/HF)"; flow:established,to_server; http.uri; content:"/HF"; startswith; fast_pattern; http.host; content:"brtzxa.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003253; classtype:social-engineering; sid:6003253; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutsch.id735904.info/getpaymentm/238112484/m9)"; flow:established,to_server; http.uri; content:"/getpaymentm/238112484/m9"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutsch.id735904.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003254; classtype:social-engineering; sid:6003254; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (map-iphone.com/QPP)"; flow:established,to_server; http.uri; content:"/QPP"; startswith; fast_pattern; http.host; content:"map-iphone.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003255; classtype:social-engineering; sid:6003255; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (idyllic-bienenstitch-58f9de.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"idyllic-bienenstitch-58f9de.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003256; classtype:social-engineering; sid:6003256; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1xlite-01617.pro/en/block)"; flow:established,to_server; http.uri; content:"/en/block"; startswith; fast_pattern; http.host; content:"1xlite-01617.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003257; classtype:social-engineering; sid:6003257; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amz0n.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amz0n.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003258; classtype:social-engineering; sid:6003258; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.authorizedfixednode.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.authorizedfixednode.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003259; classtype:social-engineering; sid:6003259; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zonaeventmaterials.web.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zonaeventmaterials.web.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003260; classtype:social-engineering; sid:6003260; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fedexpcf.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fedexpcf.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003261; classtype:social-engineering; sid:6003261; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eb8rvu.top/o/ws6l0/1768848617406#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/ws6l0/1768848617406#selectedbank9"; startswith; fast_pattern; http.host; content:"eb8rvu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003262; classtype:social-engineering; sid:6003262; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a3u2q1.lat/o/ws6l0/1768848617406#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/ws6l0/1768848617406#selectedbank9"; startswith; fast_pattern; http.host; content:"a3u2q1.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003263; classtype:social-engineering; sid:6003263; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pcsupportdesk.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pcsupportdesk.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003264; classtype:social-engineering; sid:6003264; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (krishnapriya-78797.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"krishnapriya-78797.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003265; classtype:social-engineering; sid:6003265; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.vipozon.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.vipozon.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003266; classtype:social-engineering; sid:6003266; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreibh53t73kz5qwnmfjieva3j3ksdhbltthzlpjys33iws3uryri3vy.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreibh53t73kz5qwnmfjieva3j3ksdhbltthzlpjys33iws3uryri3vy.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003267; classtype:social-engineering; sid:6003267; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.apple-website-clone-liard.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.apple-website-clone-liard.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003268; classtype:social-engineering; sid:6003268; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiaziuicwhwde6ysxzks4udfr5ud4mutnde32ra26vq5zulhidoqaq.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiaziuicwhwde6ysxzks4udfr5ud4mutnde32ra26vq5zulhidoqaq.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003269; classtype:social-engineering; sid:6003269; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsappclone-inky.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsappclone-inky.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003270; classtype:social-engineering; sid:6003270; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mohdshadav.github.io/Amazon-Clone-Project1/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone-Project1/"; startswith; fast_pattern; http.host; content:"mohdshadav.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003271; classtype:social-engineering; sid:6003271; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (headcage.info/Q0g0MS1OMTUxNS1EMDkwNjA2/?u=161C1515&e=cotiy64366%40smlmail.com&s3=&s4=&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/Q0g0MS1OMTUxNS1EMDkwNjA2/?u=161C1515&e=cotiy64366%40smlmail.com&s3=&s4=&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"headcage.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003272; classtype:social-engineering; sid:6003272; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xpapsuq.lol/o/ws6l0/1768848617406#selectedbank9)"; flow:established,to_server; http.uri; content:"/o/ws6l0/1768848617406#selectedbank9"; startswith; fast_pattern; http.host; content:"xpapsuq.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003273; classtype:social-engineering; sid:6003273; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kevinulve-dev.github.io/bnp-cib/)"; flow:established,to_server; http.uri; content:"/bnp-cib/"; startswith; fast_pattern; http.host; content:"kevinulve-dev.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003274; classtype:social-engineering; sid:6003274; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.nmyuxo.shop/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.nmyuxo.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003275; classtype:social-engineering; sid:6003275; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.angkabet39201.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.angkabet39201.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003276; classtype:social-engineering; sid:6003276; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (policycompliancereview.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"policycompliancereview.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003277; classtype:social-engineering; sid:6003277; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (connect.mylittleballoonco.info/41-1511-280526/?u=14C1515&e=oror@e6e51f3b1410b31af47cdea8c08858ac755e.net&s3=&s4=&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/41-1511-280526/?u=14C1515&e=oror@e6e51f3b1410b31af47cdea8c08858ac755e.net&s3=&s4=&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"connect.mylittleballoonco.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003278; classtype:social-engineering; sid:6003278; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-clone-puce-delta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-clone-puce-delta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003279; classtype:social-engineering; sid:6003279; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (khushi-kumari98.github.io/flipkart-frontend-clone/)"; flow:established,to_server; http.uri; content:"/flipkart-frontend-clone/"; startswith; fast_pattern; http.host; content:"khushi-kumari98.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003280; classtype:social-engineering; sid:6003280; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365bet987.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365bet987.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003281; classtype:social-engineering; sid:6003281; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vicsmart173-prog.github.io/FedEx-Express-delivery-company.com/)"; flow:established,to_server; http.uri; content:"/FedEx-Express-delivery-company.com/"; startswith; fast_pattern; http.host; content:"vicsmart173-prog.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003282; classtype:social-engineering; sid:6003282; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cadastro-entregador.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cadastro-entregador.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003283; classtype:social-engineering; sid:6003283; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortex.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortex.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003284; classtype:social-engineering; sid:6003284; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiclrefg2edsve3usoverjqvpfwsp4qwt4vcv6ebclcwcstp4fry7i.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiclrefg2edsve3usoverjqvpfwsp4qwt4vcv6ebclcwcstp4fry7i.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003285; classtype:social-engineering; sid:6003285; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-plarnix-biz-qolvrax-vromtek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-plarnix-biz-qolvrax-vromtek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003286; classtype:social-engineering; sid:6003286; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.upsxdt.shop/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.upsxdt.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003287; classtype:social-engineering; sid:6003287; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (testing-67.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"testing-67.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003288; classtype:social-engineering; sid:6003288; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (berx-c4d2h3hnepbnfhfa.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"berx-c4d2h3hnepbnfhfa.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003289; classtype:social-engineering; sid:6003289; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazonmarketing1234.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"amazonmarketing1234.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003290; classtype:social-engineering; sid:6003290; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.109tyesy.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.109tyesy.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003291; classtype:social-engineering; sid:6003291; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aquakey.click/m/lX-uqRzK_35Qh3UsSnT6SZ5m)"; flow:established,to_server; http.uri; content:"/m/lX-uqRzK_35Qh3UsSnT6SZ5m"; startswith; fast_pattern; http.host; content:"aquakey.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003292; classtype:social-engineering; sid:6003292; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dcgqka.shop/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dcgqka.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003293; classtype:social-engineering; sid:6003293; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (caesmarevento.com.br/set/1/1/)"; flow:established,to_server; http.uri; content:"/set/1/1/"; startswith; fast_pattern; http.host; content:"caesmarevento.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003294; classtype:social-engineering; sid:6003294; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rapid-pine-457.allcompredirectportalshare.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rapid-pine-457.allcompredirectportalshare.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003295; classtype:social-engineering; sid:6003295; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-1e1e5882cdef4467b149e1bfab4eb3e6.r2.dev/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-1e1e5882cdef4467b149e1bfab4eb3e6.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003296; classtype:social-engineering; sid:6003296; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.7931187365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.7931187365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003297; classtype:social-engineering; sid:6003297; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (expresshomesolutionllc.info/CH41-N1515-D090606/?e=Tgalet@d59fc8954c59c468e55053f135fc7b20e438.org&s3=Thierry&s4=Baudin&s5=Mypost24pt784721&s6=&s7=&s8=&u=12C1515)"; flow:established,to_server; http.uri; content:"/CH41-N1515-D090606/?e=Tgalet@d59fc8954c59c468e55053f135fc7b20e438.org&s3=Thierry&s4=Baudin&s5=Mypost24pt784721&s6=&s7=&s8=&u=12C1515"; startswith; fast_pattern; http.host; content:"expresshomesolutionllc.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003298; classtype:social-engineering; sid:6003298; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.holibm.shop/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.holibm.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003299; classtype:social-engineering; sid:6003299; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (swarajpattnaik84coder.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"swarajpattnaik84coder.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003300; classtype:social-engineering; sid:6003300; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortnitechecking.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortnitechecking.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003301; classtype:social-engineering; sid:6003301; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (53ge-tnwz-fa00.blake-wascom-callcmc-com-s-account.workers.dev/f69bd9f5635f40b0?email=@)"; flow:established,to_server; http.uri; content:"/f69bd9f5635f40b0?email=@"; startswith; fast_pattern; http.host; content:"53ge-tnwz-fa00.blake-wascom-callcmc-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003302; classtype:social-engineering; sid:6003302; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sidrachaindexteam.com/wallets/connect/metamask/)"; flow:established,to_server; http.uri; content:"/wallets/connect/metamask/"; startswith; fast_pattern; http.host; content:"sidrachaindexteam.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003303; classtype:social-engineering; sid:6003303; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a1270050.xsph.ru/s3.east-005-a-1db39d6a1b0485b16b052c82a823a006/payment/quickbook-authentication.htm?eta=Sdanio2@68831f8596dbb13cebd2d14b76f84403a1d1.org)"; flow:established,to_server; http.uri; content:"/s3.east-005-a-1db39d6a1b0485b16b052c82a823a006/payment/quickbook-authentication.htm?eta=Sdanio2@68831f8596dbb13cebd2d14b76f84403a1d1.org"; startswith; fast_pattern; http.host; content:"a1270050.xsph.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003304; classtype:social-engineering; sid:6003304; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (everyday.replacey.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"everyday.replacey.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003305; classtype:social-engineering; sid:6003305; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deltaportallog.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"deltaportallog.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003306; classtype:social-engineering; sid:6003306; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bridge-oi.zapier.app/ioapp)"; flow:established,to_server; http.uri; content:"/ioapp"; startswith; fast_pattern; http.host; content:"bridge-oi.zapier.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003307; classtype:social-engineering; sid:6003307; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deltacollegeu.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"deltacollegeu.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003308; classtype:social-engineering; sid:6003308; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.smbc-card.com/mem/index.jsp#/?conn_id=f929fa02-8a45-409d-bdbf-1629748f2118/)"; flow:established,to_server; http.uri; content:"/mem/index.jsp#/?conn_id=f929fa02-8a45-409d-bdbf-1629748f2118/"; startswith; fast_pattern; http.host; content:"www.smbc-card.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003309; classtype:social-engineering; sid:6003309; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ssuphuld.wixstudio.com/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"ssuphuld.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003310; classtype:social-engineering; sid:6003310; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sign-in-to-xfinity-1763.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sign-in-to-xfinity-1763.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003311; classtype:social-engineering; sid:6003311; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newapplyscureappioaergamekrogfaerigkoomgear.bujanoci.net/?ehkmvsduwt)"; flow:established,to_server; http.uri; content:"/?ehkmvsduwt"; startswith; fast_pattern; http.host; content:"newapplyscureappioaergamekrogfaerigkoomgear.bujanoci.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003312; classtype:social-engineering; sid:6003312; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creditmutuel-opposition.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"creditmutuel-opposition.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003313; classtype:social-engineering; sid:6003313; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (homely-attributes-155419.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"homely-attributes-155419.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003314; classtype:social-engineering; sid:6003314; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (parastesintago.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"parastesintago.click"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003315; classtype:social-engineering; sid:6003315; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (open-ledgrecom.wixstudio.com/us-en)"; flow:established,to_server; http.uri; content:"/us-en"; startswith; fast_pattern; http.host; content:"open-ledgrecom.wixstudio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003316; classtype:social-engineering; sid:6003316; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sbc-verifier-sign-in-eb7663.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sbc-verifier-sign-in-eb7663.webflow.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003317; classtype:social-engineering; sid:6003317; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (n-jp.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"n-jp.co"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003318; classtype:social-engineering; sid:6003318; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (987656789.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"987656789.framer.website"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003319; classtype:social-engineering; sid:6003319; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fraiserfromiptoinnovation.com/director-uwp)"; flow:established,to_server; http.uri; content:"/director-uwp"; startswith; fast_pattern; http.host; content:"fraiserfromiptoinnovation.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003320; classtype:social-engineering; sid:6003320; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (caring-quicker-964590.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"caring-quicker-964590.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003321; classtype:social-engineering; sid:6003321; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2026-06-14.sqllq.com/en/?howtosuecslplasma.org#nolanguage)"; flow:established,to_server; http.uri; content:"/en/?howtosuecslplasma.org#nolanguage"; startswith; fast_pattern; http.host; content:"2026-06-14.sqllq.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003322; classtype:social-engineering; sid:6003322; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amzaboprime002.pro/index.php)"; flow:established,to_server; http.uri; content:"/index.php"; startswith; fast_pattern; http.host; content:"amzaboprime002.pro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003323; classtype:social-engineering; sid:6003323; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bet365-bet365a-org.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bet365-bet365a-org.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003324; classtype:social-engineering; sid:6003324; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.hxkwoy.shop/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.hxkwoy.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003325; classtype:social-engineering; sid:6003325; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking-dubai-desert-safaria.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booking-dubai-desert-safaria.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003326; classtype:social-engineering; sid:6003326; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.1adt42o0cbo5.com/account/reg?code=20611)"; flow:established,to_server; http.uri; content:"/account/reg?code=20611"; startswith; fast_pattern; http.host; content:"m.1adt42o0cbo5.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003327; classtype:social-engineering; sid:6003327; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xecloud.duckdns.org/cgi-bin/index.ha/)"; flow:established,to_server; http.uri; content:"/cgi-bin/index.ha/"; startswith; fast_pattern; http.host; content:"xecloud.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003328; classtype:social-engineering; sid:6003328; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi991.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi991.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003329; classtype:social-engineering; sid:6003329; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (polyelectrolyte.com/it/fatture/)"; flow:established,to_server; http.uri; content:"/it/fatture/"; startswith; fast_pattern; http.host; content:"polyelectrolyte.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003330; classtype:social-engineering; sid:6003330; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pusatshopee88.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pusatshopee88.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003331; classtype:social-engineering; sid:6003331; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stmaryspavilion.info/48-1576-050626/?u=162C1576&e=mam%40op.pl&s3=an&s4=ewa&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/48-1576-050626/?u=162C1576&e=mam%40op.pl&s3=an&s4=ewa&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"stmaryspavilion.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003332; classtype:social-engineering; sid:6003332; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-plurnex-biz-vroltor-glatik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-plurnex-biz-vroltor-glatik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003333; classtype:social-engineering; sid:6003333; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (satisfied-operator-199590.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"satisfied-operator-199590.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003334; classtype:social-engineering; sid:6003334; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezrrsuite.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezrrsuite.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003335; classtype:social-engineering; sid:6003335; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (truea1hsbdjhbsjhddsjdsd-cbfubtfngrg3gmd0.z02.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"truea1hsbdjhbsjhddsjdsd-cbfubtfngrg3gmd0.z02.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003336; classtype:social-engineering; sid:6003336; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chromeextension.fun/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chromeextension.fun"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003337; classtype:social-engineering; sid:6003337; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip5.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip5.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003338; classtype:social-engineering; sid:6003338; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.w86365.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.w86365.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003339; classtype:social-engineering; sid:6003339; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortniteinv.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortniteinv.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003340; classtype:social-engineering; sid:6003340; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-vrolnax-biz-slatem-qurnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-vrolnax-biz-slatem-qurnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003341; classtype:social-engineering; sid:6003341; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (buzzsphere.org/durhammedical)"; flow:established,to_server; http.uri; content:"/durhammedical"; startswith; fast_pattern; http.host; content:"buzzsphere.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003342; classtype:social-engineering; sid:6003342; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiverr-work-space.pro/project/maria4)"; flow:established,to_server; http.uri; content:"/project/maria4"; startswith; fast_pattern; http.host; content:"fiverr-work-space.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003343; classtype:social-engineering; sid:6003343; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking-coom-duubai-fllight-tickets.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booking-coom-duubai-fllight-tickets.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003344; classtype:social-engineering; sid:6003344; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja73.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja73.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003345; classtype:social-engineering; sid:6003345; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.start-ledgercom.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.start-ledgercom.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003346; classtype:social-engineering; sid:6003346; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dgyuehuiwan.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.dgyuehuiwan.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003347; classtype:social-engineering; sid:6003347; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cd263423.tw1.ru/CelkemCVT32200/)"; flow:established,to_server; http.uri; content:"/CelkemCVT32200/"; startswith; fast_pattern; http.host; content:"cd263423.tw1.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003348; classtype:social-engineering; sid:6003348; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dexscreener.com.dex-app.co.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dexscreener.com.dex-app.co.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003349; classtype:social-engineering; sid:6003349; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.emtgigdats.space/scpage/Sign%20in%20_%20Scotiabank.htm)"; flow:established,to_server; http.uri; content:"/scpage/Sign%20in%20_%20Scotiabank.htm"; startswith; fast_pattern; http.host; content:"www.emtgigdats.space"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003350; classtype:social-engineering; sid:6003350; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agua-assassina.com/cb/invoice.php)"; flow:established,to_server; http.uri; content:"/cb/invoice.php"; startswith; fast_pattern; http.host; content:"agua-assassina.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003351; classtype:social-engineering; sid:6003351; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (regularisation-cpam.info/pages/captcha.php)"; flow:established,to_server; http.uri; content:"/pages/captcha.php"; startswith; fast_pattern; http.host; content:"regularisation-cpam.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003352; classtype:social-engineering; sid:6003352; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6a2ae34262585f70c408567f--neon-flan-a84962.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6a2ae34262585f70c408567f--neon-flan-a84962.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003353; classtype:social-engineering; sid:6003353; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip12.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip12.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003354; classtype:social-engineering; sid:6003354; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kkuccoinlogyn.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kkuccoinlogyn.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003355; classtype:social-engineering; sid:6003355; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zoom.allwellhealthcare.com/Mac/utility.php/)"; flow:established,to_server; http.uri; content:"/Mac/utility.php/"; startswith; fast_pattern; http.host; content:"zoom.allwellhealthcare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003356; classtype:social-engineering; sid:6003356; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (regul.rw/work.html)"; flow:established,to_server; http.uri; content:"/work.html"; startswith; fast_pattern; http.host; content:"regul.rw"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003357; classtype:social-engineering; sid:6003357; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox-tools.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"roblox-tools.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003358; classtype:social-engineering; sid:6003358; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prajapatidhruv1206.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"prajapatidhruv1206.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003359; classtype:social-engineering; sid:6003359; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (naveenrajhari.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"naveenrajhari.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003360; classtype:social-engineering; sid:6003360; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (946302365756.com/web/)"; flow:established,to_server; http.uri; content:"/web/"; startswith; fast_pattern; http.host; content:"946302365756.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003361; classtype:social-engineering; sid:6003361; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.zcw520.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.zcw520.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003362; classtype:social-engineering; sid:6003362; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (im-sravan.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"im-sravan.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003363; classtype:social-engineering; sid:6003363; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (68-210-225-27.cprapid.com/de/update.php?oa9du76b90a8tvzs93aq)"; flow:established,to_server; http.uri; content:"/de/update.php?oa9du76b90a8tvzs93aq"; startswith; fast_pattern; http.host; content:"68-210-225-27.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003364; classtype:social-engineering; sid:6003364; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.pqq.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.pqq.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003365; classtype:social-engineering; sid:6003365; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meateemasklugn.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meateemasklugn.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003366; classtype:social-engineering; sid:6003366; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wy6073.craftum.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wy6073.craftum.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003367; classtype:social-engineering; sid:6003367; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ckramx.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ckramx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003368; classtype:social-engineering; sid:6003368; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip30.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip30.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003369; classtype:social-engineering; sid:6003369; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabet.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabet.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003370; classtype:social-engineering; sid:6003370; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (access-ldgerdekstop.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"access-ldgerdekstop.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003371; classtype:social-engineering; sid:6003371; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bitmartlogiene.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bitmartlogiene.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003372; classtype:social-engineering; sid:6003372; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.microsoftonline.hmvegn.ie/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login.microsoftonline.hmvegn.ie"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003373; classtype:social-engineering; sid:6003373; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pioneering-pomegranate-641565.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pioneering-pomegranate-641565.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003374; classtype:social-engineering; sid:6003374; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinityrefunds.com/token/1CFE8699CF2B4C0A98BA55B86C2611C1)"; flow:established,to_server; http.uri; content:"/token/1CFE8699CF2B4C0A98BA55B86C2611C1"; startswith; fast_pattern; http.host; content:"www.xfinityrefunds.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003375; classtype:social-engineering; sid:6003375; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shareonedrive.iceiy.com/indexupdted.html)"; flow:established,to_server; http.uri; content:"/indexupdted.html"; startswith; fast_pattern; http.host; content:"shareonedrive.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003376; classtype:social-engineering; sid:6003376; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (geaqmuinlogin.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"geaqmuinlogin.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003377; classtype:social-engineering; sid:6003377; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.365365k.app/chs/)"; flow:established,to_server; http.uri; content:"/chs/"; startswith; fast_pattern; http.host; content:"m.365365k.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003378; classtype:social-engineering; sid:6003378; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip2.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip2.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003379; classtype:social-engineering; sid:6003379; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003380; classtype:social-engineering; sid:6003380; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comprobar--servicios2026.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comprobar--servicios2026.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003381; classtype:social-engineering; sid:6003381; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kalpanab26.github.io/instagram_clone/)"; flow:established,to_server; http.uri; content:"/instagram_clone/"; startswith; fast_pattern; http.host; content:"kalpanab26.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003382; classtype:social-engineering; sid:6003382; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zn-prosucts-made-in-chinna.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zn-prosucts-made-in-chinna.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003383; classtype:social-engineering; sid:6003383; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (click.tenhoatitude.info/ga/click/2-10604126-10-10376-20272-11277-9a09917b77-786ced0816)"; flow:established,to_server; http.uri; content:"/ga/click/2-10604126-10-10376-20272-11277-9a09917b77-786ced0816"; startswith; fast_pattern; http.host; content:"click.tenhoatitude.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003384; classtype:social-engineering; sid:6003384; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ledger-com-start.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ledger-com-start.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003385; classtype:social-engineering; sid:6003385; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking-com-dubai-shoppingg.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booking-com-dubai-shoppingg.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003386; classtype:social-engineering; sid:6003386; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeejkt789.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopeejkt789.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003387; classtype:social-engineering; sid:6003387; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tyccsyw.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tyccsyw.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003388; classtype:social-engineering; sid:6003388; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kilpad.com/pr/)"; flow:established,to_server; http.uri; content:"/pr/"; startswith; fast_pattern; http.host; content:"kilpad.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003389; classtype:social-engineering; sid:6003389; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seemvertcertified.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"seemvertcertified.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003390; classtype:social-engineering; sid:6003390; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.msnservicesecuritym.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.msnservicesecuritym.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003391; classtype:social-engineering; sid:6003391; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucoreinslogn.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kucoreinslogn.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003392; classtype:social-engineering; sid:6003392; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-qurnor-biz-slatem-vroltex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-qurnor-biz-slatem-vroltex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003393; classtype:social-engineering; sid:6003393; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (keplrwallet.to/fr-fr/app/)"; flow:established,to_server; http.uri; content:"/fr-fr/app/"; startswith; fast_pattern; http.host; content:"keplrwallet.to"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003394; classtype:social-engineering; sid:6003394; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking-com-dubai-things-to-doo.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booking-com-dubai-things-to-doo.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003395; classtype:social-engineering; sid:6003395; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pusatshopee79.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pusatshopee79.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003396; classtype:social-engineering; sid:6003396; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shaw-webmail-109704.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shaw-webmail-109704.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003397; classtype:social-engineering; sid:6003397; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bradwagonergmail.direct.quickconnect.to/cgi-bin/home.ha)"; flow:established,to_server; http.uri; content:"/cgi-bin/home.ha"; startswith; fast_pattern; http.host; content:"www.bradwagonergmail.direct.quickconnect.to"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003398; classtype:social-engineering; sid:6003398; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (proxy-discord.jeemoo.com/category/safety)"; flow:established,to_server; http.uri; content:"/category/safety"; startswith; fast_pattern; http.host; content:"proxy-discord.jeemoo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003399; classtype:social-engineering; sid:6003399; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.poijngh.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.poijngh.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003400; classtype:social-engineering; sid:6003400; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (134tyesy.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"134tyesy.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003401; classtype:social-engineering; sid:6003401; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adfccc.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"adfccc.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003402; classtype:social-engineering; sid:6003402; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.treziostart.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.treziostart.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003403; classtype:social-engineering; sid:6003403; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tastefuldelights.com.au/docusign/docusignaccess/Windows/utility.php)"; flow:established,to_server; http.uri; content:"/docusign/docusignaccess/Windows/utility.php"; startswith; fast_pattern; http.host; content:"tastefuldelights.com.au"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003404; classtype:social-engineering; sid:6003404; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dardsaaz.com/docusign/Mac/utility.php/)"; flow:established,to_server; http.uri; content:"/docusign/Mac/utility.php/"; startswith; fast_pattern; http.host; content:"dardsaaz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003405; classtype:social-engineering; sid:6003405; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (traditional-habits-801750.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"traditional-habits-801750.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003406; classtype:social-engineering; sid:6003406; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking-com-dubai-flight-ticketstour.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booking-com-dubai-flight-ticketstour.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003407; classtype:social-engineering; sid:6003407; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-shivang02.vercel.app/pages/browse.html)"; flow:established,to_server; http.uri; content:"/pages/browse.html"; startswith; fast_pattern; http.host; content:"netflix-clone-shivang02.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003408; classtype:social-engineering; sid:6003408; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (absolutecaninepa.com/DocuSign/Mac/utility.php/)"; flow:established,to_server; http.uri; content:"/DocuSign/Mac/utility.php/"; startswith; fast_pattern; http.host; content:"absolutecaninepa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003409; classtype:social-engineering; sid:6003409; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gembualoginm.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gembualoginm.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003410; classtype:social-engineering; sid:6003410; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gala-bet.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gala-bet.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003411; classtype:social-engineering; sid:6003411; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (learn-bridge-trezor-sso-autth.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"learn-bridge-trezor-sso-autth.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003412; classtype:social-engineering; sid:6003412; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shivnandan20070102-tech.github.io/instagram-)"; flow:established,to_server; http.uri; content:"/instagram-"; startswith; fast_pattern; http.host; content:"shivnandan20070102-tech.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003413; classtype:social-engineering; sid:6003413; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rodrigues361.github.io/lovelyweb/)"; flow:established,to_server; http.uri; content:"/lovelyweb/"; startswith; fast_pattern; http.host; content:"rodrigues361.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003414; classtype:social-engineering; sid:6003414; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.linn-eska.de/tuxk1yh/zgil1jk/ordhig1/jloda/0utFix/4c02b195e8d01ff716575ec99299087d/index2.php)"; flow:established,to_server; http.uri; content:"/tuxk1yh/zgil1jk/ordhig1/jloda/0utFix/4c02b195e8d01ff716575ec99299087d/index2.php"; startswith; fast_pattern; http.host; content:"www.linn-eska.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003415; classtype:social-engineering; sid:6003415; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip32.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip32.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003416; classtype:social-engineering; sid:6003416; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip1.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip1.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003417; classtype:social-engineering; sid:6003417; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (discord.365jpshop.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"discord.365jpshop.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003418; classtype:social-engineering; sid:6003418; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking-comaraab-dubai-packages.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booking-comaraab-dubai-packages.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003419; classtype:social-engineering; sid:6003419; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bloodravenzone.web.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bloodravenzone.web.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003420; classtype:social-engineering; sid:6003420; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (come.ac/ZE2Ts)"; flow:established,to_server; http.uri; content:"/ZE2Ts"; startswith; fast_pattern; http.host; content:"come.ac"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003421; classtype:social-engineering; sid:6003421; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-fratem-biz-plurnor-qolvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-fratem-biz-plurnor-qolvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003422; classtype:social-engineering; sid:6003422; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip20.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip20.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003423; classtype:social-engineering; sid:6003423; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-profile-login.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-profile-login.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003424; classtype:social-engineering; sid:6003424; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.adfccc.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.adfccc.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003425; classtype:social-engineering; sid:6003425; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth--app--kucoin--sso--cdnn.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auth--app--kucoin--sso--cdnn.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003426; classtype:social-engineering; sid:6003426; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abgctid.wpenginepowered.com/trma/)"; flow:established,to_server; http.uri; content:"/trma/"; startswith; fast_pattern; http.host; content:"abgctid.wpenginepowered.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003427; classtype:social-engineering; sid:6003427; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accessinvite.abrdns.com/K/comps.php)"; flow:established,to_server; http.uri; content:"/K/comps.php"; startswith; fast_pattern; http.host; content:"accessinvite.abrdns.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003428; classtype:social-engineering; sid:6003428; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ledgerlive-downld.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ledgerlive-downld.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003429; classtype:social-engineering; sid:6003429; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (carprimp.info/CH41-N1515-D090606/?u=83C1515&e=nelanz@c9c3f8bbfcc22b0ca53f46e042fad9be0fc5.net&s3=&s4=&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/CH41-N1515-D090606/?u=83C1515&e=nelanz@c9c3f8bbfcc22b0ca53f46e042fad9be0fc5.net&s3=&s4=&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"carprimp.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003430; classtype:social-engineering; sid:6003430; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gsantos-ob.github.io/instagram)"; flow:established,to_server; http.uri; content:"/instagram"; startswith; fast_pattern; http.host; content:"gsantos-ob.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003431; classtype:social-engineering; sid:6003431; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip19.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip19.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003432; classtype:social-engineering; sid:6003432; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip121.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip121.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003433; classtype:social-engineering; sid:6003433; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santander.dispositivoseguranca.com/inicio)"; flow:established,to_server; http.uri; content:"/inicio"; startswith; fast_pattern; http.host; content:"santander.dispositivoseguranca.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003434; classtype:social-engineering; sid:6003434; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cryptowalleet.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cryptowalleet.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003435; classtype:social-engineering; sid:6003435; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (guide-ledgr-en.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"guide-ledgr-en.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003436; classtype:social-engineering; sid:6003436; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-profile-login.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-profile-login.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003437; classtype:social-engineering; sid:6003437; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (star1-fedtgke2bkdfhzdz.z02.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"star1-fedtgke2bkdfhzdz.z02.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003438; classtype:social-engineering; sid:6003438; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreibym46z7vd4aovjmufkopyilxkmhu2nm4iucykhgvplzo5pmnw52i.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreibym46z7vd4aovjmufkopyilxkmhu2nm4iucykhgvplzo5pmnw52i.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003439; classtype:social-engineering; sid:6003439; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (11-ese.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"11-ese.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003440; classtype:social-engineering; sid:6003440; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xn--metamasklogin-lobs.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xn--metamasklogin-lobs.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003441; classtype:social-engineering; sid:6003441; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tokeonpnaket.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tokeonpnaket.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003442; classtype:social-engineering; sid:6003442; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kuionlogins.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kuionlogins.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003443; classtype:social-engineering; sid:6003443; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (misruleoflaw.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"misruleoflaw.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003444; classtype:social-engineering; sid:6003444; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-3f081ad7284d4ae088815e99acb1811a.r2.dev/zmb.html)"; flow:established,to_server; http.uri; content:"/zmb.html"; startswith; fast_pattern; http.host; content:"pub-3f081ad7284d4ae088815e99acb1811a.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003445; classtype:social-engineering; sid:6003445; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (poijngh.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"poijngh.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003446; classtype:social-engineering; sid:6003446; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucoin_loiigin.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kucoin_loiigin.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003447; classtype:social-engineering; sid:6003447; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja74.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja74.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003448; classtype:social-engineering; sid:6003448; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-com-start.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-com-start.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003449; classtype:social-engineering; sid:6003449; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tiktoksecurity.github.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tiktoksecurity.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003450; classtype:social-engineering; sid:6003450; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bybit8.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bybit8.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003451; classtype:social-engineering; sid:6003451; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pesta-shopee3777.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pesta-shopee3777.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003452; classtype:social-engineering; sid:6003452; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking-com-dubai-flight-ticke-a.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booking-com-dubai-flight-ticke-a.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003453; classtype:social-engineering; sid:6003453; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (guide-bridge-en.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"guide-bridge-en.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003454; classtype:social-engineering; sid:6003454; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (perfilexclusivo.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"perfilexclusivo.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003455; classtype:social-engineering; sid:6003455; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ups.hqrmvpkt.cfd/en/)"; flow:established,to_server; http.uri; content:"/en/"; startswith; fast_pattern; http.host; content:"ups.hqrmvpkt.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003456; classtype:social-engineering; sid:6003456; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arabbooking-com-dubai-desert-safari.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"arabbooking-com-dubai-desert-safari.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003457; classtype:social-engineering; sid:6003457; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip22.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip22.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003458; classtype:social-engineering; sid:6003458; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pafoved.net/noblefs)"; flow:established,to_server; http.uri; content:"/noblefs"; startswith; fast_pattern; http.host; content:"pafoved.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003459; classtype:social-engineering; sid:6003459; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking---comsdubai.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booking---comsdubai.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003460; classtype:social-engineering; sid:6003460; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortno.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortno.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003461; classtype:social-engineering; sid:6003461; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yosimasa.co.jp/wp-content/online-fb-ads/login/)"; flow:established,to_server; http.uri; content:"/wp-content/online-fb-ads/login/"; startswith; fast_pattern; http.host; content:"yosimasa.co.jp"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003462; classtype:social-engineering; sid:6003462; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bet365k01.com/__verify?next=/)"; flow:established,to_server; http.uri; content:"/__verify?next=/"; startswith; fast_pattern; http.host; content:"www.bet365k01.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003463; classtype:social-engineering; sid:6003463; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (beneficioexclusivo.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"beneficioexclusivo.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003464; classtype:social-engineering; sid:6003464; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vjalenn.github.io/yeadiscord)"; flow:established,to_server; http.uri; content:"/yeadiscord"; startswith; fast_pattern; http.host; content:"vjalenn.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003465; classtype:social-engineering; sid:6003465; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutch.austinsecurityservice.com/receive/order/gA0COPvVJvW?r=0x22&__cf_chl_rt_tk=ElU.RyyWB_QLPng3vYhF4qTjhzlu1X2s2Zz5gE4VeV8-1781450646-1.0.1.1-iMWjXrsEKTjr2F9AWGW8oMXEjFpVdwJBMsOHjcLDqwE)"; flow:established,to_server; http.uri; content:"/receive/order/gA0COPvVJvW?r=0x22&__cf_chl_rt_tk=ElU.RyyWB_QLPng3vYhF4qTjhzlu1X2s2Zz5gE4VeV8-1781450646-1.0.1.1-iMWjXrsEKTjr2F9AWGW8oMXEjFpVdwJBMsOHjcLDqwE"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutch.austinsecurityservice.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003466; classtype:social-engineering; sid:6003466; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc.crsorgi.gov.in.codezfree.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dc.crsorgi.gov.in.codezfree.online"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003467; classtype:social-engineering; sid:6003467; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yahoojkj.github.io/hxxp-yahoomailsignin/)"; flow:established,to_server; http.uri; content:"/hxxp-yahoomailsignin/"; startswith; fast_pattern; http.host; content:"yahoojkj.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003468; classtype:social-engineering; sid:6003468; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc.crsorgi.gov.in.index.dc-p.xyz/crs/)"; flow:established,to_server; http.uri; content:"/crs/"; startswith; fast_pattern; http.host; content:"dc.crsorgi.gov.in.index.dc-p.xyz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003469; classtype:social-engineering; sid:6003469; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (titanprint.co.in/dashboard/login.php)"; flow:established,to_server; http.uri; content:"/dashboard/login.php"; startswith; fast_pattern; http.host; content:"titanprint.co.in"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003470; classtype:social-engineering; sid:6003470; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-avrfct.icu/?secure_connect=2f2*f*&_subid=1sd8jpm.50.1ai0p&_token=1r9o4m7ck07iu.1781461379.20.19801685e0b4df0e40e430325c7aa553)"; flow:established,to_server; http.uri; content:"/?secure_connect=2f2*f*&_subid=1sd8jpm.50.1ai0p&_token=1r9o4m7ck07iu.1781461379.20.19801685e0b4df0e40e430325c7aa553"; startswith; fast_pattern; http.host; content:"my-avrfct.icu"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003471; classtype:social-engineering; sid:6003471; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (debak.ciamlogin.com/b4d386f9-19ed-4665-8274-643f6e094e6d/oauth2/v2.0/authorize?client_id=bf4983a9-1136-48b8-9304-04b416971e04&redirect_uri=https%3A%2F%2Fbitvavo.debak.nl%2Fsignin-oidc&response_type=id_token&scope=openid%20profile&response_mode=form_post&nonce=638855017811426730.YWQ5NWUwODUtYWZiNS00NDUyLTk0MjEtOWY1NjQzMmMzNzcwOTQwNDkzZDEtOGY0My00ZjI5LWFlMmMtYjNmNzBhZmNiMDg1&client_info=1&x-client-brkrver=IDWeb.3.9.1.0&state=CfDJ8Ktd8h2MRhdAsLHpuml4G8M9-fMPpYYDLACij6bjW8A5azvuDsRWtg39-FDopxWtyvlKM7sPmKNCwkwOhRdvtR1JZlxTyS0iSWq7wO7JTPGpstE_Xi_yJQoX81eH0cRaOI_mHe8tbyQTuCtNUfS1rCtZZf758oBdJpkyVUY4PXRzhYIGC1YiQzNg_xh8ZrcWL4xjTzKsiWSPpy3cHv-D05ExVfUTkGRdnVwWp0IV35kR-KpvcGfWmbDCGHFbJFBY5Nioy0akpReudnzqfOZfVmJo2tz74Wzk81HyO5PpRpXi&x-client-SKU=ID_NET9_0&x-client-ver=8.10.0.0)"; flow:established,to_server; http.uri; content:"/b4d386f9-19ed-4665-8274-643f6e094e6d/oauth2/v2.0/authorize?client_id=bf4983a9-1136-48b8-9304-04b416971e04&redirect_uri=https%3A%2F%2Fbitvavo.debak.nl%2Fsignin-oidc&response_type=id_token&scope=openid%20profile&response_mode=form_post&nonce=638855017811426730.YWQ5NWUwODUtYWZiNS00NDUyLTk0MjEtOWY1NjQzMmMzNzcwOTQwNDkzZDEtOGY0My00ZjI5LWFlMmMtYjNmNzBhZmNiMDg1&client_info=1&x-client-brkrver=IDWeb.3.9.1.0&state=CfDJ8Ktd8h2MRhdAsLHpuml4G8M9-fMPpYYDLACij6bjW8A5azvuDsRWtg39-FDopxWtyvlKM7sPmKNCwkwOhRdvtR1JZlxTyS0iSWq7wO7JTPGpstE_Xi_yJQoX81eH0cRaOI_mHe8tbyQTuCtNUfS1rCtZZf758oBdJpkyVUY4PXRzhYIGC1YiQzNg_xh8ZrcWL4xjTzKsiWSPpy3cHv-D05ExVfUTkGRdnVwWp0IV35kR-KpvcGfWmbDCGHFbJFBY5Nioy0akpReudnzqfOZfVmJo2tz74Wzk81HyO5PpRpXi&x-client-SKU=ID_NET9_0&x-client-ver=8.10.0.0"; startswith; fast_pattern; http.host; content:"debak.ciamlogin.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003472; classtype:social-engineering; sid:6003472; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (user-support.online/api/agent/download/6a22e84654ddf3633644d077?type=exe)"; flow:established,to_server; http.uri; content:"/api/agent/download/6a22e84654ddf3633644d077?type=exe"; startswith; fast_pattern; http.host; content:"user-support.online"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003473; classtype:social-engineering; sid:6003473; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc.crsorgi.gov.ec.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dc.crsorgi.gov.ec.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003474; classtype:social-engineering; sid:6003474; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (padisahbet1102.com/auth/giris?next=%2F)"; flow:established,to_server; http.uri; content:"/auth/giris?next=%2F"; startswith; fast_pattern; http.host; content:"padisahbet1102.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003475; classtype:social-engineering; sid:6003475; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.rshicz.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.rshicz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003476; classtype:social-engineering; sid:6003476; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-bebidasgelada-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-bebidasgelada-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003477; classtype:social-engineering; sid:6003477; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myjcb-safecjeckpor.icu/pages/login/index.php/)"; flow:established,to_server; http.uri; content:"/pages/login/index.php/"; startswith; fast_pattern; http.host; content:"myjcb-safecjeckpor.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003478; classtype:social-engineering; sid:6003478; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucoinloginstation.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kucoinloginstation.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003479; classtype:social-engineering; sid:6003479; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ssl.zoi9.pro/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"ssl.zoi9.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003480; classtype:social-engineering; sid:6003480; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usmanmani147.github.io/My-First-Clone-/)"; flow:established,to_server; http.uri; content:"/My-First-Clone-/"; startswith; fast_pattern; http.host; content:"usmanmani147.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003481; classtype:social-engineering; sid:6003481; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accepted-lime-odw5xh6e-dpk7y3dsrvmv.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"accepted-lime-odw5xh6e-dpk7y3dsrvmv.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003482; classtype:social-engineering; sid:6003482; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (indoorscout.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"indoorscout.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003483; classtype:social-engineering; sid:6003483; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bank-of-america.directhr.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bank-of-america.directhr.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003484; classtype:social-engineering; sid:6003484; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pensilvania.club/personal/sander/)"; flow:established,to_server; http.uri; content:"/personal/sander/"; startswith; fast_pattern; http.host; content:"pensilvania.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003485; classtype:social-engineering; sid:6003485; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhsingh735222.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"dhsingh735222.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003486; classtype:social-engineering; sid:6003486; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-resmi789.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"program-resmi789.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003487; classtype:social-engineering; sid:6003487; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (areeba-noor-ui.github.io/Amazon_Clone)"; flow:established,to_server; http.uri; content:"/Amazon_Clone"; startswith; fast_pattern; http.host; content:"areeba-noor-ui.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003488; classtype:social-engineering; sid:6003488; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creatingfinanopportunitie.free.nf/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"creatingfinanopportunitie.free.nf"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003489; classtype:social-engineering; sid:6003489; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.zoi9.pro/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"www.zoi9.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003490; classtype:social-engineering; sid:6003490; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tioshxnsu.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tioshxnsu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003491; classtype:social-engineering; sid:6003491; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tonken.cc/download/)"; flow:established,to_server; http.uri; content:"/download/"; startswith; fast_pattern; http.host; content:"www.tonken.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003492; classtype:social-engineering; sid:6003492; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-entregass24h-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-entregass24h-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003493; classtype:social-engineering; sid:6003493; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-bebidasdoze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-bebidasdoze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003494; classtype:social-engineering; sid:6003494; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (followcheck.account-info.email/6197094-oH1faBZb-PKS9Q)"; flow:established,to_server; http.uri; content:"/6197094-oH1faBZb-PKS9Q"; startswith; fast_pattern; http.host; content:"followcheck.account-info.email"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003495; classtype:social-engineering; sid:6003495; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.hmvegn.ie/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login.hmvegn.ie"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003496; classtype:social-engineering; sid:6003496; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (down-token.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"down-token.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003497; classtype:social-engineering; sid:6003497; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atikfoysal-web.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"atikfoysal-web.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003498; classtype:social-engineering; sid:6003498; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pusatshopee99.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pusatshopee99.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003499; classtype:social-engineering; sid:6003499; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-clone-beta-gules.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-clone-beta-gules.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003500; classtype:social-engineering; sid:6003500; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee9499.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee9499.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003501; classtype:social-engineering; sid:6003501; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-deliveryss24h-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-deliveryss24h-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003502; classtype:social-engineering; sid:6003502; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezoapp-page.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezoapp-page.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003503; classtype:social-engineering; sid:6003503; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (llwhgcj58w.zoi9.pro/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"llwhgcj58w.zoi9.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003504; classtype:social-engineering; sid:6003504; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (studio3-st3.com/document.php)"; flow:established,to_server; http.uri; content:"/document.php"; startswith; fast_pattern; http.host; content:"studio3-st3.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003505; classtype:social-engineering; sid:6003505; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jj7765.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jj7765.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003506; classtype:social-engineering; sid:6003506; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.adb-secure.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.adb-secure.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003507; classtype:social-engineering; sid:6003507; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mckinseyandcompany.uk/mymts/mtsmail/)"; flow:established,to_server; http.uri; content:"/mymts/mtsmail/"; startswith; fast_pattern; http.host; content:"mckinseyandcompany.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003508; classtype:social-engineering; sid:6003508; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pcswap.dev/portfolio)"; flow:established,to_server; http.uri; content:"/portfolio"; startswith; fast_pattern; http.host; content:"pcswap.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003509; classtype:social-engineering; sid:6003509; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gemanelogin.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gemanelogin.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003510; classtype:social-engineering; sid:6003510; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docusign-firmar.github.io/mexico)"; flow:established,to_server; http.uri; content:"/mexico"; startswith; fast_pattern; http.host; content:"docusign-firmar.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003511; classtype:social-engineering; sid:6003511; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.verificarcuenta365.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.verificarcuenta365.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003512; classtype:social-engineering; sid:6003512; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dlxlggrotlioconk3riv.zoi9.pro/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"dlxlggrotlioconk3riv.zoi9.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003513; classtype:social-engineering; sid:6003513; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kishan814.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"kishan814.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003514; classtype:social-engineering; sid:6003514; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.amshopoo.com/mobile/)"; flow:established,to_server; http.uri; content:"/mobile/"; startswith; fast_pattern; http.host; content:"m.amshopoo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003515; classtype:social-engineering; sid:6003515; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santandervidaygenerales.actions-online.com/?rid=1R9cXF3)"; flow:established,to_server; http.uri; content:"/?rid=1R9cXF3"; startswith; fast_pattern; http.host; content:"santandervidaygenerales.actions-online.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003516; classtype:social-engineering; sid:6003516; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (godisgreat1000x-hub.github.io/admin.html/)"; flow:established,to_server; http.uri; content:"/admin.html/"; startswith; fast_pattern; http.host; content:"godisgreat1000x-hub.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003517; classtype:social-engineering; sid:6003517; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kiroamen.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"kiroamen.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003518; classtype:social-engineering; sid:6003518; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-deliverysze-24h.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-deliverysze-24h.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003519; classtype:social-engineering; sid:6003519; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-git-06-09-fixwebtdpallnetworksoptionupdatest-619c96-uniswap.vercel.app/sell)"; flow:established,to_server; http.uri; content:"/sell"; startswith; fast_pattern; http.host; content:"web-git-06-09-fixwebtdpallnetworksoptionupdatest-619c96-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003520; classtype:social-engineering; sid:6003520; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-clone-beta-gules.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-clone-beta-gules.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003521; classtype:social-engineering; sid:6003521; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (device-iso.com/script/2026_passcode6_login)"; flow:established,to_server; http.uri; content:"/script/2026_passcode6_login"; startswith; fast_pattern; http.host; content:"device-iso.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003522; classtype:social-engineering; sid:6003522; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (impactsolutionsecuador.free.nf/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"impactsolutionsecuador.free.nf"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003523; classtype:social-engineering; sid:6003523; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee7389.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee7389.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003524; classtype:social-engineering; sid:6003524; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.us.usps-stampstore.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.us.usps-stampstore.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003525; classtype:social-engineering; sid:6003525; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.support-css.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.support-css.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003526; classtype:social-engineering; sid:6003526; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cloudflare-workers-pages-vless.lixian2000.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cloudflare-workers-pages-vless.lixian2000.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003527; classtype:social-engineering; sid:6003527; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (akhilesh-m8.github.io/Netflix-UI-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-UI-clone/"; startswith; fast_pattern; http.host; content:"akhilesh-m8.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003528; classtype:social-engineering; sid:6003528; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (slgnahrefs.com/k1/discord)"; flow:established,to_server; http.uri; content:"/k1/discord"; startswith; fast_pattern; http.host; content:"slgnahrefs.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003529; classtype:social-engineering; sid:6003529; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-ledger-com-cdn.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en-ledger-com-cdn.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003530; classtype:social-engineering; sid:6003530; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fishing-app.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fishing-app.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003531; classtype:social-engineering; sid:6003531; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.program-resmi789.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.program-resmi789.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003532; classtype:social-engineering; sid:6003532; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app3-1q9.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app3-1q9.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003533; classtype:social-engineering; sid:6003533; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (madamabistrot.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"madamabistrot.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003534; classtype:social-engineering; sid:6003534; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip4.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip4.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003535; classtype:social-engineering; sid:6003535; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.aloi-0a8j.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.aloi-0a8j.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003536; classtype:social-engineering; sid:6003536; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365bet355.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365bet355.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003537; classtype:social-engineering; sid:6003537; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brilliant-sherbet-6f0a46.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"brilliant-sherbet-6f0a46.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003538; classtype:social-engineering; sid:6003538; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pemenangshopee555.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"pemenangshopee555.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003539; classtype:social-engineering; sid:6003539; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fdis.api.lifesecretary.com/privacy)"; flow:established,to_server; http.uri; content:"/privacy"; startswith; fast_pattern; http.host; content:"fdis.api.lifesecretary.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003540; classtype:social-engineering; sid:6003540; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinityaccounthome.20-228-132-238.cpanel.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinityaccounthome.20-228-132-238.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003541; classtype:social-engineering; sid:6003541; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (disabled-lavender-ub5w238e-dph3hbjr1l94.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"disabled-lavender-ub5w238e-dph3hbjr1l94.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003542; classtype:social-engineering; sid:6003542; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.letnie-okazje28437571.cyou/oferta/id-7wv05e5c8o-Zestaw-elektronarzedzi-Makita-Idealny-na-prezent)"; flow:established,to_server; http.uri; content:"/oferta/id-7wv05e5c8o-Zestaw-elektronarzedzi-Makita-Idealny-na-prezent"; startswith; fast_pattern; http.host; content:"allegrolokalnie.letnie-okazje28437571.cyou"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003543; classtype:social-engineering; sid:6003543; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (perfect-amber-kmdbqzs7-dp7c02ls0f4p.edgeone.app/jujuj.html)"; flow:established,to_server; http.uri; content:"/jujuj.html"; startswith; fast_pattern; http.host; content:"perfect-amber-kmdbqzs7-dp7c02ls0f4p.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003544; classtype:social-engineering; sid:6003544; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (exodussupport.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"exodussupport.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003545; classtype:social-engineering; sid:6003545; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (logginldcloud-appmnx.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"logginldcloud-appmnx.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003546; classtype:social-engineering; sid:6003546; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (encontrar-i-cloud.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"encontrar-i-cloud.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003547; classtype:social-engineering; sid:6003547; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jwrlazkp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jwrlazkp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003548; classtype:social-engineering; sid:6003548; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (diamond177disini.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"diamond177disini.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003549; classtype:social-engineering; sid:6003549; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sanderunion.club/personal/)"; flow:established,to_server; http.uri; content:"/personal/"; startswith; fast_pattern; http.host; content:"sanderunion.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003550; classtype:social-engineering; sid:6003550; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lcloud-encontrarmaps.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"lcloud-encontrarmaps.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003551; classtype:social-engineering; sid:6003551; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aplle-activa-find.us/a.php/)"; flow:established,to_server; http.uri; content:"/a.php/"; startswith; fast_pattern; http.host; content:"aplle-activa-find.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003552; classtype:social-engineering; sid:6003552; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dispositivo-i-cloud.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"dispositivo-i-cloud.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003553; classtype:social-engineering; sid:6003553; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hamad007691.github.io/Amazon)"; flow:established,to_server; http.uri; content:"/Amazon"; startswith; fast_pattern; http.host; content:"hamad007691.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003554; classtype:social-engineering; sid:6003554; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pemenangshopee389.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pemenangshopee389.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003555; classtype:social-engineering; sid:6003555; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (weekdaymealprep.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"weekdaymealprep.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003556; classtype:social-engineering; sid:6003556; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiifkanpaylater.xbb.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiifkanpaylater.xbb.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003557; classtype:social-engineering; sid:6003557; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cardlamp-bit.github.io/plan-iphone/)"; flow:established,to_server; http.uri; content:"/plan-iphone/"; startswith; fast_pattern; http.host; content:"cardlamp-bit.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003558; classtype:social-engineering; sid:6003558; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.h365756.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.h365756.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003559; classtype:social-engineering; sid:6003559; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ajaykumar124.github.io/Netflix)"; flow:established,to_server; http.uri; content:"/Netflix"; startswith; fast_pattern; http.host; content:"ajaykumar124.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003560; classtype:social-engineering; sid:6003560; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (l-iniciarseuatendimento.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"l-iniciarseuatendimento.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003561; classtype:social-engineering; sid:6003561; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezor-start-io-en.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezor-start-io-en.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003562; classtype:social-engineering; sid:6003562; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.11365app.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.11365app.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003563; classtype:social-engineering; sid:6003563; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bkde-ega0c5ffdkdyhfhj.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bkde-ega0c5ffdkdyhfhj.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003564; classtype:social-engineering; sid:6003564; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeeprize339.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopeeprize339.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003565; classtype:social-engineering; sid:6003565; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365newschina.com/bhuposm/)"; flow:established,to_server; http.uri; content:"/bhuposm/"; startswith; fast_pattern; http.host; content:"365newschina.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003566; classtype:social-engineering; sid:6003566; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.authentication.ms/E.ueL_dUMl4LiHfg)"; flow:established,to_server; http.uri; content:"/E.ueL_dUMl4LiHfg"; startswith; fast_pattern; http.host; content:"www.authentication.ms"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003567; classtype:social-engineering; sid:6003567; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vinalenergy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vinalenergy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003568; classtype:social-engineering; sid:6003568; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (api-wsource1-epc78300000000000152669tfn-homesolution.educacaosobredrogas.com.br/auth/login.php)"; flow:established,to_server; http.uri; content:"/auth/login.php"; startswith; fast_pattern; http.host; content:"api-wsource1-epc78300000000000152669tfn-homesolution.educacaosobredrogas.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003569; classtype:social-engineering; sid:6003569; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (busca-midisp.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"busca-midisp.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003570; classtype:social-engineering; sid:6003570; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (treezoarwalletis.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"treezoarwalletis.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003571; classtype:social-engineering; sid:6003571; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.zjj.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.zjj.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003572; classtype:social-engineering; sid:6003572; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3659x.win/promo.html)"; flow:established,to_server; http.uri; content:"/promo.html"; startswith; fast_pattern; http.host; content:"3659x.win"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003573; classtype:social-engineering; sid:6003573; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www_jndzwy_com.guangtaiyuan.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www_jndzwy_com.guangtaiyuan.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003574; classtype:social-engineering; sid:6003574; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (security-info-account.help/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"security-info-account.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003575; classtype:social-engineering; sid:6003575; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox.com.mu/users/1336597261/profile)"; flow:established,to_server; http.uri; content:"/users/1336597261/profile"; startswith; fast_pattern; http.host; content:"www.roblox.com.mu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003576; classtype:social-engineering; sid:6003576; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app534153.hasspetorleum.com/r/?auth=383ff0e5cea5eab4&u=aHR0cHM6Ly8xMDEtcGVyc29uYWwtcHJvamVjdHMtdGVzdGluZy5hcHB3cml0ZS5uZXR3b3JrLz9hdXRoPXRvdXJpc20ucnRAdGF0YXIucnU=)"; flow:established,to_server; http.uri; content:"/r/?auth=383ff0e5cea5eab4&u=aHR0cHM6Ly8xMDEtcGVyc29uYWwtcHJvamVjdHMtdGVzdGluZy5hcHB3cml0ZS5uZXR3b3JrLz9hdXRoPXRvdXJpc20ucnRAdGF0YXIucnU="; startswith; fast_pattern; http.host; content:"app534153.hasspetorleum.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003577; classtype:social-engineering; sid:6003577; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (workspacegatewayhub.com/ftx/page.html)"; flow:established,to_server; http.uri; content:"/ftx/page.html"; startswith; fast_pattern; http.host; content:"workspacegatewayhub.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003578; classtype:social-engineering; sid:6003578; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox.fo/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"roblox.fo"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003579; classtype:social-engineering; sid:6003579; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6yod3a.lmax.xin/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6yod3a.lmax.xin"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003580; classtype:social-engineering; sid:6003580; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (logginapp-lcloudmx.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"logginapp-lcloudmx.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003581; classtype:social-engineering; sid:6003581; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sign-pple-maps.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"sign-pple-maps.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003582; classtype:social-engineering; sid:6003582; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingro.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingro.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003583; classtype:social-engineering; sid:6003583; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pdf.streamlinedweb.de/PgpGG/)"; flow:established,to_server; http.uri; content:"/PgpGG/"; startswith; fast_pattern; http.host; content:"pdf.streamlinedweb.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003584; classtype:social-engineering; sid:6003584; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lflind-lcloud.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"lflind-lcloud.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003585; classtype:social-engineering; sid:6003585; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cambodiasustancert.wasmer.app/en/)"; flow:established,to_server; http.uri; content:"/en/"; startswith; fast_pattern; http.host; content:"cambodiasustancert.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003586; classtype:social-engineering; sid:6003586; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dispositivo-perdidomex.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"dispositivo-perdidomex.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003587; classtype:social-engineering; sid:6003587; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dycmch.com/xdnpwbin/)"; flow:established,to_server; http.uri; content:"/xdnpwbin/"; startswith; fast_pattern; http.host; content:"dycmch.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003588; classtype:social-engineering; sid:6003588; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (857365.cc/?a=352698)"; flow:established,to_server; http.uri; content:"/?a=352698"; startswith; fast_pattern; http.host; content:"857365.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003589; classtype:social-engineering; sid:6003589; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.862365.cc/?a=352698)"; flow:established,to_server; http.uri; content:"/?a=352698"; startswith; fast_pattern; http.host; content:"www.862365.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003590; classtype:social-engineering; sid:6003590; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-resmi559.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"program-resmi559.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003591; classtype:social-engineering; sid:6003591; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dispositivo-idcloud-ld.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"dispositivo-idcloud-ld.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003592; classtype:social-engineering; sid:6003592; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (notifications-iqeq.com/hfv0wtghmm78uwbq)"; flow:established,to_server; http.uri; content:"/hfv0wtghmm78uwbq"; startswith; fast_pattern; http.host; content:"notifications-iqeq.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003593; classtype:social-engineering; sid:6003593; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gezondheidscentrum-klntnr34821.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gezondheidscentrum-klntnr34821.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003594; classtype:social-engineering; sid:6003594; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flnd-lcloud-devic.help/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"flnd-lcloud-devic.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003595; classtype:social-engineering; sid:6003595; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.galeri-pemenang-shopee2021.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.galeri-pemenang-shopee2021.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003596; classtype:social-engineering; sid:6003596; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (locmy-phone.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"locmy-phone.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003597; classtype:social-engineering; sid:6003597; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support.northstarresolution.help/user-support/)"; flow:established,to_server; http.uri; content:"/user-support/"; startswith; fast_pattern; http.host; content:"support.northstarresolution.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003598; classtype:social-engineering; sid:6003598; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-io-trezoo-r.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-io-trezoo-r.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003599; classtype:social-engineering; sid:6003599; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kjhgrtykbhj-dpnfz9dllbs3.edgeone.cool/?eo_token=f285a2333820a1d57d4c9d3ac0b8d37d)"; flow:established,to_server; http.uri; content:"/?eo_token=f285a2333820a1d57d4c9d3ac0b8d37d"; startswith; fast_pattern; http.host; content:"kjhgrtykbhj-dpnfz9dllbs3.edgeone.cool"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003600; classtype:social-engineering; sid:6003600; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (layanan-undian56.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"layanan-undian56.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003601; classtype:social-engineering; sid:6003601; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mysql.tchosting.net/cgi-bin/home.ha/)"; flow:established,to_server; http.uri; content:"/cgi-bin/home.ha/"; startswith; fast_pattern; http.host; content:"mysql.tchosting.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003602; classtype:social-engineering; sid:6003602; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (custermerservices-marketingbranding-aitechen.br-gru-1.linodeobjects.com/index24.html)"; flow:established,to_server; http.uri; content:"/index24.html"; startswith; fast_pattern; http.host; content:"custermerservices-marketingbranding-aitechen.br-gru-1.linodeobjects.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003603; classtype:social-engineering; sid:6003603; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (upholdvip.im/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"upholdvip.im"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003604; classtype:social-engineering; sid:6003604; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vivacious-enthusiasm-422563.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vivacious-enthusiasm-422563.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003605; classtype:social-engineering; sid:6003605; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tech-liren.run/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"tech-liren.run"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003606; classtype:social-engineering; sid:6003606; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (20-215-49-139.cprapid.com/ch/kasse.php)"; flow:established,to_server; http.uri; content:"/ch/kasse.php"; startswith; fast_pattern; http.host; content:"20-215-49-139.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003607; classtype:social-engineering; sid:6003607; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ar245.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ar245.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003608; classtype:social-engineering; sid:6003608; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-account-ios.help/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"info-account-ios.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003609; classtype:social-engineering; sid:6003609; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home-faqs-trezr-io.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"home-faqs-trezr-io.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003610; classtype:social-engineering; sid:6003610; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-io-trezo-us.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-io-trezo-us.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003611; classtype:social-engineering; sid:6003611; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santunion.club/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"santunion.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003612; classtype:social-engineering; sid:6003612; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wanko-base.com/Aeroplan/shaw/index.html?id=033)"; flow:established,to_server; http.uri; content:"/Aeroplan/shaw/index.html?id=033"; startswith; fast_pattern; http.host; content:"wanko-base.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003613; classtype:social-engineering; sid:6003613; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sunillm2026.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"sunillm2026.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003614; classtype:social-engineering; sid:6003614; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pemenangshopee28.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pemenangshopee28.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003615; classtype:social-engineering; sid:6003615; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.program-resmi559.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.program-resmi559.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003616; classtype:social-engineering; sid:6003616; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hilfekunden.de/?r=b877e467-73a5-4134-a11e-e8e22b5353ac)"; flow:established,to_server; http.uri; content:"/?r=b877e467-73a5-4134-a11e-e8e22b5353ac"; startswith; fast_pattern; http.host; content:"hilfekunden.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003617; classtype:social-engineering; sid:6003617; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cyon-ch.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cyon-ch.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003618; classtype:social-engineering; sid:6003618; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cloud-icl-fml.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"cloud-icl-fml.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003619; classtype:social-engineering; sid:6003619; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faraz-khan-booking-com-clone-react-project-1-jza6qqtrfilv.vercel.app/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"faraz-khan-booking-com-clone-react-project-1-jza6qqtrfilv.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003620; classtype:social-engineering; sid:6003620; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (learn-trezo-io-web.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"learn-trezo-io-web.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003621; classtype:social-engineering; sid:6003621; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.aa1998brazil.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.aa1998brazil.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003622; classtype:social-engineering; sid:6003622; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apple-info-account.help/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"apple-info-account.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003623; classtype:social-engineering; sid:6003623; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecuador-lcloudd.help/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"ecuador-lcloudd.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003624; classtype:social-engineering; sid:6003624; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supportlogin.tredenece.com/?rid=6740508&f=1&key=aDTbPI)"; flow:established,to_server; http.uri; content:"/?rid=6740508&f=1&key=aDTbPI"; startswith; fast_pattern; http.host; content:"supportlogin.tredenece.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003625; classtype:social-engineering; sid:6003625; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.psand.sbs/ob53/)"; flow:established,to_server; http.uri; content:"/ob53/"; startswith; fast_pattern; http.host; content:"www.psand.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003626; classtype:social-engineering; sid:6003626; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7hjp8t.cn/mmixosct)"; flow:established,to_server; http.uri; content:"/mmixosct"; startswith; fast_pattern; http.host; content:"7hjp8t.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003627; classtype:social-engineering; sid:6003627; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mathentertianment.com/utl/)"; flow:established,to_server; http.uri; content:"/utl/"; startswith; fast_pattern; http.host; content:"mathentertianment.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003628; classtype:social-engineering; sid:6003628; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (encrypt-email.org/landing/form/540a12c8-6a32-4287-8fd5-a977aaf4451c)"; flow:established,to_server; http.uri; content:"/landing/form/540a12c8-6a32-4287-8fd5-a977aaf4451c"; startswith; fast_pattern; http.host; content:"encrypt-email.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003629; classtype:social-engineering; sid:6003629; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reservierung.dpdns.org/cash35658768)"; flow:established,to_server; http.uri; content:"/cash35658768"; startswith; fast_pattern; http.host; content:"reservierung.dpdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003630; classtype:social-engineering; sid:6003630; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-1cloud-find-1.com/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"app-1cloud-find-1.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003631; classtype:social-engineering; sid:6003631; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (encontrar-i-phone.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"encontrar-i-phone.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003632; classtype:social-engineering; sid:6003632; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-drurnex-biz-fraltek-vrolnix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-drurnex-biz-fraltek-vrolnix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003633; classtype:social-engineering; sid:6003633; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9000-firebase-authenticate-1781494318542.cluster-c72u3gwiofapkvxrcwjq5zllcu.cloudworkstations.dev/?monospaceUid=88952)"; flow:established,to_server; http.uri; content:"/?monospaceUid=88952"; startswith; fast_pattern; http.host; content:"9000-firebase-authenticate-1781494318542.cluster-c72u3gwiofapkvxrcwjq5zllcu.cloudworkstations.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003634; classtype:social-engineering; sid:6003634; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maps-ubi-localizado.com/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"maps-ubi-localizado.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003635; classtype:social-engineering; sid:6003635; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (findldmaps-asistenmxn.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"findldmaps-asistenmxn.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003636; classtype:social-engineering; sid:6003636; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (worker-shy-sky-e17b.kidic25665.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"worker-shy-sky-e17b.kidic25665.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003637; classtype:social-engineering; sid:6003637; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www_c-tlc_com.xc9888.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www_c-tlc_com.xc9888.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003638; classtype:social-engineering; sid:6003638; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www-appid-buscar-phone.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"www-appid-buscar-phone.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003639; classtype:social-engineering; sid:6003639; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (calendar-invites.com/landing/form/42b2f68d-7176-4b69-9ad3-1912810401ba)"; flow:established,to_server; http.uri; content:"/landing/form/42b2f68d-7176-4b69-9ad3-1912810401ba"; startswith; fast_pattern; http.host; content:"calendar-invites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003640; classtype:social-engineering; sid:6003640; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-account-ios26.help/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"info-account-ios26.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003641; classtype:social-engineering; sid:6003641; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store.workshopcommunityratemods.com/sharedfiles/filesdetails/id=35225482508/)"; flow:established,to_server; http.uri; content:"/sharedfiles/filesdetails/id=35225482508/"; startswith; fast_pattern; http.host; content:"store.workshopcommunityratemods.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003642; classtype:social-engineering; sid:6003642; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.lootscanner.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.lootscanner.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003643; classtype:social-engineering; sid:6003643; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pemenangshopee28.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pemenangshopee28.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003644; classtype:social-engineering; sid:6003644; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (passcode-apple-id-lost-phone.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"passcode-apple-id-lost-phone.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003645; classtype:social-engineering; sid:6003645; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (umegasortemusical.com.br/ap/index.html)"; flow:established,to_server; http.uri; content:"/ap/index.html"; startswith; fast_pattern; http.host; content:"umegasortemusical.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003646; classtype:social-engineering; sid:6003646; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.89fcbr1.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.89fcbr1.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003647; classtype:social-engineering; sid:6003647; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lphone-i-cloudmaps.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"lphone-i-cloudmaps.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003648; classtype:social-engineering; sid:6003648; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adbesta-dp1kudlt0rsh.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"adbesta-dp1kudlt0rsh.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003649; classtype:social-engineering; sid:6003649; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (welcome-trezorai-com.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"welcome-trezorai-com.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003650; classtype:social-engineering; sid:6003650; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accesomex-lcloud.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"accesomex-lcloud.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003651; classtype:social-engineering; sid:6003651; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9000-firebase-ml-1781591956243.cluster-l2bgochoazbomqgfmlhuvdvgiy.cloudworkstations.dev/?monospaceUid=1412)"; flow:established,to_server; http.uri; content:"/?monospaceUid=1412"; startswith; fast_pattern; http.host; content:"9000-firebase-ml-1781591956243.cluster-l2bgochoazbomqgfmlhuvdvgiy.cloudworkstations.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003652; classtype:social-engineering; sid:6003652; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-gpt-fawn.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-gpt-fawn.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003653; classtype:social-engineering; sid:6003653; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloud-usa-mx.com/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"icloud-usa-mx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003654; classtype:social-engineering; sid:6003654; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jrzwlxqp.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jrzwlxqp.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003655; classtype:social-engineering; sid:6003655; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (encontrar-mapps.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"encontrar-mapps.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003656; classtype:social-engineering; sid:6003656; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thrshopee227.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"thrshopee227.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003657; classtype:social-engineering; sid:6003657; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ac-oll-15060101010101010101.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ac-oll-15060101010101010101.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003658; classtype:social-engineering; sid:6003658; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrp.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingrp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003659; classtype:social-engineering; sid:6003659; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (layanan-hadiah99.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"layanan-hadiah99.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003660; classtype:social-engineering; sid:6003660; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xljxx.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xljxx.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003661; classtype:social-engineering; sid:6003661; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (doguru.co.il/night/)"; flow:established,to_server; http.uri; content:"/night/"; startswith; fast_pattern; http.host; content:"doguru.co.il"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003662; classtype:social-engineering; sid:6003662; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-8234218404-chainpayout-net.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-8234218404-chainpayout-net.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003663; classtype:social-engineering; sid:6003663; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (finmy-phonesupport.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"finmy-phonesupport.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003664; classtype:social-engineering; sid:6003664; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dubai---bookingcom.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dubai---bookingcom.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003665; classtype:social-engineering; sid:6003665; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store-phon-net.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"store-phon-net.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003666; classtype:social-engineering; sid:6003666; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (port10.govisibl.com/dlv/c.php?cca=273138&ccz=6740&cid=w0qoior66jk9dp5j31ojdcta&siteid=)"; flow:established,to_server; http.uri; content:"/dlv/c.php?cca=273138&ccz=6740&cid=w0qoior66jk9dp5j31ojdcta&siteid="; startswith; fast_pattern; http.host; content:"port10.govisibl.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003667; classtype:social-engineering; sid:6003667; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (personal-adm-inf-iniciarr.iceiy.com/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"personal-adm-inf-iniciarr.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003668; classtype:social-engineering; sid:6003668; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerservicel.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerservicel.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003669; classtype:social-engineering; sid:6003669; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (propocisionmandate-rolexsa.us-east-1.linodeobjects.com/checkers.html)"; flow:established,to_server; http.uri; content:"/checkers.html"; startswith; fast_pattern; http.host; content:"propocisionmandate-rolexsa.us-east-1.linodeobjects.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003670; classtype:social-engineering; sid:6003670; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support.vanguardresolution.help/user-support/)"; flow:established,to_server; http.uri; content:"/user-support/"; startswith; fast_pattern; http.host; content:"support.vanguardresolution.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003671; classtype:social-engineering; sid:6003671; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kys3l.xljxx.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kys3l.xljxx.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003672; classtype:social-engineering; sid:6003672; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lcloud-accesomex.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"lcloud-accesomex.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003673; classtype:social-engineering; sid:6003673; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trazer-ai-bridge.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trazer-ai-bridge.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003674; classtype:social-engineering; sid:6003674; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-gpt-fawn.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-gpt-fawn.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003675; classtype:social-engineering; sid:6003675; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (localizado-maps-mx.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"localizado-maps-mx.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003676; classtype:social-engineering; sid:6003676; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flnd-iph-fmi.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"flnd-iph-fmi.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003677; classtype:social-engineering; sid:6003677; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flnd-iph-icl.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"flnd-iph-icl.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003678; classtype:social-engineering; sid:6003678; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (swaeba-bilal.github.io/Amazon_clone)"; flow:established,to_server; http.uri; content:"/Amazon_clone"; startswith; fast_pattern; http.host; content:"swaeba-bilal.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003679; classtype:social-engineering; sid:6003679; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rahul-kumar-mahato.github.io/netflix)"; flow:established,to_server; http.uri; content:"/netflix"; startswith; fast_pattern; http.host; content:"rahul-kumar-mahato.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003680; classtype:social-engineering; sid:6003680; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezur-feq-str.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezur-feq-str.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003681; classtype:social-engineering; sid:6003681; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.exodussupport.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.exodussupport.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003682; classtype:social-engineering; sid:6003682; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eat-co.com/wex/omo.html)"; flow:established,to_server; http.uri; content:"/wex/omo.html"; startswith; fast_pattern; http.host; content:"eat-co.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003683; classtype:social-engineering; sid:6003683; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (parafusacos.com.br/?id=arjuna189)"; flow:established,to_server; http.uri; content:"/?id=arjuna189"; startswith; fast_pattern; http.host; content:"parafusacos.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003684; classtype:social-engineering; sid:6003684; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jrzwpxql.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jrzwpxql.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003685; classtype:social-engineering; sid:6003685; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iclodmx-help-me.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"iclodmx-help-me.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003686; classtype:social-engineering; sid:6003686; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clickitonce.com/ee71e6/xoxo/sms.php/)"; flow:established,to_server; http.uri; content:"/ee71e6/xoxo/sms.php/"; startswith; fast_pattern; http.host; content:"clickitonce.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003687; classtype:social-engineering; sid:6003687; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ios26-maps.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"ios26-maps.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003688; classtype:social-engineering; sid:6003688; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (learn-hardware_tezo-en.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"learn-hardware_tezo-en.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003689; classtype:social-engineering; sid:6003689; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lcloud-buscarmaps.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"lcloud-buscarmaps.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003690; classtype:social-engineering; sid:6003690; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (localmedicalmarijuana.com/e9fc99/gh/uop.html?email=oronpro@88d643cd7fbc42b89a3ad14918a81998d156.org)"; flow:established,to_server; http.uri; content:"/e9fc99/gh/uop.html?email=oronpro@88d643cd7fbc42b89a3ad14918a81998d156.org"; startswith; fast_pattern; http.host; content:"localmedicalmarijuana.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003691; classtype:social-engineering; sid:6003691; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apple-maps.info/nbG)"; flow:established,to_server; http.uri; content:"/nbG"; startswith; fast_pattern; http.host; content:"apple-maps.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003692; classtype:social-engineering; sid:6003692; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app121624.hasspetorleum.com/r/?auth=69c1701f7cf79db6&u=aHR0cHM6Ly8xMDEtcGVyc29uYWwtcHJvamVjdHMtdGVzdGluZy5hcHB3cml0ZS5uZXR3b3JrLz9hdXRoPWxvbGl0YS5tYXRldUB2bnVrb3ZvLnJ1)"; flow:established,to_server; http.uri; content:"/r/?auth=69c1701f7cf79db6&u=aHR0cHM6Ly8xMDEtcGVyc29uYWwtcHJvamVjdHMtdGVzdGluZy5hcHB3cml0ZS5uZXR3b3JrLz9hdXRoPWxvbGl0YS5tYXRldUB2bnVrb3ZvLnJ1"; startswith; fast_pattern; http.host; content:"app121624.hasspetorleum.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003693; classtype:social-engineering; sid:6003693; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atleticacentrolario.it/se/ur/)"; flow:established,to_server; http.uri; content:"/se/ur/"; startswith; fast_pattern; http.host; content:"atleticacentrolario.it"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003694; classtype:social-engineering; sid:6003694; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutch.wc0759.com/Nhri3EaMBl?m=5)"; flow:established,to_server; http.uri; content:"/Nhri3EaMBl?m=5"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutch.wc0759.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003695; classtype:social-engineering; sid:6003695; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgr-start.zapier.app/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"ledgr-start.zapier.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003696; classtype:social-engineering; sid:6003696; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fifaworldcup-jobs.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fifaworldcup-jobs.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003697; classtype:social-engineering; sid:6003697; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (casobancamiga.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"casobancamiga.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003698; classtype:social-engineering; sid:6003698; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (frgrgjfeijfegrfeifei.cfolks.pl/cr/fo/)"; flow:established,to_server; http.uri; content:"/cr/fo/"; startswith; fast_pattern; http.host; content:"frgrgjfeijfegrfeifei.cfolks.pl"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003699; classtype:social-engineering; sid:6003699; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.1020smart9381.baby/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.1020smart9381.baby"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003700; classtype:social-engineering; sid:6003700; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie.smart93818192.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.smart93818192.xyz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003701; classtype:social-engineering; sid:6003701; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fifahiring.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fifahiring.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003702; classtype:social-engineering; sid:6003702; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shubhamvatsjha7.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"shubhamvatsjha7.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003703; classtype:social-engineering; sid:6003703; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ww547.terbaru-2023.com/?tkn=19vnMT3S)"; flow:established,to_server; http.uri; content:"/?tkn=19vnMT3S"; startswith; fast_pattern; http.host; content:"ww547.terbaru-2023.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003704; classtype:social-engineering; sid:6003704; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (drivkac.click/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&dsh=S-1892784165%3A1781648110060649&followup=https%3A%2F%2Faccounts.google.com%2F&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AcDsRvw8PExz_ljCTZXq-X3AGuhctgFBkOVRiY99zYNj0_j3GzpVDxd2QQZUHwXnowNAmlgtfYT_9w)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&dsh=S-1892784165%3A1781648110060649&followup=https%3A%2F%2Faccounts.google.com%2F&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AcDsRvw8PExz_ljCTZXq-X3AGuhctgFBkOVRiY99zYNj0_j3GzpVDxd2QQZUHwXnowNAmlgtfYT_9w"; startswith; fast_pattern; http.host; content:"drivkac.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003705; classtype:social-engineering; sid:6003705; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ptshopee445.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ptshopee445.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003706; classtype:social-engineering; sid:6003706; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.aceccessos2026.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.aceccessos2026.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003707; classtype:social-engineering; sid:6003707; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.lhh.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.lhh.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003708; classtype:social-engineering; sid:6003708; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerservicem.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerservicem.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003709; classtype:social-engineering; sid:6003709; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (microsoft-login.praetoria.fr/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"microsoft-login.praetoria.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003710; classtype:social-engineering; sid:6003710; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (expatgold.asia/law.php/)"; flow:established,to_server; http.uri; content:"/law.php/"; startswith; fast_pattern; http.host; content:"expatgold.asia"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003711; classtype:social-engineering; sid:6003711; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crsorgi-gov.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"crsorgi-gov.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003712; classtype:social-engineering; sid:6003712; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vdhd.fr/pay/login.php)"; flow:established,to_server; http.uri; content:"/pay/login.php"; startswith; fast_pattern; http.host; content:"vdhd.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003713; classtype:social-engineering; sid:6003713; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8yaz-k3zj-br05.cebsgroupsreceivables-ar-caesars-com-s-account.workers.dev/06846646a4b32744?email=renen1@33bc362c7d0244c23e91b0064ac18bee8a4a.com/)"; flow:established,to_server; http.uri; content:"/06846646a4b32744?email=renen1@33bc362c7d0244c23e91b0064ac18bee8a4a.com/"; startswith; fast_pattern; http.host; content:"8yaz-k3zj-br05.cebsgroupsreceivables-ar-caesars-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003714; classtype:social-engineering; sid:6003714; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumento86.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumento86.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003715; classtype:social-engineering; sid:6003715; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (office365.rricrosoft-offices.org/i/df3667320560f4a8a9918ef9f3f4c4383)"; flow:established,to_server; http.uri; content:"/i/df3667320560f4a8a9918ef9f3f4c4383"; startswith; fast_pattern; http.host; content:"office365.rricrosoft-offices.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003716; classtype:social-engineering; sid:6003716; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rohit-123-vii.github.io/project-1.html/)"; flow:established,to_server; http.uri; content:"/project-1.html/"; startswith; fast_pattern; http.host; content:"rohit-123-vii.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003717; classtype:social-engineering; sid:6003717; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.2017winplataforma1.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.2017winplataforma1.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003718; classtype:social-engineering; sid:6003718; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cpcodm.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cpcodm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003719; classtype:social-engineering; sid:6003719; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (soft-states-572702.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"soft-states-572702.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003720; classtype:social-engineering; sid:6003720; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ri5-cbfga3eueneqa2g8.z02.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ri5-cbfga3eueneqa2g8.z02.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003721; classtype:social-engineering; sid:6003721; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (getvalued.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"getvalued.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003722; classtype:social-engineering; sid:6003722; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (leboncoin.vdhd.fr/pay/login.php)"; flow:established,to_server; http.uri; content:"/pay/login.php"; startswith; fast_pattern; http.host; content:"leboncoin.vdhd.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003723; classtype:social-engineering; sid:6003723; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (owa-production-26ca.up.railway.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"owa-production-26ca.up.railway.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003724; classtype:social-engineering; sid:6003724; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vivektiwari2006.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"vivektiwari2006.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003725; classtype:social-engineering; sid:6003725; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (admanagement.do/water)"; flow:established,to_server; http.uri; content:"/water"; startswith; fast_pattern; http.host; content:"admanagement.do"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003726; classtype:social-engineering; sid:6003726; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc.crsorgi.gov.in.verfiys.in/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dc.crsorgi.gov.in.verfiys.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003727; classtype:social-engineering; sid:6003727; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bx55-a.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bx55-a.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003728; classtype:social-engineering; sid:6003728; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sejamaisfelizccomseunovolmt.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"sejamaisfelizccomseunovolmt.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003729; classtype:social-engineering; sid:6003729; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabetin.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabetin.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003730; classtype:social-engineering; sid:6003730; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.endive-iris-7232.squarespace.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.endive-iris-7232.squarespace.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003731; classtype:social-engineering; sid:6003731; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a0lp34.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a0lp34.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003732; classtype:social-engineering; sid:6003732; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gaganvaishnav208.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"gaganvaishnav208.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003733; classtype:social-engineering; sid:6003733; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja83.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja83.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003734; classtype:social-engineering; sid:6003734; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc.crsorgi.gov.in.veriye.in/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dc.crsorgi.gov.in.veriye.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003735; classtype:social-engineering; sid:6003735; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-trezorr-suit.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"help-trezorr-suit.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003736; classtype:social-engineering; sid:6003736; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gbwta.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gbwta.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003737; classtype:social-engineering; sid:6003737; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc.crsorgi.gov.in.verfy.store/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dc.crsorgi.gov.in.verfy.store"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003738; classtype:social-engineering; sid:6003738; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tanakabauer.info/41-1511-280526/?u=162C1515&e=haruschmi%2540gmail.com&s3=Hansruedi&s4=Schmidlin&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/41-1511-280526/?u=162C1515&e=haruschmi%2540gmail.com&s3=Hansruedi&s4=Schmidlin&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"tanakabauer.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003739; classtype:social-engineering; sid:6003739; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coxon8.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coxon8.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003740; classtype:social-engineering; sid:6003740; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerservicec.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerservicec.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003741; classtype:social-engineering; sid:6003741; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thrshopee16.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"thrshopee16.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003742; classtype:social-engineering; sid:6003742; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nithishjadhav-jn.github.io/netflix-homepage-clone/)"; flow:established,to_server; http.uri; content:"/netflix-homepage-clone/"; startswith; fast_pattern; http.host; content:"nithishjadhav-jn.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003743; classtype:social-engineering; sid:6003743; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sorer.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sorer.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003744; classtype:social-engineering; sid:6003744; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ccyyz.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ccyyz.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003745; classtype:social-engineering; sid:6003745; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (privacy-help-authority.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"privacy-help-authority.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003746; classtype:social-engineering; sid:6003746; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.dmibgc.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.dmibgc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003747; classtype:social-engineering; sid:6003747; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc.crsorgi.gov.in.index.web-index.info/general-public)"; flow:established,to_server; http.uri; content:"/general-public"; startswith; fast_pattern; http.host; content:"dc.crsorgi.gov.in.index.web-index.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003748; classtype:social-engineering; sid:6003748; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerserviceqt.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerserviceqt.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003749; classtype:social-engineering; sid:6003749; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spacepotato08.neocities.org/iclanda/)"; flow:established,to_server; http.uri; content:"/iclanda/"; startswith; fast_pattern; http.host; content:"spacepotato08.neocities.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003750; classtype:social-engineering; sid:6003750; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nanigudivaka.github.io/Amazon-clone-with-JavaScript)"; flow:established,to_server; http.uri; content:"/Amazon-clone-with-JavaScript"; startswith; fast_pattern; http.host; content:"nanigudivaka.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003751; classtype:social-engineering; sid:6003751; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (efficacyheatficient.sbs/auth/)"; flow:established,to_server; http.uri; content:"/auth/"; startswith; fast_pattern; http.host; content:"efficacyheatficient.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003752; classtype:social-engineering; sid:6003752; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (organizacaotudo.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"organizacaotudo.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003753; classtype:social-engineering; sid:6003753; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ka.bjpglyg.com/cgi/)"; flow:established,to_server; http.uri; content:"/cgi/"; startswith; fast_pattern; http.host; content:"ka.bjpglyg.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003754; classtype:social-engineering; sid:6003754; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.trendymods.net/robux/index.html)"; flow:established,to_server; http.uri; content:"/robux/index.html"; startswith; fast_pattern; http.host; content:"www.trendymods.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003755; classtype:social-engineering; sid:6003755; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ggsgsgsgdjjczkjgjkggacggc-dpqt3wpkjdo9.edgeone.dev/english.html)"; flow:established,to_server; http.uri; content:"/english.html"; startswith; fast_pattern; http.host; content:"ggsgsgsgdjjczkjgjkggacggc-dpqt3wpkjdo9.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003756; classtype:social-engineering; sid:6003756; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (linkqr.id/s/pontun)"; flow:established,to_server; http.uri; content:"/s/pontun"; startswith; fast_pattern; http.host; content:"linkqr.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003757; classtype:social-engineering; sid:6003757; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (api-guide.orange-maroc.net/tableau-de-bord/login)"; flow:established,to_server; http.uri; content:"/tableau-de-bord/login"; startswith; fast_pattern; http.host; content:"api-guide.orange-maroc.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003758; classtype:social-engineering; sid:6003758; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ioannashellenichospitality.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ioannashellenichospitality.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003759; classtype:social-engineering; sid:6003759; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.smca.info/mwhips-invoice/)"; flow:established,to_server; http.uri; content:"/mwhips-invoice/"; startswith; fast_pattern; http.host; content:"www.smca.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003760; classtype:social-engineering; sid:6003760; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account.confirm-meta-badge.info/favicon.ico)"; flow:established,to_server; http.uri; content:"/favicon.ico"; startswith; fast_pattern; http.host; content:"account.confirm-meta-badge.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003761; classtype:social-engineering; sid:6003761; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (z8h9-bw89-fvck.css-sleepbetteraustin-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"z8h9-bw89-fvck.css-sleepbetteraustin-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003762; classtype:social-engineering; sid:6003762; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gopal.business/ok/rogers)"; flow:established,to_server; http.uri; content:"/ok/rogers"; startswith; fast_pattern; http.host; content:"gopal.business"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003763; classtype:social-engineering; sid:6003763; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xj.flez.biz.id/ambill.sawerann)"; flow:established,to_server; http.uri; content:"/ambill.sawerann"; startswith; fast_pattern; http.host; content:"xj.flez.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003764; classtype:social-engineering; sid:6003764; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kritika963.github.io/Amazon-2.0/)"; flow:established,to_server; http.uri; content:"/Amazon-2.0/"; startswith; fast_pattern; http.host; content:"kritika963.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003765; classtype:social-engineering; sid:6003765; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ppyl.buzz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ppyl.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003766; classtype:social-engineering; sid:6003766; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (siteblasterco.productaccess.in/wp-includes/clone/flit/rab/hndawtw/ZXZhc3VAaGFydmF0ZWsuY29tLnR3)"; flow:established,to_server; http.uri; content:"/wp-includes/clone/flit/rab/hndawtw/ZXZhc3VAaGFydmF0ZWsuY29tLnR3"; startswith; fast_pattern; http.host; content:"siteblasterco.productaccess.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003767; classtype:social-engineering; sid:6003767; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fedxscan.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fedxscan.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003768; classtype:social-engineering; sid:6003768; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freeflowbrasil.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"freeflowbrasil.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003769; classtype:social-engineering; sid:6003769; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerservicev.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerservicev.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003770; classtype:social-engineering; sid:6003770; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mujakkir-maher.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"mujakkir-maher.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003771; classtype:social-engineering; sid:6003771; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qxlyhl.com/xdnpwbin/)"; flow:established,to_server; http.uri; content:"/xdnpwbin/"; startswith; fast_pattern; http.host; content:"qxlyhl.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003772; classtype:social-engineering; sid:6003772; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (presudeind3xsoff-dpr3nq7g30sv.edgeone.dev/indexs.html)"; flow:established,to_server; http.uri; content:"/indexs.html"; startswith; fast_pattern; http.host; content:"presudeind3xsoff-dpr3nq7g30sv.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003773; classtype:social-engineering; sid:6003773; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (index-zeo.nasser-kineticsgroup-ae-s-account.workers.dev/bf3bb6f1918f9e9f/)"; flow:established,to_server; http.uri; content:"/bf3bb6f1918f9e9f/"; startswith; fast_pattern; http.host; content:"index-zeo.nasser-kineticsgroup-ae-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003774; classtype:social-engineering; sid:6003774; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alexgalho.com.br/anodur)"; flow:established,to_server; http.uri; content:"/anodur"; startswith; fast_pattern; http.host; content:"alexgalho.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003775; classtype:social-engineering; sid:6003775; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cg6681.craftum.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cg6681.craftum.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003776; classtype:social-engineering; sid:6003776; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookmessenger12.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"facebookmessenger12.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003777; classtype:social-engineering; sid:6003777; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instantformhdc.com/pages/captcha.php)"; flow:established,to_server; http.uri; content:"/pages/captcha.php"; startswith; fast_pattern; http.host; content:"instantformhdc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003778; classtype:social-engineering; sid:6003778; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jk-1914.github.io/Netflix-UI-Clone)"; flow:established,to_server; http.uri; content:"/Netflix-UI-Clone"; startswith; fast_pattern; http.host; content:"jk-1914.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003779; classtype:social-engineering; sid:6003779; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freeflowoficial.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"freeflowoficial.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003780; classtype:social-engineering; sid:6003780; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fogdev.icecubestudio.com/wp-doc/fileshared/)"; flow:established,to_server; http.uri; content:"/wp-doc/fileshared/"; startswith; fast_pattern; http.host; content:"fogdev.icecubestudio.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003781; classtype:social-engineering; sid:6003781; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bptransport.ch/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bptransport.ch"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003782; classtype:social-engineering; sid:6003782; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc.crsorgi.gov.in.web.dccertificate.in/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dc.crsorgi.gov.in.web.dccertificate.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003783; classtype:social-engineering; sid:6003783; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreicjsieopcis332voy6xbzi2farum3qrvhqnxvykv3vulhw2wj6y7m.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreicjsieopcis332voy6xbzi2farum3qrvhqnxvykv3vulhw2wj6y7m.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003784; classtype:social-engineering; sid:6003784; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instruction-upslux-2026.com/app/index.php?view=main&id=da55a61adfa44ac5b0c4e5080b19a95c)"; flow:established,to_server; http.uri; content:"/app/index.php?view=main&id=da55a61adfa44ac5b0c4e5080b19a95c"; startswith; fast_pattern; http.host; content:"instruction-upslux-2026.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003785; classtype:social-engineering; sid:6003785; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (takami-web.co.jp/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"takami-web.co.jp"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003786; classtype:social-engineering; sid:6003786; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (garakuta-ichi.net/wordpress/wp-content/plugins/made/membercenter.made-in-china.com/index.html)"; flow:established,to_server; http.uri; content:"/wordpress/wp-content/plugins/made/membercenter.made-in-china.com/index.html"; startswith; fast_pattern; http.host; content:"garakuta-ichi.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003787; classtype:social-engineering; sid:6003787; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (68-210-101-96.cprapid.com/de/)"; flow:established,to_server; http.uri; content:"/de/"; startswith; fast_pattern; http.host; content:"68-210-101-96.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003788; classtype:social-engineering; sid:6003788; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aujhmv.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aujhmv.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003789; classtype:social-engineering; sid:6003789; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (knowledgeable-beige-turtle.31-22-7-7.cpanel.site/mini/)"; flow:established,to_server; http.uri; content:"/mini/"; startswith; fast_pattern; http.host; content:"knowledgeable-beige-turtle.31-22-7-7.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003790; classtype:social-engineering; sid:6003790; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.authsusngwd0c34748dhbdr673hndy73if5revssharepoint.cscllccmo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.authsusngwd0c34748dhbdr673hndy73if5revssharepoint.cscllccmo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003791; classtype:social-engineering; sid:6003791; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.seuabudcrx.yoga/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.seuabudcrx.yoga"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003792; classtype:social-engineering; sid:6003792; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9000-firebase-link-1781076144085.cluster-dccle54vc5d26v2fsixd2icgqi.cloudworkstations.dev/?monospaceUid=119697)"; flow:established,to_server; http.uri; content:"/?monospaceUid=119697"; startswith; fast_pattern; http.host; content:"9000-firebase-link-1781076144085.cluster-dccle54vc5d26v2fsixd2icgqi.cloudworkstations.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003793; classtype:social-engineering; sid:6003793; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tiktokseller.aoyolo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tiktokseller.aoyolo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003794; classtype:social-engineering; sid:6003794; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dev3.ictusinitiative.net/app/)"; flow:established,to_server; http.uri; content:"/app/"; startswith; fast_pattern; http.host; content:"dev3.ictusinitiative.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003795; classtype:social-engineering; sid:6003795; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja82.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja82.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003796; classtype:social-engineering; sid:6003796; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thrshopee29.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"thrshopee29.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003797; classtype:social-engineering; sid:6003797; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spotify-modapk.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spotify-modapk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003798; classtype:social-engineering; sid:6003798; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (khlaidcodestudent.github.io/Amazon-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-Clone"; startswith; fast_pattern; http.host; content:"khlaidcodestudent.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003799; classtype:social-engineering; sid:6003799; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortval.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortval.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003800; classtype:social-engineering; sid:6003800; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jshfmy_com.zhukangwang.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jshfmy_com.zhukangwang.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003801; classtype:social-engineering; sid:6003801; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (descaro.com/wetransfer/)"; flow:established,to_server; http.uri; content:"/wetransfer/"; startswith; fast_pattern; http.host; content:"descaro.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003802; classtype:social-engineering; sid:6003802; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.puratonpothik.com/policy/)"; flow:established,to_server; http.uri; content:"/policy/"; startswith; fast_pattern; http.host; content:"www.puratonpothik.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003803; classtype:social-engineering; sid:6003803; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hklogin.uat.mizuhoscfglobal.com/oauth2/authorize?response_type=code&client_id=bca4f495-a205-4cb4-8b0a-07f4d88a7584&scope=openid%20email%20profile&state=CeEiDbj5pJ71cSO2lzi7pvcGOXH7mmevbD7DFNqgeXo%3D&redirect_uri=https://hk.uat.mizuhoscfglobal.com/scf/login/oauth2/code/fusionauth&nonce=-f1ca21YpsZjdNfCQ4Svmqe-0XxilP2uxOGLJ32BGs8)"; flow:established,to_server; http.uri; content:"/oauth2/authorize?response_type=code&client_id=bca4f495-a205-4cb4-8b0a-07f4d88a7584&scope=openid%20email%20profile&state=CeEiDbj5pJ71cSO2lzi7pvcGOXH7mmevbD7DFNqgeXo%3D&redirect_uri=https://hk.uat.mizuhoscfglobal.com/scf/login/oauth2/code/fusionauth&nonce=-f1ca21YpsZjdNfCQ4Svmqe-0XxilP2uxOGLJ32BGs8"; startswith; fast_pattern; http.host; content:"hklogin.uat.mizuhoscfglobal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003804; classtype:social-engineering; sid:6003804; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docment.e-docssign.net/education_redirect_second?5372b28b-1718-482e-afd8-5ae0571cba68)"; flow:established,to_server; http.uri; content:"/education_redirect_second?5372b28b-1718-482e-afd8-5ae0571cba68"; startswith; fast_pattern; http.host; content:"docment.e-docssign.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003805; classtype:social-engineering; sid:6003805; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docs.eu.itpatches.com/3/5ac856/239e406a-cc37-43b0-8942-f022375ca24c)"; flow:established,to_server; http.uri; content:"/3/5ac856/239e406a-cc37-43b0-8942-f022375ca24c"; startswith; fast_pattern; http.host; content:"docs.eu.itpatches.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003806; classtype:social-engineering; sid:6003806; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telllstraaadminnn.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telllstraaadminnn.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003807; classtype:social-engineering; sid:6003807; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloudconect.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"icloudconect.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003808; classtype:social-engineering; sid:6003808; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebookmessenger12.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebookmessenger12.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003809; classtype:social-engineering; sid:6003809; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (snehagarasiya7-rgb.github.io/Amazon-clone)"; flow:established,to_server; http.uri; content:"/Amazon-clone"; startswith; fast_pattern; http.host; content:"snehagarasiya7-rgb.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003810; classtype:social-engineering; sid:6003810; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucoinlogn.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kucoinlogn.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003811; classtype:social-engineering; sid:6003811; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apac.orbitor.dev/ipfs/bafkreicz4wawzt7jznunnkmaju3oqhe2vsokbca7jkc75tdo7w64ccedgy/)"; flow:established,to_server; http.uri; content:"/ipfs/bafkreicz4wawzt7jznunnkmaju3oqhe2vsokbca7jkc75tdo7w64ccedgy/"; startswith; fast_pattern; http.host; content:"apac.orbitor.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003812; classtype:social-engineering; sid:6003812; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (daanaindoonesiaz.resmi-exs.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"daanaindoonesiaz.resmi-exs.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003813; classtype:social-engineering; sid:6003813; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (withered-darkness-de12.eqfmevdlxnlojrqlxa.workers.dev/meta.help)"; flow:established,to_server; http.uri; content:"/meta.help"; startswith; fast_pattern; http.host; content:"withered-darkness-de12.eqfmevdlxnlojrqlxa.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003814; classtype:social-engineering; sid:6003814; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pay-paypaynejp87288i.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pay-paypaynejp87288i.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003815; classtype:social-engineering; sid:6003815; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.avocatsabrinaene.ro/wp/invoice/)"; flow:established,to_server; http.uri; content:"/wp/invoice/"; startswith; fast_pattern; http.host; content:"www.avocatsabrinaene.ro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003816; classtype:social-engineering; sid:6003816; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.telllstraaadminnn.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.telllstraaadminnn.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003817; classtype:social-engineering; sid:6003817; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerserviceh.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerserviceh.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003818; classtype:social-engineering; sid:6003818; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lnfww.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lnfww.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003819; classtype:social-engineering; sid:6003819; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pagesystemsupportfor.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pagesystemsupportfor.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003820; classtype:social-engineering; sid:6003820; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zxcvbnmnbvcvbnmnmn-dpd500wql2ak.edgeone.dev/english.html)"; flow:established,to_server; http.uri; content:"/english.html"; startswith; fast_pattern; http.host; content:"zxcvbnmnbvcvbnmnmn-dpd500wql2ak.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003821; classtype:social-engineering; sid:6003821; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (index-qf0.sales-masterelevatorparts-com-s-account.workers.dev/7ba748bfc6436733/)"; flow:established,to_server; http.uri; content:"/7ba748bfc6436733/"; startswith; fast_pattern; http.host; content:"index-qf0.sales-masterelevatorparts-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003822; classtype:social-engineering; sid:6003822; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeeprize339.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopeeprize339.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003823; classtype:social-engineering; sid:6003823; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (on-pedagiofreeflow.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"on-pedagiofreeflow.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003824; classtype:social-engineering; sid:6003824; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anszrgg.cloud-ip.cc/RR82358239/CA/)"; flow:established,to_server; http.uri; content:"/RR82358239/CA/"; startswith; fast_pattern; http.host; content:"anszrgg.cloud-ip.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003825; classtype:social-engineering; sid:6003825; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shivraj6868.github.io/Amazon-Clone-)"; flow:established,to_server; http.uri; content:"/Amazon-Clone-"; startswith; fast_pattern; http.host; content:"shivraj6868.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003826; classtype:social-engineering; sid:6003826; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (businees-verify-badge-vip-123634cv.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"businees-verify-badge-vip-123634cv.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003827; classtype:social-engineering; sid:6003827; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rbux4aall.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rbux4aall.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003828; classtype:social-engineering; sid:6003828; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rewardstasksnew.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rewardstasksnew.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003829; classtype:social-engineering; sid:6003829; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (if4522.craftum.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"if4522.craftum.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003830; classtype:social-engineering; sid:6003830; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (garakutaichi.com/wordpress/wp-content/plugins/made/membercenter.made-in-china.com/index.html)"; flow:established,to_server; http.uri; content:"/wordpress/wp-content/plugins/made/membercenter.made-in-china.com/index.html"; startswith; fast_pattern; http.host; content:"garakutaichi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003831; classtype:social-engineering; sid:6003831; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wpqpdldsallslsss.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wpqpdldsallslsss.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003832; classtype:social-engineering; sid:6003832; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (r7f1c8d4a6e23f9c5d1a7b0e4c8f6291.oimf.com.tr/?email=halusx@63481ae7644a83de534c949ec4ff91f873e1.org)"; flow:established,to_server; http.uri; content:"/?email=halusx@63481ae7644a83de534c949ec4ff91f873e1.org"; startswith; fast_pattern; http.host; content:"r7f1c8d4a6e23f9c5d1a7b0e4c8f6291.oimf.com.tr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003833; classtype:social-engineering; sid:6003833; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (macroxaa37dwjhbjhsdbjhsd-dtfeb2gedmd8bpfx.z02.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"macroxaa37dwjhbjhsdbjhsd-dtfeb2gedmd8bpfx.z02.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003834; classtype:social-engineering; sid:6003834; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rational-industry-828231.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rational-industry-828231.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003835; classtype:social-engineering; sid:6003835; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (connexion-app.com/clientes/login.php)"; flow:established,to_server; http.uri; content:"/clientes/login.php"; startswith; fast_pattern; http.host; content:"connexion-app.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003836; classtype:social-engineering; sid:6003836; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (index-1f1.sales-masterelevatorparts-com-s-account.workers.dev/4a13b29d079c8ca2/)"; flow:established,to_server; http.uri; content:"/4a13b29d079c8ca2/"; startswith; fast_pattern; http.host; content:"index-1f1.sales-masterelevatorparts-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003837; classtype:social-engineering; sid:6003837; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc.crsorgi.gov.in.verifycertificate.info/general-public)"; flow:established,to_server; http.uri; content:"/general-public"; startswith; fast_pattern; http.host; content:"dc.crsorgi.gov.in.verifycertificate.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003838; classtype:social-engineering; sid:6003838; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fhhn-e49u-fn59.molly-hb-mirrors-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fhhn-e49u-fn59.molly-hb-mirrors-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003839; classtype:social-engineering; sid:6003839; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-index-page--melisapritt.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-index-page--melisapritt.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003840; classtype:social-engineering; sid:6003840; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerservicek.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerservicek.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003841; classtype:social-engineering; sid:6003841; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atokk918-pixel.github.io/Pusat-bantuan-)"; flow:established,to_server; http.uri; content:"/Pusat-bantuan-"; startswith; fast_pattern; http.host; content:"atokk918-pixel.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003842; classtype:social-engineering; sid:6003842; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.whh.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.whh.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003843; classtype:social-engineering; sid:6003843; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (link-support-badge-563234613zas.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"link-support-badge-563234613zas.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003844; classtype:social-engineering; sid:6003844; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pagesystemsupportfor.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pagesystemsupportfor.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003845; classtype:social-engineering; sid:6003845; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (link-support-badge-5632346zx456xc.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"link-support-badge-5632346zx456xc.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003846; classtype:social-engineering; sid:6003846; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bnrurabetegt.biz.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bnrurabetegt.biz.site"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003847; classtype:social-engineering; sid:6003847; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutch.albertacraneservices.com/receive/order/ljidXUWuCrI?r=0x11)"; flow:established,to_server; http.uri; content:"/receive/order/ljidXUWuCrI?r=0x11"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutch.albertacraneservices.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003848; classtype:social-engineering; sid:6003848; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (banrural-en-linea.biz.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"banrural-en-linea.biz.site"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003849; classtype:social-engineering; sid:6003849; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhamentertainment.com/en/main/?username=redacted@abuse.ionos.com&hash=4328338-4328338-4328338)"; flow:established,to_server; http.uri; content:"/en/main/?username=redacted@abuse.ionos.com&hash=4328338-4328338-4328338"; startswith; fast_pattern; http.host; content:"bhamentertainment.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003850; classtype:social-engineering; sid:6003850; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sanfanderbomk.icu/?secure_connect=241*fc*&_subid=2ge6qe4.43.1dq76&_token=3e78u193kmtj58.1781886699.1.c478b502c0753e8e25b4f67ca23ddf62)"; flow:established,to_server; http.uri; content:"/?secure_connect=241*fc*&_subid=2ge6qe4.43.1dq76&_token=3e78u193kmtj58.1781886699.1.c478b502c0753e8e25b4f67ca23ddf62"; startswith; fast_pattern; http.host; content:"sanfanderbomk.icu"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003851; classtype:social-engineering; sid:6003851; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (r1sy-online.icu/?secure_connect=d9*8z*&_subid=1sd8jpm.93.1doqs&_token=124p3em17ihegp.1781851368.9.4a130128600ef185753ea8484e9107fe)"; flow:established,to_server; http.uri; content:"/?secure_connect=d9*8z*&_subid=1sd8jpm.93.1doqs&_token=124p3em17ihegp.1781851368.9.4a130128600ef185753ea8484e9107fe"; startswith; fast_pattern; http.host; content:"r1sy-online.icu"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003852; classtype:social-engineering; sid:6003852; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie.12030oh5.xyz/lokalnie/?id=7M2d5p3l3S0v0d3n5s0B6P2e9b1D2T1Y)"; flow:established,to_server; http.uri; content:"/lokalnie/?id=7M2d5p3l3S0v0d3n5s0B6P2e9b1D2T1Y"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.12030oh5.xyz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003853; classtype:social-engineering; sid:6003853; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hnghnff.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hnghnff.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003854; classtype:social-engineering; sid:6003854; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pichincha.cc/ec)"; flow:established,to_server; http.uri; content:"/ec"; startswith; fast_pattern; http.host; content:"pichincha.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003855; classtype:social-engineering; sid:6003855; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kuckointlogin.webador.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kuckointlogin.webador.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003856; classtype:social-engineering; sid:6003856; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (misthigupta0022.github.io/semester-2-project/)"; flow:established,to_server; http.uri; content:"/semester-2-project/"; startswith; fast_pattern; http.host; content:"misthigupta0022.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003857; classtype:social-engineering; sid:6003857; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtw.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingtw.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003858; classtype:social-engineering; sid:6003858; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (codervishy.github.io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"codervishy.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003859; classtype:social-engineering; sid:6003859; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrf.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingrf.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003860; classtype:social-engineering; sid:6003860; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aribafiroz2207.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"aribafiroz2207.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003861; classtype:social-engineering; sid:6003861; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (odopdwkld.s3.eu-north-1.amazonaws.com/nwk.html)"; flow:established,to_server; http.uri; content:"/nwk.html"; startswith; fast_pattern; http.host; content:"odopdwkld.s3.eu-north-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003862; classtype:social-engineering; sid:6003862; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.onmilz.top/pay)"; flow:established,to_server; http.uri; content:"/pay"; startswith; fast_pattern; http.host; content:"t-mobile.onmilz.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003863; classtype:social-engineering; sid:6003863; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smca.info/itschiro_time/)"; flow:established,to_server; http.uri; content:"/itschiro_time/"; startswith; fast_pattern; http.host; content:"smca.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003864; classtype:social-engineering; sid:6003864; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (schloss-castel.de/smalenegie/)"; flow:established,to_server; http.uri; content:"/smalenegie/"; startswith; fast_pattern; http.host; content:"schloss-castel.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003865; classtype:social-engineering; sid:6003865; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.vimareo.com/wap)"; flow:established,to_server; http.uri; content:"/wap"; startswith; fast_pattern; http.host; content:"www.vimareo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003866; classtype:social-engineering; sid:6003866; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1xplayers.com/GtNNJWZc)"; flow:established,to_server; http.uri; content:"/GtNNJWZc"; startswith; fast_pattern; http.host; content:"1xplayers.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003867; classtype:social-engineering; sid:6003867; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docs-trezor-io-login.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"docs-trezor-io-login.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003868; classtype:social-engineering; sid:6003868; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.taslimaenterprise.com/adobe/)"; flow:established,to_server; http.uri; content:"/adobe/"; startswith; fast_pattern; http.host; content:"www.taslimaenterprise.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003869; classtype:social-engineering; sid:6003869; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sabadellherrero.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sabadellherrero.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003870; classtype:social-engineering; sid:6003870; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtt.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingtt.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003871; classtype:social-engineering; sid:6003871; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiew7w6k3ryybdumpzpuaxenhl7btkqqdb6ss7aza5plujnxjk7jmm.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiew7w6k3ryybdumpzpuaxenhl7btkqqdb6ss7aza5plujnxjk7jmm.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003872; classtype:social-engineering; sid:6003872; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-pede48h-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-pede48h-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003873; classtype:social-engineering; sid:6003873; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (80938cb1.secure-signin.co/?d=A27dcHPfqRyoTfQmWDGve)"; flow:established,to_server; http.uri; content:"/?d=A27dcHPfqRyoTfQmWDGve"; startswith; fast_pattern; http.host; content:"80938cb1.secure-signin.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003874; classtype:social-engineering; sid:6003874; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ezeserverlogin-dptabl94lu7z.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ezeserverlogin-dptabl94lu7z.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003875; classtype:social-engineering; sid:6003875; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kleinanzeigen.kleinkauff0.icu/order/eUAWgCc4uJkB/?plg=polya_ma)"; flow:established,to_server; http.uri; content:"/order/eUAWgCc4uJkB/?plg=polya_ma"; startswith; fast_pattern; http.host; content:"kleinanzeigen.kleinkauff0.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003876; classtype:social-engineering; sid:6003876; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.pl-58912547891.sbs/oferta/91329224/jacuzzi-dmuc)"; flow:established,to_server; http.uri; content:"/oferta/91329224/jacuzzi-dmuc"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-58912547891.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003877; classtype:social-engineering; sid:6003877; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vaai.la/RwTL)"; flow:established,to_server; http.uri; content:"/RwTL"; startswith; fast_pattern; http.host; content:"vaai.la"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003878; classtype:social-engineering; sid:6003878; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd-bdjfa.cc/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd-bdjfa.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003879; classtype:social-engineering; sid:6003879; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (edward95.neocities.org/iclaaa/)"; flow:established,to_server; http.uri; content:"/iclaaa/"; startswith; fast_pattern; http.host; content:"edward95.neocities.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003880; classtype:social-engineering; sid:6003880; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (helphome-trezer-wallt.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"helphome-trezer-wallt.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003881; classtype:social-engineering; sid:6003881; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (relis.co.ke/vendor/meta-fb-page/login/)"; flow:established,to_server; http.uri; content:"/vendor/meta-fb-page/login/"; startswith; fast_pattern; http.host; content:"relis.co.ke"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003882; classtype:social-engineering; sid:6003882; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (css-ch.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"css-ch.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003883; classtype:social-engineering; sid:6003883; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.blm7333.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.blm7333.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003884; classtype:social-engineering; sid:6003884; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtd.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingtd.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003885; classtype:social-engineering; sid:6003885; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtj.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingtj.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003886; classtype:social-engineering; sid:6003886; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ecommerce-website-nine-hazel.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ecommerce-website-nine-hazel.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003887; classtype:social-engineering; sid:6003887; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (macelos.cyou/ins.gov.co.html)"; flow:established,to_server; http.uri; content:"/ins.gov.co.html"; startswith; fast_pattern; http.host; content:"macelos.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003888; classtype:social-engineering; sid:6003888; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toplukonut8879772196.vercel.app/giris.html)"; flow:established,to_server; http.uri; content:"/giris.html"; startswith; fast_pattern; http.host; content:"toplukonut8879772196.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003889; classtype:social-engineering; sid:6003889; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee2449.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopee2449.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003890; classtype:social-engineering; sid:6003890; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9cmw-idx4-47fs.george-vandevorde-smithinsurancellc-com-s-account.workers.dev/12...)"; flow:established,to_server; http.uri; content:"/12..."; startswith; fast_pattern; http.host; content:"9cmw-idx4-47fs.george-vandevorde-smithinsurancellc-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003891; classtype:social-engineering; sid:6003891; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kkhm-62ja-vye4.philip-turnkeytalk-com-s-account.workers.dev/c6b87fb685103ff6?email=3/)"; flow:established,to_server; http.uri; content:"/c6b87fb685103ff6?email=3/"; startswith; fast_pattern; http.host; content:"kkhm-62ja-vye4.philip-turnkeytalk-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003892; classtype:social-engineering; sid:6003892; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (manage-trezor-info-learn.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"manage-trezor-info-learn.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003893; classtype:social-engineering; sid:6003893; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sx.xmugrg.net/supprtdocs-remitstatementpdf/office/)"; flow:established,to_server; http.uri; content:"/supprtdocs-remitstatementpdf/office/"; startswith; fast_pattern; http.host; content:"sx.xmugrg.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003894; classtype:social-engineering; sid:6003894; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.jhrerth.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.jhrerth.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003895; classtype:social-engineering; sid:6003895; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dolamesbu.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dolamesbu.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003896; classtype:social-engineering; sid:6003896; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eco17.onrender.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eco17.onrender.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003897; classtype:social-engineering; sid:6003897; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alicefilmustherapy.com/~r5g8ldveioxpnxqm/assets/images/images/12/lng/login.php)"; flow:established,to_server; http.uri; content:"/~r5g8ldveioxpnxqm/assets/images/images/12/lng/login.php"; startswith; fast_pattern; http.host; content:"alicefilmustherapy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003898; classtype:social-engineering; sid:6003898; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd-padnu.com/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd-padnu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003899; classtype:social-engineering; sid:6003899; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (macroja39whdsbhjbdjhbshdbj-cvcfckhzhhd0b7dr.z02.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"macroja39whdsbhjbdjhbshdbj-cvcfckhzhhd0b7dr.z02.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003900; classtype:social-engineering; sid:6003900; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (femmesopk.com/le-diagnostic-du-sopk-le-diagnostic-est-pose-si-au-moins-2-des-3-criteres/)"; flow:established,to_server; http.uri; content:"/le-diagnostic-du-sopk-le-diagnostic-est-pose-si-au-moins-2-des-3-criteres/"; startswith; fast_pattern; http.host; content:"femmesopk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003901; classtype:social-engineering; sid:6003901; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtr.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingtr.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003902; classtype:social-engineering; sid:6003902; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd-lpobj.cc/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd-lpobj.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003903; classtype:social-engineering; sid:6003903; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (68-210-98-112.cprapid.com/de/kasse.php?f9g3df4kli27s0sk9fym)"; flow:established,to_server; http.uri; content:"/de/kasse.php?f9g3df4kli27s0sk9fym"; startswith; fast_pattern; http.host; content:"68-210-98-112.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003904; classtype:social-engineering; sid:6003904; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acessoradardigital.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"acessoradardigital.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003905; classtype:social-engineering; sid:6003905; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (asra144.github.io/Netflix-Clone)"; flow:established,to_server; http.uri; content:"/Netflix-Clone"; startswith; fast_pattern; http.host; content:"asra144.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003906; classtype:social-engineering; sid:6003906; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mosquitomagnet-mrad.net/~r5g8ldveioxpnxqm/assets/images/images/12/lng/login.php)"; flow:established,to_server; http.uri; content:"/~r5g8ldveioxpnxqm/assets/images/images/12/lng/login.php"; startswith; fast_pattern; http.host; content:"www.mosquitomagnet-mrad.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003907; classtype:social-engineering; sid:6003907; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee8717.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.shopee8717.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003908; classtype:social-engineering; sid:6003908; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cofredeleads.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"cofredeleads.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003909; classtype:social-engineering; sid:6003909; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pruebegydo-ship-it.github.io/Web.biblioteca)"; flow:established,to_server; http.uri; content:"/Web.biblioteca"; startswith; fast_pattern; http.host; content:"pruebegydo-ship-it.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003910; classtype:social-engineering; sid:6003910; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whapptr9.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whapptr9.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003911; classtype:social-engineering; sid:6003911; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bigshopee597.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"bigshopee597.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003912; classtype:social-engineering; sid:6003912; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7wk0-c0co-0t2l.dturcotte-predictms-com-s-account.workers.dev/1a8578e3f506d45a?email=a$)"; flow:established,to_server; http.uri; content:"/1a8578e3f506d45a?email=a$"; startswith; fast_pattern; http.host; content:"7wk0-c0co-0t2l.dturcotte-predictms-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003913; classtype:social-engineering; sid:6003913; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (itens-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"itens-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003914; classtype:social-engineering; sid:6003914; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365wtvip.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365wtvip.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003915; classtype:social-engineering; sid:6003915; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coningmarincert.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coningmarincert.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003916; classtype:social-engineering; sid:6003916; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrc.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingrc.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003917; classtype:social-engineering; sid:6003917; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (am.rdiyn.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"am.rdiyn.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003918; classtype:social-engineering; sid:6003918; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unlimited-overlays-836657.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"unlimited-overlays-836657.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003919; classtype:social-engineering; sid:6003919; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (farwa07.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"farwa07.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003920; classtype:social-engineering; sid:6003920; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (japassoudahoradeelevaraumenteja.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"japassoudahoradeelevaraumenteja.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003921; classtype:social-engineering; sid:6003921; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingts.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingts.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003922; classtype:social-engineering; sid:6003922; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtw.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingtw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003923; classtype:social-engineering; sid:6003923; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco.acesse-empresas.com/app/wd/index.php?p=carregando&_reqid=cf413dd01570edd02fdbf9173e5b44d7)"; flow:established,to_server; http.uri; content:"/app/wd/index.php?p=carregando&_reqid=cf413dd01570edd02fdbf9173e5b44d7"; startswith; fast_pattern; http.host; content:"bradesco.acesse-empresas.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003924; classtype:social-engineering; sid:6003924; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (valuabley.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"valuabley.xyz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003925; classtype:social-engineering; sid:6003925; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cba1188.com/?ZnaH8IRmgoOp)"; flow:established,to_server; http.uri; content:"/?ZnaH8IRmgoOp"; startswith; fast_pattern; http.host; content:"www.cba1188.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003926; classtype:social-engineering; sid:6003926; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerserviceqr.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerserviceqr.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003927; classtype:social-engineering; sid:6003927; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fsdyt168.com/?8zueCpR91uVW)"; flow:established,to_server; http.uri; content:"/?8zueCpR91uVW"; startswith; fast_pattern; http.host; content:"www.fsdyt168.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003928; classtype:social-engineering; sid:6003928; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kopaturismo.com.br/ase/saveenergy_09343.html)"; flow:established,to_server; http.uri; content:"/ase/saveenergy_09343.html"; startswith; fast_pattern; http.host; content:"kopaturismo.com.br"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6003929; classtype:social-engineering; sid:6003929; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-password-recovery.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-password-recovery.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003930; classtype:social-engineering; sid:6003930; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (produklokal.palukota.go.id/app)"; flow:established,to_server; http.uri; content:"/app"; startswith; fast_pattern; http.host; content:"produklokal.palukota.go.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003931; classtype:social-engineering; sid:6003931; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-r.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-r.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003932; classtype:social-engineering; sid:6003932; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (94709.my/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"94709.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003933; classtype:social-engineering; sid:6003933; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (capitalaccelusa.us-sea-1.linodeobjects.com/validate.html)"; flow:established,to_server; http.uri; content:"/validate.html"; startswith; fast_pattern; http.host; content:"capitalaccelusa.us-sea-1.linodeobjects.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003934; classtype:social-engineering; sid:6003934; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faq-trezo-or-hard-ware-walle-t.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faq-trezo-or-hard-ware-walle-t.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003935; classtype:social-engineering; sid:6003935; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portaldodev.com.br/nday.html)"; flow:established,to_server; http.uri; content:"/nday.html"; startswith; fast_pattern; http.host; content:"portaldodev.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003936; classtype:social-engineering; sid:6003936; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (charminviteco.de/ecard/)"; flow:established,to_server; http.uri; content:"/ecard/"; startswith; fast_pattern; http.host; content:"charminviteco.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003937; classtype:social-engineering; sid:6003937; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fq.relink-tech.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fq.relink-tech.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003938; classtype:social-engineering; sid:6003938; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (os.techto.com.br/opening)"; flow:established,to_server; http.uri; content:"/opening"; startswith; fast_pattern; http.host; content:"os.techto.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003939; classtype:social-engineering; sid:6003939; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (url1402.nycamail.com/ls/click?upn=u001.O6jY7o9q5dogmtnrk4RHNyfiClE-2FdW0u4mVoJzQUWbl43jj-2Bk3VIt5wVfL10yYz8-2F0MlU5h4lHc0-2F527Vfp1Rg9WaAVbnT0lKyMb5-2ByVOkkzmc1loXcjwD00dBsi-2Bpuo1sN1BAVIzP14BCXPZIqxow-3D-3DbI1t_1K0sULVzZmD1Y43wkEC8mz1u4aiMsC3e7cQ11KiXIvDbtqxsJoY2t837YrWb3CJ66Dc0oauTwyQIkYg-2BmDnxee3FedFhlkMt3it9LlURYYXRS8hteDZed4heUotSWyPKKHChxN-2BeFymuOAtm-2FUIDFdN3QTOLkLTMKBpPBzavxdVfhdXPnRLnbLyzx4E3kFOUzPOx7mHrv-2B3MHYivnDmBkkTNRaEWqcBM55iYbdiPd21m0kEcQ8SZ2rj5ALr3hilz)"; flow:established,to_server; http.uri; content:"/ls/click?upn=u001.O6jY7o9q5dogmtnrk4RHNyfiClE-2FdW0u4mVoJzQUWbl43jj-2Bk3VIt5wVfL10yYz8-2F0MlU5h4lHc0-2F527Vfp1Rg9WaAVbnT0lKyMb5-2ByVOkkzmc1loXcjwD00dBsi-2Bpuo1sN1BAVIzP14BCXPZIqxow-3D-3DbI1t_1K0sULVzZmD1Y43wkEC8mz1u4aiMsC3e7cQ11KiXIvDbtqxsJoY2t837YrWb3CJ66Dc0oauTwyQIkYg-2BmDnxee3FedFhlkMt3it9LlURYYXRS8hteDZed4heUotSWyPKKHChxN-2BeFymuOAtm-2FUIDFdN3QTOLkLTMKBpPBzavxdVfhdXPnRLnbLyzx4E3kFOUzPOx7mHrv-2B3MHYivnDmBkkTNRaEWqcBM55iYbdiPd21m0kEcQ8SZ2rj5ALr3hilz"; startswith; fast_pattern; http.host; content:"url1402.nycamail.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003940; classtype:social-engineering; sid:6003940; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pesta-shopee509.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"pesta-shopee509.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003941; classtype:social-engineering; sid:6003941; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gabrielnovaesdev.github.io/Clone-de-Interface-do-Spotify)"; flow:established,to_server; http.uri; content:"/Clone-de-Interface-do-Spotify"; startswith; fast_pattern; http.host; content:"gabrielnovaesdev.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003942; classtype:social-engineering; sid:6003942; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nidarosdiskgolf.no/sgi/)"; flow:established,to_server; http.uri; content:"/sgi/"; startswith; fast_pattern; http.host; content:"nidarosdiskgolf.no"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003943; classtype:social-engineering; sid:6003943; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suite-trezear.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"suite-trezear.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003944; classtype:social-engineering; sid:6003944; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uspsglobaldelivery.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uspsglobaldelivery.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003945; classtype:social-engineering; sid:6003945; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-auth-trezor-wallet.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-auth-trezor-wallet.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003946; classtype:social-engineering; sid:6003946; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4-creeks.mpaeroz.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4-creeks.mpaeroz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003947; classtype:social-engineering; sid:6003947; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-password-recovery.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-password-recovery.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003948; classtype:social-engineering; sid:6003948; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toplukonut1251251.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"toplukonut1251251.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003949; classtype:social-engineering; sid:6003949; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gerenciadorcaixaempresas.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gerenciadorcaixaempresas.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003950; classtype:social-engineering; sid:6003950; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-liive-app.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"ledger-liive-app.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003951; classtype:social-engineering; sid:6003951; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.00wnsr.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.00wnsr.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003952; classtype:social-engineering; sid:6003952; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentojaa01.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentojaa01.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003953; classtype:social-engineering; sid:6003953; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (btccompensation.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"btccompensation.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003954; classtype:social-engineering; sid:6003954; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lp-dialok-rs-pf.btg-goods.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lp-dialok-rs-pf.btg-goods.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003955; classtype:social-engineering; sid:6003955; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.css-ch.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.css-ch.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003956; classtype:social-engineering; sid:6003956; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rd3f-aicp-3l2z.jennifer-jencrosslaw-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rd3f-aicp-3l2z.jennifer-jencrosslaw-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003957; classtype:social-engineering; sid:6003957; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hga372.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hga372.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003958; classtype:social-engineering; sid:6003958; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mspremierconsultinginc.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mspremierconsultinginc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003959; classtype:social-engineering; sid:6003959; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hsihwef.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hsihwef.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003960; classtype:social-engineering; sid:6003960; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (in.flea.biz.id/dana.bantuan/)"; flow:established,to_server; http.uri; content:"/dana.bantuan/"; startswith; fast_pattern; http.host; content:"in.flea.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003961; classtype:social-engineering; sid:6003961; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ying8868.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ying8868.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003962; classtype:social-engineering; sid:6003962; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sicpac.com/sales)"; flow:established,to_server; http.uri; content:"/sales"; startswith; fast_pattern; http.host; content:"sicpac.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003963; classtype:social-engineering; sid:6003963; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortchamp.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortchamp.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003964; classtype:social-engineering; sid:6003964; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.rebrabooking.it/nfx)"; flow:established,to_server; http.uri; content:"/nfx"; startswith; fast_pattern; http.host; content:"www.rebrabooking.it"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003965; classtype:social-engineering; sid:6003965; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faq-trezr-public-en.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faq-trezr-public-en.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003966; classtype:social-engineering; sid:6003966; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aditieeeee.github.io/Aditieeeee.github/)"; flow:established,to_server; http.uri; content:"/Aditieeeee.github/"; startswith; fast_pattern; http.host; content:"aditieeeee.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003967; classtype:social-engineering; sid:6003967; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fuv.jbw.temporary.site/112/NRD/b3287fe/Sign_in.php/)"; flow:established,to_server; http.uri; content:"/112/NRD/b3287fe/Sign_in.php/"; startswith; fast_pattern; http.host; content:"www.fuv.jbw.temporary.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003968; classtype:social-engineering; sid:6003968; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (welcome--suite-trezr-io.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"welcome--suite-trezr-io.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003969; classtype:social-engineering; sid:6003969; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fanciful-mochi-1778c3.netlify.app/#belelz@a592214ebafee626190c24b16bd58cf2f4bd.org)"; flow:established,to_server; http.uri; content:"/#belelz@a592214ebafee626190c24b16bd58cf2f4bd.org"; startswith; fast_pattern; http.host; content:"fanciful-mochi-1778c3.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003970; classtype:social-engineering; sid:6003970; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (goapps---y--uphold-com.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"goapps---y--uphold-com.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003971; classtype:social-engineering; sid:6003971; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (evobothub.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"evobothub.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003972; classtype:social-engineering; sid:6003972; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedagiodigitalonline.email/ecovias/home.php)"; flow:established,to_server; http.uri; content:"/ecovias/home.php"; startswith; fast_pattern; http.host; content:"pedagiodigitalonline.email"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003973; classtype:social-engineering; sid:6003973; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (360plus.net/eng/)"; flow:established,to_server; http.uri; content:"/eng/"; startswith; fast_pattern; http.host; content:"360plus.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003974; classtype:social-engineering; sid:6003974; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (potkek01.neocities.org/BR/)"; flow:established,to_server; http.uri; content:"/BR/"; startswith; fast_pattern; http.host; content:"potkek01.neocities.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003975; classtype:social-engineering; sid:6003975; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fed-ex.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fed-ex.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003976; classtype:social-engineering; sid:6003976; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (insta-clone-johnatanivini.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"insta-clone-johnatanivini.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003977; classtype:social-engineering; sid:6003977; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.web-git-herman-cons-1985-responsive-web-changes-uniswap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.web-git-herman-cons-1985-responsive-web-changes-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003978; classtype:social-engineering; sid:6003978; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kesinlink3.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kesinlink3.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003979; classtype:social-engineering; sid:6003979; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.toplukonut1251251.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.toplukonut1251251.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003980; classtype:social-engineering; sid:6003980; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (colectivopa.hstn.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"colectivopa.hstn.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003981; classtype:social-engineering; sid:6003981; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (grihinie.org/gk/index.html)"; flow:established,to_server; http.uri; content:"/gk/index.html"; startswith; fast_pattern; http.host; content:"grihinie.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003982; classtype:social-engineering; sid:6003982; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (biiing.net/?r=9f45ed62-2dd0-43c0-b67b-ee43b48b5cc6&rg=eu)"; flow:established,to_server; http.uri; content:"/?r=9f45ed62-2dd0-43c0-b67b-ee43b48b5cc6&rg=eu"; startswith; fast_pattern; http.host; content:"biiing.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003983; classtype:social-engineering; sid:6003983; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home-trez-or-walle-t.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"home-trez-or-walle-t.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003984; classtype:social-engineering; sid:6003984; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (api.relis.co.ke/vendor/meta-fb-page/login/)"; flow:established,to_server; http.uri; content:"/vendor/meta-fb-page/login/"; startswith; fast_pattern; http.host; content:"api.relis.co.ke"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003985; classtype:social-engineering; sid:6003985; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danaid.offlcial-info1.web.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danaid.offlcial-info1.web.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003986; classtype:social-engineering; sid:6003986; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ptshopee-229.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"ptshopee-229.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003987; classtype:social-engineering; sid:6003987; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meine-zustellplanung.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meine-zustellplanung.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003988; classtype:social-engineering; sid:6003988; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vester.it/mol/idks4/konda1.html)"; flow:established,to_server; http.uri; content:"/mol/idks4/konda1.html"; startswith; fast_pattern; http.host; content:"vester.it"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003989; classtype:social-engineering; sid:6003989; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tealsmoorebag.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tealsmoorebag.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003990; classtype:social-engineering; sid:6003990; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (url-shortener.me/N5JS)"; flow:established,to_server; http.uri; content:"/N5JS"; startswith; fast_pattern; http.host; content:"url-shortener.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003991; classtype:social-engineering; sid:6003991; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.juplab.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.juplab.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003992; classtype:social-engineering; sid:6003992; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bitly.cx/aR7ZT)"; flow:established,to_server; http.uri; content:"/aR7ZT"; startswith; fast_pattern; http.host; content:"bitly.cx"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003993; classtype:social-engineering; sid:6003993; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.djj.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.djj.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003994; classtype:social-engineering; sid:6003994; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (post-finance.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"post-finance.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003995; classtype:social-engineering; sid:6003995; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365verificafacial.fwh.is/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"365verificafacial.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003996; classtype:social-engineering; sid:6003996; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sakshiyadav0925.github.io/Project)"; flow:established,to_server; http.uri; content:"/Project"; startswith; fast_pattern; http.host; content:"sakshiyadav0925.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003997; classtype:social-engineering; sid:6003997; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robuxstacks.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"robuxstacks.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003998; classtype:social-engineering; sid:6003998; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mathkaynsgvsjbhiabhsbu.github.io/Metamask-phish/)"; flow:established,to_server; http.uri; content:"/Metamask-phish/"; startswith; fast_pattern; http.host; content:"mathkaynsgvsjbhiabhsbu.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6003999; classtype:social-engineering; sid:6003999; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reactivar-microsoft-mxx.iceiy.com/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"reactivar-microsoft-mxx.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004000; classtype:social-engineering; sid:6004000; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezoor-io-learn-cdn.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezoor-io-learn-cdn.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004001; classtype:social-engineering; sid:6004001; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (confirmare.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"confirmare.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004002; classtype:social-engineering; sid:6004002; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreieok7tsdcw3zc5hqju7f35whwjuhajc7snjatmqmz4y6pmwmfm4te.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreieok7tsdcw3zc5hqju7f35whwjuhajc7snjatmqmz4y6pmwmfm4te.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004003; classtype:social-engineering; sid:6004003; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (snipergames.de/paylog2/index.html)"; flow:established,to_server; http.uri; content:"/paylog2/index.html"; startswith; fast_pattern; http.host; content:"snipergames.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004004; classtype:social-engineering; sid:6004004; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ptshopee-229.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.ptshopee-229.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004005; classtype:social-engineering; sid:6004005; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ptfuturewebinarfrellanceece.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ptfuturewebinarfrellanceece.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004006; classtype:social-engineering; sid:6004006; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ecocashquickloans.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ecocashquickloans.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004007; classtype:social-engineering; sid:6004007; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mr-sum1t.github.io/Amazon-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-Clone"; startswith; fast_pattern; http.host; content:"mr-sum1t.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004008; classtype:social-engineering; sid:6004008; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tibexa.kesug.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tibexa.kesug.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004009; classtype:social-engineering; sid:6004009; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (convivial-smile-369927.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"convivial-smile-369927.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004010; classtype:social-engineering; sid:6004010; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pam-alpha-mail-ne-jp-fantastic-chainsaw-production-c3bb.up.railway.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pam-alpha-mail-ne-jp-fantastic-chainsaw-production-c3bb.up.railway.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004011; classtype:social-engineering; sid:6004011; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtn.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingtn.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004012; classtype:social-engineering; sid:6004012; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (876678987.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"876678987.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004013; classtype:social-engineering; sid:6004013; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (final-ivory-yyeunzxk-dprqo0854tpr.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"final-ivory-yyeunzxk-dprqo0854tpr.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004014; classtype:social-engineering; sid:6004014; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.asdfghjkjhgfdsaq1.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.asdfghjkjhgfdsaq1.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004015; classtype:social-engineering; sid:6004015; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (devansh-srivastava-source.github.io/amazon-uiclone01/product.html)"; flow:established,to_server; http.uri; content:"/amazon-uiclone01/product.html"; startswith; fast_pattern; http.host; content:"devansh-srivastava-source.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004016; classtype:social-engineering; sid:6004016; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cerval.com.mx/app/)"; flow:established,to_server; http.uri; content:"/app/"; startswith; fast_pattern; http.host; content:"cerval.com.mx"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004017; classtype:social-engineering; sid:6004017; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iliovskiinn.com/uri/2/Email)"; flow:established,to_server; http.uri; content:"/uri/2/Email"; startswith; fast_pattern; http.host; content:"iliovskiinn.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004018; classtype:social-engineering; sid:6004018; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ai-start-faq-trezoor.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ai-start-faq-trezoor.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004019; classtype:social-engineering; sid:6004019; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steamnconmunity.ru/Id/7656193558567372)"; flow:established,to_server; http.uri; content:"/Id/7656193558567372"; startswith; fast_pattern; http.host; content:"steamnconmunity.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004020; classtype:social-engineering; sid:6004020; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whatsapp-base-app.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsapp-base-app.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004021; classtype:social-engineering; sid:6004021; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tibexa.kesug.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tibexa.kesug.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004022; classtype:social-engineering; sid:6004022; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (live.aaveapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"live.aaveapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004023; classtype:social-engineering; sid:6004023; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (doniasyriac.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"doniasyriac.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004024; classtype:social-engineering; sid:6004024; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (singular-semolina-b8c7ee.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"singular-semolina-b8c7ee.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004025; classtype:social-engineering; sid:6004025; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (minhasvantagensitau.com.br/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"minhasvantagensitau.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004026; classtype:social-engineering; sid:6004026; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mmshipman.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mmshipman.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004027; classtype:social-engineering; sid:6004027; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (glopakind.com/DocuSign/Mac/)"; flow:established,to_server; http.uri; content:"/DocuSign/Mac/"; startswith; fast_pattern; http.host; content:"glopakind.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004028; classtype:social-engineering; sid:6004028; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (conobse_prologe.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"conobse_prologe.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004029; classtype:social-engineering; sid:6004029; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.gjj.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.gjj.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004030; classtype:social-engineering; sid:6004030; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onlinepharmacygx.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"onlinepharmacygx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004031; classtype:social-engineering; sid:6004031; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (banco-pichincha.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"banco-pichincha.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004032; classtype:social-engineering; sid:6004032; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prestamos-adelantos-ecuador2026.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"prestamos-adelantos-ecuador2026.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004033; classtype:social-engineering; sid:6004033; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco.chatcorporativopj.digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bradesco.chatcorporativopj.digital"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004034; classtype:social-engineering; sid:6004034; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mygloboltsb-online.icu/?secure_connect=v99*ft1&_subid=28u3f78.2d.1eoi7&_token=1vhvikq3ctv11g.1781937011.5.d653d72f006140538b8f26024ca92cc4)"; flow:established,to_server; http.uri; content:"/?secure_connect=v99*ft1&_subid=28u3f78.2d.1eoi7&_token=1vhvikq3ctv11g.1781937011.5.d653d72f006140538b8f26024ca92cc4"; startswith; fast_pattern; http.host; content:"mygloboltsb-online.icu"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004035; classtype:social-engineering; sid:6004035; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (komcontrol.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"komcontrol.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004036; classtype:social-engineering; sid:6004036; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro-lokalnie.prywatne8329.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro-lokalnie.prywatne8329.lol"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004037; classtype:social-engineering; sid:6004037; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-hn35vvz3h.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-hn35vvz3h.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004038; classtype:social-engineering; sid:6004038; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtb.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingtb.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004039; classtype:social-engineering; sid:6004039; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.labrrums.co.uk/ngW49h7NdM1RF99HHFVi-j4PrMtujxw7BJEQBN68t0pg9LD98I6s3EW7bT8nJEkyVC2Aw5Ly0x-jGoZ29068CfMnX3qaOMpJZ_pfrJJ9XG44ToJ3QJgDy82CHJwN2S4yJNIZdnQoiFe4a1VsV764AZ8NNEcTAFo9e24TnmObKZij42XZ0f7r3v1wVLz4NlvjH0ujyivcKE7kWYXE1jV7Ic4BFBwKL_oF9T30OZhP6YbL5ePa3n9B475D/gwxDWpBW1hi0/)"; flow:established,to_server; http.uri; content:"/ngW49h7NdM1RF99HHFVi-j4PrMtujxw7BJEQBN68t0pg9LD98I6s3EW7bT8nJEkyVC2Aw5Ly0x-jGoZ29068CfMnX3qaOMpJZ_pfrJJ9XG44ToJ3QJgDy82CHJwN2S4yJNIZdnQoiFe4a1VsV764AZ8NNEcTAFo9e24TnmObKZij42XZ0f7r3v1wVLz4NlvjH0ujyivcKE7kWYXE1jV7Ic4BFBwKL_oF9T30OZhP6YbL5ePa3n9B475D/gwxDWpBW1hi0/"; startswith; fast_pattern; http.host; content:"www.labrrums.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004040; classtype:social-engineering; sid:6004040; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingyi.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingyi.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004041; classtype:social-engineering; sid:6004041; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (compuservinformatica.com/kabra/kabra.html)"; flow:established,to_server; http.uri; content:"/kabra/kabra.html"; startswith; fast_pattern; http.host; content:"compuservinformatica.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004042; classtype:social-engineering; sid:6004042; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.pl-65891248791243.sbs/oferta/66880113/jacuzzi-intex-whirlpool-purespa-196-x-71-cm)"; flow:established,to_server; http.uri; content:"/oferta/66880113/jacuzzi-intex-whirlpool-purespa-196-x-71-cm"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-65891248791243.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004043; classtype:social-engineering; sid:6004043; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (security-indexer--adamlee160686.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"security-indexer--adamlee160686.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004044; classtype:social-engineering; sid:6004044; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1xlite-24510.bar/en/slots/)"; flow:established,to_server; http.uri; content:"/en/slots/"; startswith; fast_pattern; http.host; content:"www.1xlite-24510.bar"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004045; classtype:social-engineering; sid:6004045; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (org-007.github.io/instagram)"; flow:established,to_server; http.uri; content:"/instagram"; startswith; fast_pattern; http.host; content:"org-007.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004046; classtype:social-engineering; sid:6004046; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ynlendriyonuzknk23154.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ynlendriyonuzknk23154.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004047; classtype:social-engineering; sid:6004047; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp-support-app.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp-support-app.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004048; classtype:social-engineering; sid:6004048; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp-app-hub.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp-app-hub.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004049; classtype:social-engineering; sid:6004049; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3gx4-9e9i-1a1y.hany-onixautomotive-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3gx4-9e9i-1a1y.hany-onixautomotive-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004050; classtype:social-engineering; sid:6004050; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtm.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingtm.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004051; classtype:social-engineering; sid:6004051; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (storno-addebiti.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"storno-addebiti.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004052; classtype:social-engineering; sid:6004052; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (51qkzz.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"51qkzz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004053; classtype:social-engineering; sid:6004053; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alert-navyfederal.web.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"alert-navyfederal.web.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004054; classtype:social-engineering; sid:6004054; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.paypal-banking.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.paypal-banking.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004055; classtype:social-engineering; sid:6004055; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.program-resmi67.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.program-resmi67.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004056; classtype:social-engineering; sid:6004056; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.id.rivdevis.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.id.rivdevis.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004057; classtype:social-engineering; sid:6004057; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail-owa-path-mail-crispy-sniffle-production-9007.up.railway.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webmail-owa-path-mail-crispy-sniffle-production-9007.up.railway.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004058; classtype:social-engineering; sid:6004058; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.program-resmi537.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.program-resmi537.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004059; classtype:social-engineering; sid:6004059; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.trezosuites.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.trezosuites.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004060; classtype:social-engineering; sid:6004060; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtm.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingtm.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004061; classtype:social-engineering; sid:6004061; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp-sync-pro.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp-sync-pro.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004062; classtype:social-engineering; sid:6004062; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (realarpit.github.io/amazon_clone/)"; flow:established,to_server; http.uri; content:"/amazon_clone/"; startswith; fast_pattern; http.host; content:"realarpit.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004063; classtype:social-engineering; sid:6004063; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steam-totp.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"steam-totp.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004064; classtype:social-engineering; sid:6004064; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.secure-attestation.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.secure-attestation.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004065; classtype:social-engineering; sid:6004065; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (falabellaprestamos.click/inicio-movil.php)"; flow:established,to_server; http.uri; content:"/inicio-movil.php"; startswith; fast_pattern; http.host; content:"falabellaprestamos.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004066; classtype:social-engineering; sid:6004066; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whatsapp-crm-hub.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsapp-crm-hub.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004067; classtype:social-engineering; sid:6004067; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adityajoshi2628-collab.github.io/sem2.github.io/)"; flow:established,to_server; http.uri; content:"/sem2.github.io/"; startswith; fast_pattern; http.host; content:"adityajoshi2628-collab.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004068; classtype:social-engineering; sid:6004068; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp-mobile-hub.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp-mobile-hub.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004069; classtype:social-engineering; sid:6004069; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (joint-turquoise-ajfkbwvy.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"joint-turquoise-ajfkbwvy.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004070; classtype:social-engineering; sid:6004070; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fjordbadger.digital/c39zHnd7)"; flow:established,to_server; http.uri; content:"/c39zHnd7"; startswith; fast_pattern; http.host; content:"fjordbadger.digital"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004071; classtype:social-engineering; sid:6004071; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.trust-wallet-cloned-beige.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.trust-wallet-cloned-beige.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004072; classtype:social-engineering; sid:6004072; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.home-messenger-verrification-mailbox.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.home-messenger-verrification-mailbox.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004073; classtype:social-engineering; sid:6004073; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (waocreativacompany.com/kdn)"; flow:established,to_server; http.uri; content:"/kdn"; startswith; fast_pattern; http.host; content:"waocreativacompany.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004074; classtype:social-engineering; sid:6004074; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtd.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingtd.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004075; classtype:social-engineering; sid:6004075; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whatsapp-flow-app.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsapp-flow-app.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004076; classtype:social-engineering; sid:6004076; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suemaisnovoupgradeaumento.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"suemaisnovoupgradeaumento.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004077; classtype:social-engineering; sid:6004077; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (feinz.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"feinz.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004078; classtype:social-engineering; sid:6004078; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeetbk133.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.shopeetbk133.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004079; classtype:social-engineering; sid:6004079; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.site-hn35vvz3h.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.site-hn35vvz3h.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004080; classtype:social-engineering; sid:6004080; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreid5ebjfcsqjng6pzokmecfax3nki3xqsmqmb2uf4zqy675wrlewxq.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreid5ebjfcsqjng6pzokmecfax3nki3xqsmqmb2uf4zqy675wrlewxq.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004081; classtype:social-engineering; sid:6004081; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ginnovenergy.com/fb-page-review/login/)"; flow:established,to_server; http.uri; content:"/fb-page-review/login/"; startswith; fast_pattern; http.host; content:"www.ginnovenergy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004082; classtype:social-engineering; sid:6004082; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cw9h-2avi-96oj.jennifer-jencrosslaw-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cw9h-2avi-96oj.jennifer-jencrosslaw-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004083; classtype:social-engineering; sid:6004083; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vaaiidu.github.io/amazon/)"; flow:established,to_server; http.uri; content:"/amazon/"; startswith; fast_pattern; http.host; content:"vaaiidu.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004084; classtype:social-engineering; sid:6004084; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cra-atfykn.dft-tar.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cra-atfykn.dft-tar.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004085; classtype:social-engineering; sid:6004085; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp-hub-net.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp-hub-net.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004086; classtype:social-engineering; sid:6004086; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (carteras.bolsos.skin/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"carteras.bolsos.skin"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004087; classtype:social-engineering; sid:6004087; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whatsapp-zone-hub.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsapp-zone-hub.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004088; classtype:social-engineering; sid:6004088; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0991contacto.github.io/revisar09mail/)"; flow:established,to_server; http.uri; content:"/revisar09mail/"; startswith; fast_pattern; http.host; content:"0991contacto.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004089; classtype:social-engineering; sid:6004089; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pesta-shopee509.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pesta-shopee509.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004090; classtype:social-engineering; sid:6004090; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sample-painting.com/two.html)"; flow:established,to_server; http.uri; content:"/two.html"; startswith; fast_pattern; http.host; content:"sample-painting.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004091; classtype:social-engineering; sid:6004091; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (securelink.newsupdate.cloud/updateemailinformation?rid=GLGzR9t)"; flow:established,to_server; http.uri; content:"/updateemailinformation?rid=GLGzR9t"; startswith; fast_pattern; http.host; content:"securelink.newsupdate.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004092; classtype:social-engineering; sid:6004092; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafybeidijorazwioy33ekcfbv2zyvthhjtklisrk6aoyxl6evmoro4jpka.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafybeidijorazwioy33ekcfbv2zyvthhjtklisrk6aoyxl6evmoro4jpka.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004093; classtype:social-engineering; sid:6004093; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (attfiberoptic.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"attfiberoptic.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004094; classtype:social-engineering; sid:6004094; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (toplukonut214925192.vercel.app/giris.html)"; flow:established,to_server; http.uri; content:"/giris.html"; startswith; fast_pattern; http.host; content:"toplukonut214925192.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004095; classtype:social-engineering; sid:6004095; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.alligator-finch-x9ae.squarespace.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.alligator-finch-x9ae.squarespace.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004096; classtype:social-engineering; sid:6004096; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja001.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja001.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004097; classtype:social-engineering; sid:6004097; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (equipamentosdolareacimasempre.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"equipamentosdolareacimasempre.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004098; classtype:social-engineering; sid:6004098; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deutschebank.abbove.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"deutschebank.abbove.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004099; classtype:social-engineering; sid:6004099; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sender1.zohoinsights.com.au/ck1/7a6803.1a13b9c22/a7213d90-6ae3-11f1-a441-7ec00f710257/ffbc7b02bba08b1c8637d56c23f5452b8ce2c2c9/2?e=PhH3ITXZ6BBnQVVMx7Dh5Og5k0oSQY7EcjGL3bakyrCCNxMcRF0NAJ9gR2X1yXWmyQDsTTWOxhJzmbH9EZz43A==)"; flow:established,to_server; http.uri; content:"/ck1/7a6803.1a13b9c22/a7213d90-6ae3-11f1-a441-7ec00f710257/ffbc7b02bba08b1c8637d56c23f5452b8ce2c2c9/2?e=PhH3ITXZ6BBnQVVMx7Dh5Og5k0oSQY7EcjGL3bakyrCCNxMcRF0NAJ9gR2X1yXWmyQDsTTWOxhJzmbH9EZz43A=="; startswith; fast_pattern; http.host; content:"sender1.zohoinsights.com.au"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004100; classtype:social-engineering; sid:6004100; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingyi.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingyi.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004101; classtype:social-engineering; sid:6004101; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (houstontacolover.com/Mac/visit.php)"; flow:established,to_server; http.uri; content:"/Mac/visit.php"; startswith; fast_pattern; http.host; content:"houstontacolover.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004102; classtype:social-engineering; sid:6004102; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.epcheck.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.epcheck.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004103; classtype:social-engineering; sid:6004103; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (id.rivdevis.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"id.rivdevis.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004104; classtype:social-engineering; sid:6004104; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-9hrs9q9vu.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-9hrs9q9vu.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004105; classtype:social-engineering; sid:6004105; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (belbuilnet.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"belbuilnet.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004106; classtype:social-engineering; sid:6004106; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.site-9hrs9q9vu.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.site-9hrs9q9vu.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004107; classtype:social-engineering; sid:6004107; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (servmsn-live.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"servmsn-live.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004108; classtype:social-engineering; sid:6004108; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hibcoprotector.com/mac/secure_access-5.html)"; flow:established,to_server; http.uri; content:"/mac/secure_access-5.html"; startswith; fast_pattern; http.host; content:"hibcoprotector.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004109; classtype:social-engineering; sid:6004109; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (att-resetaccount.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"att-resetaccount.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004110; classtype:social-engineering; sid:6004110; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acct.caixesp-finbk.com/es)"; flow:established,to_server; http.uri; content:"/es"; startswith; fast_pattern; http.host; content:"acct.caixesp-finbk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004111; classtype:social-engineering; sid:6004111; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp-now-hub.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp-now-hub.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004112; classtype:social-engineering; sid:6004112; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (angela-lala-bruno.com/wp-includes/ID3/multi/home.php?newtoken=)"; flow:established,to_server; http.uri; content:"/wp-includes/ID3/multi/home.php?newtoken="; startswith; fast_pattern; http.host; content:"angela-lala-bruno.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004113; classtype:social-engineering; sid:6004113; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtn.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingtn.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004114; classtype:social-engineering; sid:6004114; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kurasiz.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kurasiz.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004115; classtype:social-engineering; sid:6004115; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abialine.ng/ffr/?naps/)"; flow:established,to_server; http.uri; content:"/ffr/?naps/"; startswith; fast_pattern; http.host; content:"abialine.ng"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004116; classtype:social-engineering; sid:6004116; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paypal-banking.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paypal-banking.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004117; classtype:social-engineering; sid:6004117; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fraudoptix.com/vi22fe02226/792e0bff658f2ae7fbbaa7c2/index.php?id=40c92f7aa24713d87e3a9a66c2be7f13)"; flow:established,to_server; http.uri; content:"/vi22fe02226/792e0bff658f2ae7fbbaa7c2/index.php?id=40c92f7aa24713d87e3a9a66c2be7f13"; startswith; fast_pattern; http.host; content:"fraudoptix.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004118; classtype:social-engineering; sid:6004118; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (turbopage.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"turbopage.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004119; classtype:social-engineering; sid:6004119; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (r-unicorn-international.com/meta-page-fb/login)"; flow:established,to_server; http.uri; content:"/meta-page-fb/login"; startswith; fast_pattern; http.host; content:"r-unicorn-international.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004120; classtype:social-engineering; sid:6004120; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-resmi537.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"program-resmi537.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004121; classtype:social-engineering; sid:6004121; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingyr.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingyr.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004122; classtype:social-engineering; sid:6004122; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerserviceqp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerserviceqp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004123; classtype:social-engineering; sid:6004123; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingyt.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingyt.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004124; classtype:social-engineering; sid:6004124; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezosuites.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"trezosuites.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004125; classtype:social-engineering; sid:6004125; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whatsapp-hub-net.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsapp-hub-net.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004126; classtype:social-engineering; sid:6004126; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clone-facebook-alpha.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clone-facebook-alpha.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004127; classtype:social-engineering; sid:6004127; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (colegioconexao.com.br/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"colegioconexao.com.br"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004128; classtype:social-engineering; sid:6004128; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enthusiastic-cassava-092831.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"enthusiastic-cassava-092831.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004129; classtype:social-engineering; sid:6004129; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (little-travel-744918.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"little-travel-744918.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004130; classtype:social-engineering; sid:6004130; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (royamailpost.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"royamailpost.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004131; classtype:social-engineering; sid:6004131; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (youandeverwlse0nllne.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"youandeverwlse0nllne.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004132; classtype:social-engineering; sid:6004132; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (long-icloud.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"long-icloud.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004133; classtype:social-engineering; sid:6004133; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.educationpolicy.eu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.educationpolicy.eu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004134; classtype:social-engineering; sid:6004134; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cn-core-baowei.com/?Action&Apply/=)"; flow:established,to_server; http.uri; content:"/?Action&Apply/="; startswith; fast_pattern; http.host; content:"cn-core-baowei.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004135; classtype:social-engineering; sid:6004135; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.o4o23-200.xyz/lokalnie/?id=9P4r7Q3B4l9F6h9z2q0p9e8R3e5X9b4z)"; flow:established,to_server; http.uri; content:"/lokalnie/?id=9P4r7Q3B4l9F6h9z2q0p9e8R3e5X9b4z"; startswith; fast_pattern; http.host; content:"allegro.o4o23-200.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004136; classtype:social-engineering; sid:6004136; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezur-en-us.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezur-en-us.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004137; classtype:social-engineering; sid:6004137; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (setwallet.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"setwallet.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004138; classtype:social-engineering; sid:6004138; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dgtl.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dgtl.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004139; classtype:social-engineering; sid:6004139; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.device-detect.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.device-detect.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004140; classtype:social-engineering; sid:6004140; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.l-lcloud-1-com.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.l-lcloud-1-com.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004141; classtype:social-engineering; sid:6004141; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloud-localizado.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"icloud-localizado.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004142; classtype:social-engineering; sid:6004142; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.lcloud-support2.com/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.lcloud-support2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004143; classtype:social-engineering; sid:6004143; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wym.sfu.mybluehost.me/wp-includes/sitemaps/gucsapv/rkgmy1j/awpvyhb/property.html)"; flow:established,to_server; http.uri; content:"/wp-includes/sitemaps/gucsapv/rkgmy1j/awpvyhb/property.html"; startswith; fast_pattern; http.host; content:"wym.sfu.mybluehost.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004144; classtype:social-engineering; sid:6004144; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (epicinfo.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"epicinfo.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004145; classtype:social-engineering; sid:6004145; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (efficientattics.com/wp-admin/page.html)"; flow:established,to_server; http.uri; content:"/wp-admin/page.html"; startswith; fast_pattern; http.host; content:"efficientattics.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004146; classtype:social-engineering; sid:6004146; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lcloud-support2.com/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"lcloud-support2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004147; classtype:social-engineering; sid:6004147; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.support-icloudfinds.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.support-icloudfinds.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004148; classtype:social-engineering; sid:6004148; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.devicelocate.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.devicelocate.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004149; classtype:social-engineering; sid:6004149; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.ifindphonemy.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.ifindphonemy.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004150; classtype:social-engineering; sid:6004150; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ashish13-hub.github.io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"ashish13-hub.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004151; classtype:social-engineering; sid:6004151; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adityapandey87.github.io/adityaportfolio/)"; flow:established,to_server; http.uri; content:"/adityaportfolio/"; startswith; fast_pattern; http.host; content:"adityapandey87.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004152; classtype:social-engineering; sid:6004152; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unl.one/2ZZW4.mp4)"; flow:established,to_server; http.uri; content:"/2ZZW4.mp4"; startswith; fast_pattern; http.host; content:"unl.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004153; classtype:social-engineering; sid:6004153; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abhaythakor07.github.io/Amazon-Clone-Home-Page/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone-Home-Page/"; startswith; fast_pattern; http.host; content:"abhaythakor07.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004154; classtype:social-engineering; sid:6004154; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (plavereuropa.com/ap/signin)"; flow:established,to_server; http.uri; content:"/ap/signin"; startswith; fast_pattern; http.host; content:"plavereuropa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004155; classtype:social-engineering; sid:6004155; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lcloud-support1.com/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"lcloud-support1.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004156; classtype:social-engineering; sid:6004156; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (started-ledger.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"started-ledger.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004157; classtype:social-engineering; sid:6004157; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.icloud-myfind.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.icloud-myfind.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004158; classtype:social-engineering; sid:6004158; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maps-icloudmy1.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"maps-icloudmy1.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004159; classtype:social-engineering; sid:6004159; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ahn43814-boop.github.io/mircosoft-index/)"; flow:established,to_server; http.uri; content:"/mircosoft-index/"; startswith; fast_pattern; http.host; content:"ahn43814-boop.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004160; classtype:social-engineering; sid:6004160; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.device-iphone.life/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.device-iphone.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004161; classtype:social-engineering; sid:6004161; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myfindphone.help/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"myfindphone.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004162; classtype:social-engineering; sid:6004162; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (location-fmdl.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"location-fmdl.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004163; classtype:social-engineering; sid:6004163; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kleinanzeigen.klrdomkauf.shop/order/1j3Vt4RLBpCE/?plg=catchme)"; flow:established,to_server; http.uri; content:"/order/1j3Vt4RLBpCE/?plg=catchme"; startswith; fast_pattern; http.host; content:"kleinanzeigen.klrdomkauf.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004164; classtype:social-engineering; sid:6004164; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortsky.xyz/id/login)"; flow:established,to_server; http.uri; content:"/id/login"; startswith; fast_pattern; http.host; content:"fortsky.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004165; classtype:social-engineering; sid:6004165; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja003.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja003.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004166; classtype:social-engineering; sid:6004166; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.flndmeapple.info/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.flndmeapple.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004167; classtype:social-engineering; sid:6004167; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.findmy2.support/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"mail.findmy2.support"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004168; classtype:social-engineering; sid:6004168; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fy-device-iapple.com/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"fy-device-iapple.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004169; classtype:social-engineering; sid:6004169; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-iapple.com/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"help-iapple.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004170; classtype:social-engineering; sid:6004170; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.rccghopehall.com/m/index.html)"; flow:established,to_server; http.uri; content:"/m/index.html"; startswith; fast_pattern; http.host; content:"m.rccghopehall.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004171; classtype:social-engineering; sid:6004171; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (admintalkssuprt.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"admintalkssuprt.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004172; classtype:social-engineering; sid:6004172; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (attwireless-customersupport.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"attwireless-customersupport.framer.website"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004173; classtype:social-engineering; sid:6004173; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (technical-behaviors-537868.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"technical-behaviors-537868.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004174; classtype:social-engineering; sid:6004174; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cpmmemberfastalert.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cpmmemberfastalert.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004175; classtype:social-engineering; sid:6004175; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yarcher.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yarcher.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004176; classtype:social-engineering; sid:6004176; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ntdc-ngc-gov-pk.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ntdc-ngc-gov-pk.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004177; classtype:social-engineering; sid:6004177; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cbhdvbhbe.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cbhdvbhbe.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004178; classtype:social-engineering; sid:6004178; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (officce-upol-cz.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"officce-upol-cz.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004179; classtype:social-engineering; sid:6004179; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loyal-turnip-539496.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"loyal-turnip-539496.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004180; classtype:social-engineering; sid:6004180; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (talk-tk766.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"talk-tk766.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004181; classtype:social-engineering; sid:6004181; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zimbra---si.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zimbra---si.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004182; classtype:social-engineering; sid:6004182; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usiu-ac-ke.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"usiu-ac-ke.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004183; classtype:social-engineering; sid:6004183; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (djhjdcdhscbchdchjbhjh.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"djhjdcdhscbchdchjbhjh.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004184; classtype:social-engineering; sid:6004184; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sesowoower.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sesowoower.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004185; classtype:social-engineering; sid:6004185; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-18eepfj9u.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-18eepfj9u.godaddysites.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004186; classtype:social-engineering; sid:6004186; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shy-influence-729694.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shy-influence-729694.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004187; classtype:social-engineering; sid:6004187; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wandering-darlings-034248.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wandering-darlings-034248.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004188; classtype:social-engineering; sid:6004188; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jhdfbhdfbg.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jhdfbhdfbg.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004189; classtype:social-engineering; sid:6004189; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (43.156.0.130/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts.google.com%2F&%3Bifkv=AaSxoQyQEeCdGiNQploah5nAij7vrMqrlVIHby1Q4v_ARx9kttGkmffM4ARVCnkvjXQyGpUqW4kQNA&%3Bpassive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=Ac50bxsqxKjPnCQmHYI6gE_dIARzQ3Q1TeDEfYZSlMp7szjQ4Ie39w_IMdCTMsh-nZe-LACwU68i&dsh=S1510344005%3A1785386040008332)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?amp%3Bfollowup=https%3A%2F%2Faccounts.google.com%2F&%3Bifkv=AaSxoQyQEeCdGiNQploah5nAij7vrMqrlVIHby1Q4v_ARx9kttGkmffM4ARVCnkvjXQyGpUqW4kQNA&%3Bpassive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=Ac50bxsqxKjPnCQmHYI6gE_dIARzQ3Q1TeDEfYZSlMp7szjQ4Ie39w_IMdCTMsh-nZe-LACwU68i&dsh=S1510344005%3A1785386040008332"; startswith; fast_pattern; http.host; content:"43.156.0.130"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004190; classtype:social-engineering; sid:6004190; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agenbuteriasgob.top/es)"; flow:established,to_server; http.uri; content:"/es"; startswith; fast_pattern; http.host; content:"agenbuteriasgob.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004191; classtype:social-engineering; sid:6004191; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (specific-product-867778.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"specific-product-867778.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004192; classtype:social-engineering; sid:6004192; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.studyseed.net/wp-content/uploads/grok)"; flow:established,to_server; http.uri; content:"/wp-content/uploads/grok"; startswith; fast_pattern; http.host; content:"www.studyseed.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004193; classtype:social-engineering; sid:6004193; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portfolio-bcj.pages.dev/work/att/)"; flow:established,to_server; http.uri; content:"/work/att/"; startswith; fast_pattern; http.host; content:"portfolio-bcj.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004194; classtype:social-engineering; sid:6004194; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cliente-gg-limpfeirao.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cliente-gg-limpfeirao.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004195; classtype:social-engineering; sid:6004195; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docs--login--ledger-live-desktop-io.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"docs--login--ledger-live-desktop-io.typedream.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004196; classtype:social-engineering; sid:6004196; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (micro.statichost.page/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"micro.statichost.page"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004197; classtype:social-engineering; sid:6004197; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dev-ladgerlive-app.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dev-ladgerlive-app.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004198; classtype:social-engineering; sid:6004198; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metacase258177-fbrwvg.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metacase258177-fbrwvg.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004199; classtype:social-engineering; sid:6004199; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (foolish-leaders-968365.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"foolish-leaders-968365.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004200; classtype:social-engineering; sid:6004200; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metacase314490-fbm96q.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metacase314490-fbm96q.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004201; classtype:social-engineering; sid:6004201; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (siddharth-kadam-dev.github.io/Movie-Streaming-UI-Clone/)"; flow:established,to_server; http.uri; content:"/Movie-Streaming-UI-Clone/"; startswith; fast_pattern; http.host; content:"siddharth-kadam-dev.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004202; classtype:social-engineering; sid:6004202; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lotmail02.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lotmail02.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004203; classtype:social-engineering; sid:6004203; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (83332.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"83332.xyz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004204; classtype:social-engineering; sid:6004204; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp6ct-velnor-biz8-praskel-timvor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp6ct-velnor-biz8-praskel-timvor.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004205; classtype:social-engineering; sid:6004205; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (miuh76g543-dpfg0dhrch27.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"miuh76g543-dpfg0dhrch27.edgeone.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004206; classtype:social-engineering; sid:6004206; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (explore-ledgr-desktop-apps.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"explore-ledgr-desktop-apps.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004207; classtype:social-engineering; sid:6004207; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yuvakshimodi-cmyk.github.io/finance-advisor/)"; flow:established,to_server; http.uri; content:"/finance-advisor/"; startswith; fast_pattern; http.host; content:"yuvakshimodi-cmyk.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004208; classtype:social-engineering; sid:6004208; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robiox.com.py/users/308948519545/profile)"; flow:established,to_server; http.uri; content:"/users/308948519545/profile"; startswith; fast_pattern; http.host; content:"robiox.com.py"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004209; classtype:social-engineering; sid:6004209; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (geminileginei.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"geminileginei.webflow.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004210; classtype:social-engineering; sid:6004210; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dechricganoc.it.com/pdfreader/dir/)"; flow:established,to_server; http.uri; content:"/pdfreader/dir/"; startswith; fast_pattern; http.host; content:"dechricganoc.it.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004211; classtype:social-engineering; sid:6004211; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (item.ehay.com.login.secures-wr8wsvzt.construccionesjlfabririssas.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"item.ehay.com.login.secures-wr8wsvzt.construccionesjlfabririssas.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004212; classtype:social-engineering; sid:6004212; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (live-leedgar-get-us.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"live-leedgar-get-us.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004213; classtype:social-engineering; sid:6004213; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shreyas339.github.io/Projects/)"; flow:established,to_server; http.uri; content:"/Projects/"; startswith; fast_pattern; http.host; content:"shreyas339.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004214; classtype:social-engineering; sid:6004214; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitywer.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitywer.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004215; classtype:social-engineering; sid:6004215; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aptoswex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aptoswex.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004216; classtype:social-engineering; sid:6004216; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tzr-iejfd.destiny72.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tzr-iejfd.destiny72.workers.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004217; classtype:social-engineering; sid:6004217; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (desktop-ledgerlive-history.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"desktop-ledgerlive-history.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004218; classtype:social-engineering; sid:6004218; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.acti.cc/ac/)"; flow:established,to_server; http.uri; content:"/ac/"; startswith; fast_pattern; http.host; content:"www.acti.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004219; classtype:social-engineering; sid:6004219; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-ledgr-wllt.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en-ledgr-wllt.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004220; classtype:social-engineering; sid:6004220; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (indigo-difference-130061.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"indigo-difference-130061.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004221; classtype:social-engineering; sid:6004221; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jacko-dhl.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jacko-dhl.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004222; classtype:social-engineering; sid:6004222; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bfghfgrfrfgh655fef.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bfghfgrfrfgh655fef.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004223; classtype:social-engineering; sid:6004223; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (desktopledgerlive.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"desktopledgerlive.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004224; classtype:social-engineering; sid:6004224; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (83347.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"83347.xyz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004225; classtype:social-engineering; sid:6004225; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ew4rt.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ew4rt.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004226; classtype:social-engineering; sid:6004226; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sin1.contabostorage.com/d96fc17aeb3741e493b2e5b3a72a669f:appsuiteuser-domainappio.oxmailfolderdefault0server0update/netvvorkservice-netsolappsuitep0rt.html)"; flow:established,to_server; http.uri; content:"/d96fc17aeb3741e493b2e5b3a72a669f:appsuiteuser-domainappio.oxmailfolderdefault0server0update/netvvorkservice-netsolappsuitep0rt.html"; startswith; fast_pattern; http.host; content:"sin1.contabostorage.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004227; classtype:social-engineering; sid:6004227; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox.com.pt/404)"; flow:established,to_server; http.uri; content:"/404"; startswith; fast_pattern; http.host; content:"www.roblox.com.pt"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004228; classtype:social-engineering; sid:6004228; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cg157984.tw1.ru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cg157984.tw1.ru"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004229; classtype:social-engineering; sid:6004229; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr4657tfrde46ydhyggerfde.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr4657tfrde46ydhyggerfde.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004230; classtype:social-engineering; sid:6004230; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eng-wallttreez-us.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eng-wallttreez-us.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004231; classtype:social-engineering; sid:6004231; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazongenerator.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazongenerator.edgeone.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004232; classtype:social-engineering; sid:6004232; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentojamais03.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentojamais03.s3.us-east-005.backblazeb2.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004233; classtype:social-engineering; sid:6004233; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (googles-lab.github.io/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"googles-lab.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004234; classtype:social-engineering; sid:6004234; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paket.info.158-158-1-61.cpanel.site/pl/update.php?token=rr7e6uq2ook6aoxxt7q1)"; flow:established,to_server; http.uri; content:"/pl/update.php?token=rr7e6uq2ook6aoxxt7q1"; startswith; fast_pattern; http.host; content:"paket.info.158-158-1-61.cpanel.site"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004235; classtype:social-engineering; sid:6004235; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nice-gray-rmhnvluy.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nice-gray-rmhnvluy.edgeone.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004236; classtype:social-engineering; sid:6004236; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (junkbegonedumpsters.com/wp-includes/theme-compat/rschxym/cmron1i/fhzpatq/sanctuary/fe.html)"; flow:established,to_server; http.uri; content:"/wp-includes/theme-compat/rschxym/cmron1i/fhzpatq/sanctuary/fe.html"; startswith; fast_pattern; http.host; content:"junkbegonedumpsters.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004237; classtype:social-engineering; sid:6004237; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ex344xrfxr.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ex344xrfxr.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004238; classtype:social-engineering; sid:6004238; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (us-ldgrelives-en.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"us-ldgrelives-en.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004239; classtype:social-engineering; sid:6004239; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (himthermo.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"himthermo.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004240; classtype:social-engineering; sid:6004240; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (page-en-live-ledger.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"page-en-live-ledger.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004241; classtype:social-engineering; sid:6004241; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (exoduss-pdf-wallet.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"exoduss-pdf-wallet.wasmer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004242; classtype:social-engineering; sid:6004242; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shukla-harshita.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"shukla-harshita.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004243; classtype:social-engineering; sid:6004243; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ruxbl-4.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ruxbl-4.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004244; classtype:social-engineering; sid:6004244; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rss2.sayler.at/go/y2c4y254/y274x274)"; flow:established,to_server; http.uri; content:"/go/y2c4y254/y274x274"; startswith; fast_pattern; http.host; content:"rss2.sayler.at"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004245; classtype:social-engineering; sid:6004245; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mail1-accedi-libero-staff-it-italy-sslitaly423429kf923kc092kc.casajasmine.ro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mail1-accedi-libero-staff-it-italy-sslitaly423429kf923kc092kc.casajasmine.ro"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004246; classtype:social-engineering; sid:6004246; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (silly-card-849458.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"silly-card-849458.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004247; classtype:social-engineering; sid:6004247; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aquaaa7328opposs.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aquaaa7328opposs.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004248; classtype:social-engineering; sid:6004248; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreicavkuyvd7kpfoazwtemvzcdg7vxlrwpd4g2uiqachk4a5xdx4e6a.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreicavkuyvd7kpfoazwtemvzcdg7vxlrwpd4g2uiqachk4a5xdx4e6a.ipfs.dweb.link"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004249; classtype:social-engineering; sid:6004249; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vvajhhsxxzk4e8483jxxjs.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vvajhhsxxzk4e8483jxxjs.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004250; classtype:social-engineering; sid:6004250; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hdoosde.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hdoosde.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004251; classtype:social-engineering; sid:6004251; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adflow-browser-usage.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"adflow-browser-usage.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004252; classtype:social-engineering; sid:6004252; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (updatextraconzsecure.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"updatextraconzsecure.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004253; classtype:social-engineering; sid:6004253; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (03191190026.github.io/Amazon-Clone-Web-Page-Project/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone-Web-Page-Project/"; startswith; fast_pattern; http.host; content:"03191190026.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004254; classtype:social-engineering; sid:6004254; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (andreww-nguyen.github.io/amazon-project/)"; flow:established,to_server; http.uri; content:"/amazon-project/"; startswith; fast_pattern; http.host; content:"andreww-nguyen.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004255; classtype:social-engineering; sid:6004255; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (checkingmaildaily.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"checkingmaildaily.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004256; classtype:social-engineering; sid:6004256; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eng-bridge-trezo-guide.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eng-bridge-trezo-guide.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004257; classtype:social-engineering; sid:6004257; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebooksignuplogin.blogspot.com/2011/09/email-password-keep-me-logged-in-forgot.html)"; flow:established,to_server; http.uri; content:"/2011/09/email-password-keep-me-logged-in-forgot.html"; startswith; fast_pattern; http.host; content:"facebooksignuplogin.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004258; classtype:social-engineering; sid:6004258; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fuchsia-graphs-773214.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fuchsia-graphs-773214.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004259; classtype:social-engineering; sid:6004259; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m2icrosfoftonilelogin.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m2icrosfoftonilelogin.framer.website"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004260; classtype:social-engineering; sid:6004260; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (signuupoutlook.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"signuupoutlook.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004261; classtype:social-engineering; sid:6004261; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail-pieas-edu-pk.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webmail-pieas-edu-pk.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004262; classtype:social-engineering; sid:6004262; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metaogye-noticefb851233.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metaogye-noticefb851233.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004263; classtype:social-engineering; sid:6004263; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dist-tan-ten-93.vercel.app/signin.html)"; flow:established,to_server; http.uri; content:"/signin.html"; startswith; fast_pattern; http.host; content:"dist-tan-ten-93.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004264; classtype:social-engineering; sid:6004264; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhavikmirchandani94-star.github.io/ledger-banking-site/)"; flow:established,to_server; http.uri; content:"/ledger-banking-site/"; startswith; fast_pattern; http.host; content:"bhavikmirchandani94-star.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004265; classtype:social-engineering; sid:6004265; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (energized-grapefruit-585921.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"energized-grapefruit-585921.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004266; classtype:social-engineering; sid:6004266; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apexlendinggroup.us/wp-content/logs/?uid=Nvalos@6e5adf498030f8d01aba0a36d73dc548beac.net)"; flow:established,to_server; http.uri; content:"/wp-content/logs/?uid=Nvalos@6e5adf498030f8d01aba0a36d73dc548beac.net"; startswith; fast_pattern; http.host; content:"apexlendinggroup.us"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004267; classtype:social-engineering; sid:6004267; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marvelous-building-703227.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"marvelous-building-703227.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004268; classtype:social-engineering; sid:6004268; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robl0xlogin.github.io/roblox-login/)"; flow:established,to_server; http.uri; content:"/roblox-login/"; startswith; fast_pattern; http.host; content:"robl0xlogin.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004269; classtype:social-engineering; sid:6004269; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (talktalkfghdfge234.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"talktalkfghdfge234.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004270; classtype:social-engineering; sid:6004270; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.messenger-wapp.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.messenger-wapp.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004271; classtype:social-engineering; sid:6004271; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coja.life/find/following-agreement.html)"; flow:established,to_server; http.uri; content:"/find/following-agreement.html"; startswith; fast_pattern; http.host; content:"coja.life"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004272; classtype:social-engineering; sid:6004272; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (claim-offer.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"claim-offer.netlify.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004273; classtype:social-engineering; sid:6004273; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lower-forms-047117.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lower-forms-047117.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004274; classtype:social-engineering; sid:6004274; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paypalcorp.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paypalcorp.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004275; classtype:social-engineering; sid:6004275; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vvvvw-roblox.com/users/1950487385/profile)"; flow:established,to_server; http.uri; content:"/users/1950487385/profile"; startswith; fast_pattern; http.host; content:"vvvvw-roblox.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004276; classtype:social-engineering; sid:6004276; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (it.m.sonicmenusprices.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"it.m.sonicmenusprices.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004277; classtype:social-engineering; sid:6004277; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crypto-ledgrlive.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"crypto-ledgrlive.wasmer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004278; classtype:social-engineering; sid:6004278; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chimex.com.mx/wp-admin/admin/am/infospage.php)"; flow:established,to_server; http.uri; content:"/wp-admin/admin/am/infospage.php"; startswith; fast_pattern; http.host; content:"chimex.com.mx"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004279; classtype:social-engineering; sid:6004279; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylaterzz.zavg.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylaterzz.zavg.my.id"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004280; classtype:social-engineering; sid:6004280; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (get-leddger-livep-en.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"get-leddger-livep-en.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004281; classtype:social-engineering; sid:6004281; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sweranauman-sketch.github.io/Amazon/)"; flow:established,to_server; http.uri; content:"/Amazon/"; startswith; fast_pattern; http.host; content:"sweranauman-sketch.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004282; classtype:social-engineering; sid:6004282; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www--roblox.co/communities/12543965)"; flow:established,to_server; http.uri; content:"/communities/12543965"; startswith; fast_pattern; http.host; content:"www--roblox.co"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004283; classtype:social-engineering; sid:6004283; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct-fanik-biz8-hurem-lovex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct-fanik-biz8-hurem-lovex.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004284; classtype:social-engineering; sid:6004284; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct-foril-biz8-kurem-savon.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct-foril-biz8-kurem-savon.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004285; classtype:social-engineering; sid:6004285; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ruxbl-4.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ruxbl-4.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004286; classtype:social-engineering; sid:6004286; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uniswap-eth-chain-gateaway-v25.vercel.app/main.html)"; flow:established,to_server; http.uri; content:"/main.html"; startswith; fast_pattern; http.host; content:"uniswap-eth-chain-gateaway-v25.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004287; classtype:social-engineering; sid:6004287; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ww547.scotaibank.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ww547.scotaibank.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004288; classtype:social-engineering; sid:6004288; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prathmesh235.github.io/Spotify_Clone/)"; flow:established,to_server; http.uri; content:"/Spotify_Clone/"; startswith; fast_pattern; http.host; content:"prathmesh235.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004289; classtype:social-engineering; sid:6004289; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgr-live-app.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgr-live-app.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004290; classtype:social-engineering; sid:6004290; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ndadevdev.github.io/instagram)"; flow:established,to_server; http.uri; content:"/instagram"; startswith; fast_pattern; http.host; content:"ndadevdev.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004291; classtype:social-engineering; sid:6004291; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eastlinkghhfjf.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eastlinkghhfjf.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004292; classtype:social-engineering; sid:6004292; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shaimalpp.github.io/netflix/)"; flow:established,to_server; http.uri; content:"/netflix/"; startswith; fast_pattern; http.host; content:"shaimalpp.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004293; classtype:social-engineering; sid:6004293; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (official-leadgr-en.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"official-leadgr-en.wasmer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004294; classtype:social-engineering; sid:6004294; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home-ldger-get.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"home-ldger-get.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004295; classtype:social-engineering; sid:6004295; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (official-trezorstas.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"official-trezorstas.wasmer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004296; classtype:social-engineering; sid:6004296; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verifymymailxfinity.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"verifymymailxfinity.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004297; classtype:social-engineering; sid:6004297; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xxchangeonline.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xxchangeonline.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004298; classtype:social-engineering; sid:6004298; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-trenax-biz8-morix-faven.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-trenax-biz8-morix-faven.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004299; classtype:social-engineering; sid:6004299; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (83368.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"83368.xyz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004300; classtype:social-engineering; sid:6004300; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ivvvaaannaaalaaawiiiiifamilly.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ivvvaaannaaalaaawiiiiifamilly.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004301; classtype:social-engineering; sid:6004301; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metacase027126-fbo84p.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metacase027126-fbo84p.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004302; classtype:social-engineering; sid:6004302; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (magnificent-caramel-e8de44.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"magnificent-caramel-e8de44.netlify.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004303; classtype:social-engineering; sid:6004303; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgecom-start-en-io.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgecom-start-en-io.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004304; classtype:social-engineering; sid:6004304; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (static-decisions-424911.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"static-decisions-424911.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004305; classtype:social-engineering; sid:6004305; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s3.us-east-005.backblazeb2.com/FundoCheckoutG.L.N.Meta2027/aumento.html)"; flow:established,to_server; http.uri; content:"/FundoCheckoutG.L.N.Meta2027/aumento.html"; startswith; fast_pattern; http.host; content:"s3.us-east-005.backblazeb2.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004306; classtype:social-engineering; sid:6004306; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tesourooportunidadeacme-prod-transaction-limits.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"tesourooportunidadeacme-prod-transaction-limits.s3.us-east-005.backblazeb2.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004307; classtype:social-engineering; sid:6004307; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tributariconfirmars-es.top/ES)"; flow:established,to_server; http.uri; content:"/ES"; startswith; fast_pattern; http.host; content:"tributariconfirmars-es.top"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004308; classtype:social-engineering; sid:6004308; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aksprofessional.github.io/amazon-clone.project/)"; flow:established,to_server; http.uri; content:"/amazon-clone.project/"; startswith; fast_pattern; http.host; content:"aksprofessional.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004309; classtype:social-engineering; sid:6004309; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enchanted-darlings-194810.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"enchanted-darlings-194810.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004310; classtype:social-engineering; sid:6004310; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docshrreadm.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"docshrreadm.me"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004311; classtype:social-engineering; sid:6004311; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sucurpanamigob360.onrender.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sucurpanamigob360.onrender.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004312; classtype:social-engineering; sid:6004312; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (few-teal-lgrkmvcy.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"few-teal-lgrkmvcy.edgeone.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004313; classtype:social-engineering; sid:6004313; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (princeyy0707-cell.github.io/Expo668)"; flow:established,to_server; http.uri; content:"/Expo668"; startswith; fast_pattern; http.host; content:"princeyy0707-cell.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004314; classtype:social-engineering; sid:6004314; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adminnnnnwebb.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"adminnnnnwebb.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004315; classtype:social-engineering; sid:6004315; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.robiox.com.ps/users/8507824409/profile)"; flow:established,to_server; http.uri; content:"/users/8507824409/profile"; startswith; fast_pattern; http.host; content:"www.robiox.com.ps"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004316; classtype:social-engineering; sid:6004316; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3ex33x3x34.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3ex33x3x34.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004317; classtype:social-engineering; sid:6004317; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta8a31-noticefb344166.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meta8a31-noticefb344166.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004318; classtype:social-engineering; sid:6004318; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myshoip-7-11-com-tw.549dk.link/ht/kefu.php?ClickID=13&amount=50.00)"; flow:established,to_server; http.uri; content:"/ht/kefu.php?ClickID=13&amount=50.00"; startswith; fast_pattern; http.host; content:"myshoip-7-11-com-tw.549dk.link"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004319; classtype:social-engineering; sid:6004319; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (igvu7-7g17-p20-xsyh9g-uai0v.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"igvu7-7g17-p20-xsyh9g-uai0v.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004320; classtype:social-engineering; sid:6004320; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (left-pitch-487249.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"left-pitch-487249.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004321; classtype:social-engineering; sid:6004321; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (talktalkupdate2026.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"talktalkupdate2026.framer.ai"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004322; classtype:social-engineering; sid:6004322; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iop3-77a9-3osu.aflores-rorealty-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"iop3-77a9-3osu.aflores-rorealty-com-s-account.workers.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004323; classtype:social-engineering; sid:6004323; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marxist-crimson-uccvkwvs.edgeone.dev/ovh.html)"; flow:established,to_server; http.uri; content:"/ovh.html"; startswith; fast_pattern; http.host; content:"marxist-crimson-uccvkwvs.edgeone.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004324; classtype:social-engineering; sid:6004324; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accountverify.au/?r=04b430ed-96d3-4148-90f9-c86b25e1d7a5&rg=eu)"; flow:established,to_server; http.uri; content:"/?r=04b430ed-96d3-4148-90f9-c86b25e1d7a5&rg=eu"; startswith; fast_pattern; http.host; content:"accountverify.au"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004325; classtype:social-engineering; sid:6004325; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cliente-yy-limpfeirao.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cliente-yy-limpfeirao.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004326; classtype:social-engineering; sid:6004326; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.connectsecurehomelaiding.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.connectsecurehomelaiding.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004327; classtype:social-engineering; sid:6004327; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (staking1portfolio.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"staking1portfolio.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004328; classtype:social-engineering; sid:6004328; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (connect-livelgr-eng.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"connect-livelgr-eng.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004329; classtype:social-engineering; sid:6004329; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-download-ledgelive.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en-download-ledgelive.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004330; classtype:social-engineering; sid:6004330; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x-fy.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"x-fy.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004331; classtype:social-engineering; sid:6004331; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (us-en-desktoplive.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"us-en-desktoplive.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004332; classtype:social-engineering; sid:6004332; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whatsapper.leadball.ru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsapper.leadball.ru"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004333; classtype:social-engineering; sid:6004333; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anjali27feb.github.io/E_Commerce_Clone/)"; flow:established,to_server; http.uri; content:"/E_Commerce_Clone/"; startswith; fast_pattern; http.host; content:"anjali27feb.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004334; classtype:social-engineering; sid:6004334; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.83352.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.83352.xyz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004335; classtype:social-engineering; sid:6004335; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgerlive-on.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgerlive-on.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004336; classtype:social-engineering; sid:6004336; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kanishkanaik.github.io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"kanishkanaik.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004337; classtype:social-engineering; sid:6004337; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct-samex-biz8-hurel-koniv.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct-samex-biz8-hurel-koniv.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004338; classtype:social-engineering; sid:6004338; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.r.oblox.com.et/users/2661706558/profile)"; flow:established,to_server; http.uri; content:"/users/2661706558/profile"; startswith; fast_pattern; http.host; content:"www.r.oblox.com.et"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004339; classtype:social-engineering; sid:6004339; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anuja2793.github.io/Netflix-landing-pages/)"; flow:established,to_server; http.uri; content:"/Netflix-landing-pages/"; startswith; fast_pattern; http.host; content:"anuja2793.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004340; classtype:social-engineering; sid:6004340; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suite-trezur-el.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"suite-trezur-el.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004341; classtype:social-engineering; sid:6004341; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (angad-ji.github.io/Amazon/)"; flow:established,to_server; http.uri; content:"/Amazon/"; startswith; fast_pattern; http.host; content:"angad-ji.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004342; classtype:social-engineering; sid:6004342; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (admin-care-centeranetseurereviewaccounttoday.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"admin-care-centeranetseurereviewaccounttoday.square.site"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004343; classtype:social-engineering; sid:6004343; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitymail2026.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitymail2026.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004344; classtype:social-engineering; sid:6004344; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (23x23x23x.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"23x23x23x.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004345; classtype:social-engineering; sid:6004345; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (us1-auth-docs-static-f049698-p396932.joel-89f.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"us1-auth-docs-static-f049698-p396932.joel-89f.workers.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004346; classtype:social-engineering; sid:6004346; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox.com.kz/share?code=70866209249101970327377432676230&type=Profile&source=ProfileShare&gameid=84515722934860)"; flow:established,to_server; http.uri; content:"/share?code=70866209249101970327377432676230&type=Profile&source=ProfileShare&gameid=84515722934860"; startswith; fast_pattern; http.host; content:"roblox.com.kz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004347; classtype:social-engineering; sid:6004347; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telzora-gld-belxora-r9t6hk58.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telzora-gld-belxora-r9t6hk58.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004348; classtype:social-engineering; sid:6004348; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ldgrr--live.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ldgrr--live.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004349; classtype:social-engineering; sid:6004349; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eternal-team-881838.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eternal-team-881838.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004350; classtype:social-engineering; sid:6004350; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accounts-facebook.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"accounts-facebook.blogspot.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004351; classtype:social-engineering; sid:6004351; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kuwqnlogin.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kuwqnlogin.webflow.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004352; classtype:social-engineering; sid:6004352; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.hunanqingang.com/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"login.hunanqingang.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004353; classtype:social-engineering; sid:6004353; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rough-plum-xd7jzfml.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rough-plum-xd7jzfml.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004354; classtype:social-engineering; sid:6004354; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shah-project.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shah-project.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004355; classtype:social-engineering; sid:6004355; rev:1; metadata: signature_severity Major, created_et 2026_07_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metanask-download.com/metamask/welcome.php)"; flow:established,to_server; http.uri; content:"/metamask/welcome.php"; startswith; fast_pattern; http.host; content:"metanask-download.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004356; classtype:social-engineering; sid:6004356; rev:1; metadata: signature_severity Major, created_et 2026_07_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (phemayameltahub.site/wp-includes/pomo/ini_db-update.php)"; flow:established,to_server; http.uri; content:"/wp-includes/pomo/ini_db-update.php"; startswith; fast_pattern; http.host; content:"phemayameltahub.site"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004357; classtype:social-engineering; sid:6004357; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cashapp-liart.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cashapp-liart.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004358; classtype:social-engineering; sid:6004358; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netliflixx.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netliflixx.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004359; classtype:social-engineering; sid:6004359; rev:1; metadata: signature_severity Major, created_et 2026_07_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (link.infini.fr/1rz0D9X5)"; flow:established,to_server; http.uri; content:"/1rz0D9X5"; startswith; fast_pattern; http.host; content:"link.infini.fr"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004360; classtype:social-engineering; sid:6004360; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ghanapoest.eu.cc/gh)"; flow:established,to_server; http.uri; content:"/gh"; startswith; fast_pattern; http.host; content:"ghanapoest.eu.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004361; classtype:social-engineering; sid:6004361; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct6-zolvik-biz-qarnex-platir.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct6-zolvik-biz-qarnex-platir.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004362; classtype:social-engineering; sid:6004362; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (twilightbrand.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"twilightbrand.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004363; classtype:social-engineering; sid:6004363; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee2444.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee2444.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004364; classtype:social-engineering; sid:6004364; rev:1; metadata: signature_severity Major, created_et 2026_06_08, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecoviasemfila.guiasindividuais.online/ecovias/?xp=)"; flow:established,to_server; http.uri; content:"/ecovias/?xp="; startswith; fast_pattern; http.host; content:"ecoviasemfila.guiasindividuais.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004365; classtype:social-engineering; sid:6004365; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.orutwf.top/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.orutwf.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004366; classtype:social-engineering; sid:6004366; rev:1; metadata: signature_severity Major, created_et 2026_06_09, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.jxtrmpqv.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.jxtrmpqv.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004367; classtype:social-engineering; sid:6004367; rev:1; metadata: signature_severity Major, created_et 2026_06_10, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (monespace-reglement.com/support/login/)"; flow:established,to_server; http.uri; content:"/support/login/"; startswith; fast_pattern; http.host; content:"monespace-reglement.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004368; classtype:social-engineering; sid:6004368; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (caconstructionweb.com/bdhvio/)"; flow:established,to_server; http.uri; content:"/bdhvio/"; startswith; fast_pattern; http.host; content:"caconstructionweb.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004369; classtype:social-engineering; sid:6004369; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (beaz-c7czfkh3guhaffaf.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"beaz-c7czfkh3guhaffaf.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004370; classtype:social-engineering; sid:6004370; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (srujana882006.github.io/amazon-css-clone/)"; flow:established,to_server; http.uri; content:"/amazon-css-clone/"; startswith; fast_pattern; http.host; content:"srujana882006.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004371; classtype:social-engineering; sid:6004371; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.vwk.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.vwk.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004372; classtype:social-engineering; sid:6004372; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (orange513.sjmwu.top/?orange=513)"; flow:established,to_server; http.uri; content:"/?orange=513"; startswith; fast_pattern; http.host; content:"orange513.sjmwu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004373; classtype:social-engineering; sid:6004373; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brtzxv.cfd/HF)"; flow:established,to_server; http.uri; content:"/HF"; startswith; fast_pattern; http.host; content:"brtzxv.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004374; classtype:social-engineering; sid:6004374; rev:1; metadata: signature_severity Major, created_et 2026_06_11, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pasastesintag.pics/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pasastesintag.pics"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004375; classtype:social-engineering; sid:6004375; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agadvantagegroup.com/public/view/)"; flow:established,to_server; http.uri; content:"/public/view/"; startswith; fast_pattern; http.host; content:"agadvantagegroup.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004376; classtype:social-engineering; sid:6004376; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netcoins-help-logi--cdn.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netcoins-help-logi--cdn.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004377; classtype:social-engineering; sid:6004377; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tokenpcktoe.pro/security)"; flow:established,to_server; http.uri; content:"/security"; startswith; fast_pattern; http.host; content:"tokenpcktoe.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004378; classtype:social-engineering; sid:6004378; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortnitelocker.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortnitelocker.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004379; classtype:social-engineering; sid:6004379; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d259p54wqxi9ep.cloudfront.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d259p54wqxi9ep.cloudfront.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004380; classtype:social-engineering; sid:6004380; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (profycom.rs/feisbuck-456756454645/)"; flow:established,to_server; http.uri; content:"/feisbuck-456756454645/"; startswith; fast_pattern; http.host; content:"profycom.rs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004381; classtype:social-engineering; sid:6004381; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.galasongirisler.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.galasongirisler.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004382; classtype:social-engineering; sid:6004382; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (markatuna.com/docusign/docusign/Windows/utility.php)"; flow:established,to_server; http.uri; content:"/docusign/docusign/Windows/utility.php"; startswith; fast_pattern; http.host; content:"markatuna.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004383; classtype:social-engineering; sid:6004383; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.zff.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.zff.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004384; classtype:social-engineering; sid:6004384; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verificarcuenta365.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"verificarcuenta365.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004385; classtype:social-engineering; sid:6004385; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (interactive-checklist-656460.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"interactive-checklist-656460.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004386; classtype:social-engineering; sid:6004386; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tkiltokdownload.com/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"tkiltokdownload.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004387; classtype:social-engineering; sid:6004387; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (teams-jk.com/p/fjbd-cbcr/ypixvvaa/)"; flow:established,to_server; http.uri; content:"/p/fjbd-cbcr/ypixvvaa/"; startswith; fast_pattern; http.host; content:"teams-jk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004388; classtype:social-engineering; sid:6004388; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.matesanto.com/choiceandcontrol/choiceandcontrol.htm)"; flow:established,to_server; http.uri; content:"/choiceandcontrol/choiceandcontrol.htm"; startswith; fast_pattern; http.host; content:"www.matesanto.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004389; classtype:social-engineering; sid:6004389; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (readfile.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"readfile.online"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004390; classtype:social-engineering; sid:6004390; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (morg-234.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"morg-234.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004391; classtype:social-engineering; sid:6004391; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (litera-bavarica.de/suchen/d_person.php?person=%22%2F%3E%3Cimg%20src%3D%22https%3A%2F%2Fgoogle.com%2FUPs4z0e1QBo7C.jpg%22%20onerror%3D%22window.location%3DdecodeURIComponent%28atob%28%27Njg3NDc0NzA3MzNhMmYyZjZhNjU3NDdhNzQyZTcwNzU3MzY4MmQ3NDYxNmUyZDY1NzI2ZTY1NzU2NTcyNmUyZTY5NmU2NjZmMmY3Mzc0NjE3Mjc0MmU3MDY4NzAyMzcwNjE2MzUyNmI0NTcwNzY%3D%27%29.replace%28%2F%28..%29%2Fg%2C%20%27%25%241%27%29%29%3B%22%3E)"; flow:established,to_server; http.uri; content:"/suchen/d_person.php?person=%22%2F%3E%3Cimg%20src%3D%22https%3A%2F%2Fgoogle.com%2FUPs4z0e1QBo7C.jpg%22%20onerror%3D%22window.location%3DdecodeURIComponent%28atob%28%27Njg3NDc0NzA3MzNhMmYyZjZhNjU3NDdhNzQyZTcwNzU3MzY4MmQ3NDYxNmUyZDY1NzI2ZTY1NzU2NTcyNmUyZTY5NmU2NjZmMmY3Mzc0NjE3Mjc0MmU3MDY4NzAyMzcwNjE2MzUyNmI0NTcwNzY%3D%27%29.replace%28%2F%28..%29%2Fg%2C%20%27%25%241%27%29%29%3B%22%3E"; startswith; fast_pattern; http.host; content:"litera-bavarica.de"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004392; classtype:social-engineering; sid:6004392; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.861365.cc/?a=352698)"; flow:established,to_server; http.uri; content:"/?a=352698"; startswith; fast_pattern; http.host; content:"www.861365.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004393; classtype:social-engineering; sid:6004393; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-security-account.help/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"info-security-account.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004394; classtype:social-engineering; sid:6004394; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galeri-pemenang-shopee2021.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galeri-pemenang-shopee2021.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004395; classtype:social-engineering; sid:6004395; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (your-lost-iphone-apple-suspended.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"your-lost-iphone-apple-suspended.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004396; classtype:social-engineering; sid:6004396; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cloud-aldm-poh.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"cloud-aldm-poh.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004397; classtype:social-engineering; sid:6004397; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (find-account.help/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"find-account.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004398; classtype:social-engineering; sid:6004398; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (undianresmishopee2022.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"undianresmishopee2022.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004399; classtype:social-engineering; sid:6004399; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-resmi44.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"program-resmi44.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004400; classtype:social-engineering; sid:6004400; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suport.office365-update.org/?rid=ra8WGHO)"; flow:established,to_server; http.uri; content:"/?rid=ra8WGHO"; startswith; fast_pattern; http.host; content:"suport.office365-update.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004401; classtype:social-engineering; sid:6004401; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lcloud-iphonemaps.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"lcloud-iphonemaps.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004402; classtype:social-engineering; sid:6004402; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bonfires.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bonfires.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004403; classtype:social-engineering; sid:6004403; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mrako.vip/promo.html)"; flow:established,to_server; http.uri; content:"/promo.html"; startswith; fast_pattern; http.host; content:"mrako.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004404; classtype:social-engineering; sid:6004404; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bridge--a-public-trezor.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bridge--a-public-trezor.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004405; classtype:social-engineering; sid:6004405; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee2545.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopee2545.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004406; classtype:social-engineering; sid:6004406; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (findmappas-ldcloudmp.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"findmappas-ldcloudmp.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004407; classtype:social-engineering; sid:6004407; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lcloud-mex-loginmaps.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"lcloud-mex-loginmaps.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004408; classtype:social-engineering; sid:6004408; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (am.ydvxk.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"am.ydvxk.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004409; classtype:social-engineering; sid:6004409; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (project2-amazone-clone.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"project2-amazone-clone.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004410; classtype:social-engineering; sid:6004410; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (energetic-rose-pony.31-22-7-7.cpanel.site/bony/)"; flow:established,to_server; http.uri; content:"/bony/"; startswith; fast_pattern; http.host; content:"energetic-rose-pony.31-22-7-7.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004411; classtype:social-engineering; sid:6004411; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app649669.hasspetorleum.com/r/?auth=b11750fa7c8490e0&u=aHR0cHM6Ly8xMDEtcGVyc29uYWwtcHJvamVjdHMtdGVzdGluZy5hcHB3cml0ZS5uZXR3b3JrLz9hdXRoPXdlYm1hc3RlckByY2p5Lmdvdi5zYQ==)"; flow:established,to_server; http.uri; content:"/r/?auth=b11750fa7c8490e0&u=aHR0cHM6Ly8xMDEtcGVyc29uYWwtcHJvamVjdHMtdGVzdGluZy5hcHB3cml0ZS5uZXR3b3JrLz9hdXRoPXdlYm1hc3RlckByY2p5Lmdvdi5zYQ=="; startswith; fast_pattern; http.host; content:"app649669.hasspetorleum.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004412; classtype:social-engineering; sid:6004412; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (avijeet1912.github.io/Streamflix)"; flow:established,to_server; http.uri; content:"/Streamflix"; startswith; fast_pattern; http.host; content:"avijeet1912.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004413; classtype:social-engineering; sid:6004413; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www-applecol-support-encontrar.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"www-applecol-support-encontrar.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004414; classtype:social-engineering; sid:6004414; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerservicez.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerservicez.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004415; classtype:social-engineering; sid:6004415; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kjhgrtykbhj-dpxqvlaupe9d.edgeone.cool/?eo_token=48787297ca6c107cd16b7bf4c3f31c79)"; flow:established,to_server; http.uri; content:"/?eo_token=48787297ca6c107cd16b7bf4c3f31c79"; startswith; fast_pattern; http.host; content:"kjhgrtykbhj-dpxqvlaupe9d.edgeone.cool"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004416; classtype:social-engineering; sid:6004416; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (col-ilogincloud.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"col-ilogincloud.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004417; classtype:social-engineering; sid:6004417; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (buscami-dispenlinea.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"buscami-dispenlinea.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004418; classtype:social-engineering; sid:6004418; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aauth---trazorr.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aauth---trazorr.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004419; classtype:social-engineering; sid:6004419; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2355bet.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2355bet.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004420; classtype:social-engineering; sid:6004420; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (find-my-phone-al-ldevices-offline.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"find-my-phone-al-ldevices-offline.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004421; classtype:social-engineering; sid:6004421; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee2545.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee2545.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004422; classtype:social-engineering; sid:6004422; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd.gnzrwplx.cfd/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"dpd.gnzrwplx.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004423; classtype:social-engineering; sid:6004423; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lcloud-maps26.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"lcloud-maps26.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004424; classtype:social-engineering; sid:6004424; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (superfluous-deck-706256.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"superfluous-deck-706256.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004425; classtype:social-engineering; sid:6004425; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.allegg.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.allegg.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004426; classtype:social-engineering; sid:6004426; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (theresultsearch.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"theresultsearch.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004427; classtype:social-engineering; sid:6004427; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (truea1sdvbjhsdvbjhsdb-f4d7epekfteqbwcw.z02.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"truea1sdvbjhsdvbjhsdb-f4d7epekfteqbwcw.z02.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004428; classtype:social-engineering; sid:6004428; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dccertificate.in/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dccertificate.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004429; classtype:social-engineering; sid:6004429; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso---i-trustcapital-home-com.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso---i-trustcapital-home-com.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004430; classtype:social-engineering; sid:6004430; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.perchemicals.com.tr/images/index.html)"; flow:established,to_server; http.uri; content:"/images/index.html"; startswith; fast_pattern; http.host; content:"www.perchemicals.com.tr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004431; classtype:social-engineering; sid:6004431; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreidg7dhaupuit4wc2i7w22mphyqnlsp6cvp6gplvh7w4t25hmip24q.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreidg7dhaupuit4wc2i7w22mphyqnlsp6cvp6gplvh7w4t25hmip24q.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004432; classtype:social-engineering; sid:6004432; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gouvdgfesdavs.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.gouvdgfesdavs.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004433; classtype:social-engineering; sid:6004433; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (businees-verify-badge-vip-12363123xcv.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"businees-verify-badge-vip-12363123xcv.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004434; classtype:social-engineering; sid:6004434; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (author-start-trezor.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"author-start-trezor.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004435; classtype:social-engineering; sid:6004435; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fruedenberg-filter.com/xlsx)"; flow:established,to_server; http.uri; content:"/xlsx"; startswith; fast_pattern; http.host; content:"fruedenberg-filter.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004436; classtype:social-engineering; sid:6004436; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (387f628c.privacy-compliance-authenticated.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"387f628c.privacy-compliance-authenticated.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004437; classtype:social-engineering; sid:6004437; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (solucoesprahoje.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"solucoesprahoje.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004438; classtype:social-engineering; sid:6004438; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (diannaoya.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"diannaoya.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004439; classtype:social-engineering; sid:6004439; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja80.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja80.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004440; classtype:social-engineering; sid:6004440; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.coxon8.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.coxon8.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004441; classtype:social-engineering; sid:6004441; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.layanan-undian56.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.layanan-undian56.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004442; classtype:social-engineering; sid:6004442; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (businees-verify-badge-vip-12362345xcv.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"businees-verify-badge-vip-12362345xcv.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004443; classtype:social-engineering; sid:6004443; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365asia.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365asia.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004444; classtype:social-engineering; sid:6004444; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedrosoares1779822703712.2041778.meusitehostgator.com.br/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedrosoares1779822703712.2041778.meusitehostgator.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004445; classtype:social-engineering; sid:6004445; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (swissseborg-login.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"swissseborg-login.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004446; classtype:social-engineering; sid:6004446; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrf.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingrf.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004447; classtype:social-engineering; sid:6004447; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (businees-verify-badge-vip-123645cvw.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"businees-verify-badge-vip-123645cvw.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004448; classtype:social-engineering; sid:6004448; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (businees-verify-badge-vip-123634.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"businees-verify-badge-vip-123634.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004449; classtype:social-engineering; sid:6004449; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nav-trezorsuite.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nav-trezorsuite.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004450; classtype:social-engineering; sid:6004450; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortnites.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortnites.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004451; classtype:social-engineering; sid:6004451; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (siakad.stte.ac.id/?id_ID=OLXTOTO+BET+100)"; flow:established,to_server; http.uri; content:"/?id_ID=OLXTOTO+BET+100"; startswith; fast_pattern; http.host; content:"siakad.stte.ac.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004452; classtype:social-engineering; sid:6004452; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unrivaled-meringue-509c76.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"unrivaled-meringue-509c76.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004453; classtype:social-engineering; sid:6004453; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bestchange.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bestchange.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004454; classtype:social-engineering; sid:6004454; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unityone-creditunion-docusign.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"unityone-creditunion-docusign.edgeone.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004455; classtype:social-engineering; sid:6004455; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cr-bind-fenix.s3.us-east-1.amazonaws.com/XAc6geBVOhc?email=redacted@abuse.ionos.com)"; flow:established,to_server; http.uri; content:"/XAc6geBVOhc?email=redacted@abuse.ionos.com"; startswith; fast_pattern; http.host; content:"cr-bind-fenix.s3.us-east-1.amazonaws.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004456; classtype:social-engineering; sid:6004456; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.edgecoinnews.com/a-disruptive-technology-blockchain-will-make-dubai-happiest-city-on-earth/)"; flow:established,to_server; http.uri; content:"/a-disruptive-technology-blockchain-will-make-dubai-happiest-city-on-earth/"; startswith; fast_pattern; http.host; content:"www.edgecoinnews.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004457; classtype:social-engineering; sid:6004457; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ww1-dkb.webworkonline.co/webs.asp/DUVzTTavlOw/eLLPCe8pww7JaLVVL3PjC370)"; flow:established,to_server; http.uri; content:"/webs.asp/DUVzTTavlOw/eLLPCe8pww7JaLVVL3PjC370"; startswith; fast_pattern; http.host; content:"ww1-dkb.webworkonline.co"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004458; classtype:social-engineering; sid:6004458; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dkserver.sviluppo.host/a/)"; flow:established,to_server; http.uri; content:"/a/"; startswith; fast_pattern; http.host; content:"dkserver.sviluppo.host"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004459; classtype:social-engineering; sid:6004459; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tlktokshopa.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tlktokshopa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004460; classtype:social-engineering; sid:6004460; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpd-ouwib.com/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"dpd-ouwib.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004461; classtype:social-engineering; sid:6004461; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qrsu.io/n2J7D)"; flow:established,to_server; http.uri; content:"/n2J7D"; startswith; fast_pattern; http.host; content:"qrsu.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004462; classtype:social-engineering; sid:6004462; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jhrerth.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jhrerth.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004463; classtype:social-engineering; sid:6004463; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingty.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingty.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004464; classtype:social-engineering; sid:6004464; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedir-deliverys-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedir-deliverys-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004465; classtype:social-engineering; sid:6004465; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.customeraccessmembershipmovie.65-98-5-17.cpanel.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.customeraccessmembershipmovie.65-98-5-17.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004466; classtype:social-engineering; sid:6004466; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (affinityc2penterpris.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"affinityc2penterpris.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004467; classtype:social-engineering; sid:6004467; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee2449.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.shopee2449.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004468; classtype:social-engineering; sid:6004468; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrb.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingrb.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004469; classtype:social-engineering; sid:6004469; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (elizasilva13.github.io/elizasilva134.github.io/)"; flow:established,to_server; http.uri; content:"/elizasilva134.github.io/"; startswith; fast_pattern; http.host; content:"elizasilva13.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004470; classtype:social-engineering; sid:6004470; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrd.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingrd.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004471; classtype:social-engineering; sid:6004471; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (azwar-zsh.github.io/instagram-login)"; flow:established,to_server; http.uri; content:"/instagram-login"; startswith; fast_pattern; http.host; content:"azwar-zsh.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004472; classtype:social-engineering; sid:6004472; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-git-herman-cons-1985-responsive-web-changes-uniswap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-git-herman-cons-1985-responsive-web-changes-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004473; classtype:social-engineering; sid:6004473; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-pedido24h-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-pedido24h-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004474; classtype:social-engineering; sid:6004474; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chicagolandconstructionandremodeling.com/~r5g8ldveioxpnxqm/assets/images/images/12/lng/login.php)"; flow:established,to_server; http.uri; content:"/~r5g8ldveioxpnxqm/assets/images/images/12/lng/login.php"; startswith; fast_pattern; http.host; content:"chicagolandconstructionandremodeling.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004475; classtype:social-engineering; sid:6004475; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (carrefour-pass-espace.com/espace/)"; flow:established,to_server; http.uri; content:"/espace/"; startswith; fast_pattern; http.host; content:"carrefour-pass-espace.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004476; classtype:social-engineering; sid:6004476; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (118924kraken.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"118924kraken.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004477; classtype:social-engineering; sid:6004477; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrs.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingrs.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004478; classtype:social-engineering; sid:6004478; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-pedidos-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-pedidos-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004479; classtype:social-engineering; sid:6004479; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (plearnthaipalace.com/~r5g8ldveioxpnxqm/assets/images/images/12/lng/login.php)"; flow:established,to_server; http.uri; content:"/~r5g8ldveioxpnxqm/assets/images/images/12/lng/login.php"; startswith; fast_pattern; http.host; content:"plearnthaipalace.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004480; classtype:social-engineering; sid:6004480; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (giftcard.lat/activate-189522795/)"; flow:established,to_server; http.uri; content:"/activate-189522795/"; startswith; fast_pattern; http.host; content:"giftcard.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004481; classtype:social-engineering; sid:6004481; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecocashquickloans.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ecocashquickloans.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004482; classtype:social-engineering; sid:6004482; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whapptr3.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whapptr3.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004483; classtype:social-engineering; sid:6004483; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (copataaiaumenteja70.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"copataaiaumenteja70.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004484; classtype:social-engineering; sid:6004484; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrn.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingrn.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004485; classtype:social-engineering; sid:6004485; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeebig777.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopeebig777.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004486; classtype:social-engineering; sid:6004486; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtq.shop/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingtq.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004487; classtype:social-engineering; sid:6004487; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ferctharyzan.icu/?secure_connect=i2*9o*&_subid=28u3f78.96.1ekr4&_token=1vhvikq3ctv11g.1781937011.2.d9edf1e8ad7c5d68bb8f390cebc94092)"; flow:established,to_server; http.uri; content:"/?secure_connect=i2*9o*&_subid=28u3f78.96.1ekr4&_token=1vhvikq3ctv11g.1781937011.2.d9edf1e8ad7c5d68bb8f390cebc94092"; startswith; fast_pattern; http.host; content:"ferctharyzan.icu"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004488; classtype:social-engineering; sid:6004488; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail03-blocage-provisoire.abrdns.com/id/soilandpile.com/wp-admin/js/js/index.html)"; flow:established,to_server; http.uri; content:"/id/soilandpile.com/wp-admin/js/js/index.html"; startswith; fast_pattern; http.host; content:"mail03-blocage-provisoire.abrdns.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004489; classtype:social-engineering; sid:6004489; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (js4519.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"js4519.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004490; classtype:social-engineering; sid:6004490; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (minabus.cl/km/santa.html)"; flow:established,to_server; http.uri; content:"/km/santa.html"; startswith; fast_pattern; http.host; content:"minabus.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004491; classtype:social-engineering; sid:6004491; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bisque-takeaways-294067.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bisque-takeaways-294067.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004492; classtype:social-engineering; sid:6004492; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rscigroups.com/0602/access/zT7v84ofQi9lueNf0MtiVB0xYQYWPTlE7rOp)"; flow:established,to_server; http.uri; content:"/0602/access/zT7v84ofQi9lueNf0MtiVB0xYQYWPTlE7rOp"; startswith; fast_pattern; http.host; content:"rscigroups.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004493; classtype:social-engineering; sid:6004493; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vikramak-47.github.io/ECE-2-Amazon-Clone-Project-146/)"; flow:established,to_server; http.uri; content:"/ECE-2-Amazon-Clone-Project-146/"; startswith; fast_pattern; http.host; content:"vikramak-47.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004494; classtype:social-engineering; sid:6004494; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myqrcode.mobi/894a1a64)"; flow:established,to_server; http.uri; content:"/894a1a64"; startswith; fast_pattern; http.host; content:"myqrcode.mobi"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004495; classtype:social-engineering; sid:6004495; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.clubedopresente.club/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app.clubedopresente.club"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004496; classtype:social-engineering; sid:6004496; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.jotform.com/251692439172563)"; flow:established,to_server; http.uri; content:"/251692439172563"; startswith; fast_pattern; http.host; content:"app.jotform.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004497; classtype:social-engineering; sid:6004497; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trust-wallet-cloned-beige.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trust-wallet-cloned-beige.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004498; classtype:social-engineering; sid:6004498; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingyr.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingyr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004499; classtype:social-engineering; sid:6004499; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-r.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-r.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004500; classtype:social-engineering; sid:6004500; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vaibhavgarg78.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"vaibhavgarg78.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004501; classtype:social-engineering; sid:6004501; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (parvathi982005.github.io/login-page)"; flow:established,to_server; http.uri; content:"/login-page"; startswith; fast_pattern; http.host; content:"parvathi982005.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004502; classtype:social-engineering; sid:6004502; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whatsapp-easy-flow.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsapp-easy-flow.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004503; classtype:social-engineering; sid:6004503; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loginfacebook.site.je/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"loginfacebook.site.je"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004504; classtype:social-engineering; sid:6004504; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (z9p3t6k1r8w4.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"z9p3t6k1r8w4.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004505; classtype:social-engineering; sid:6004505; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.qee.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.qee.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004506; classtype:social-engineering; sid:6004506; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (greatmaninlifejeuscomefromkenny.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"greatmaninlifejeuscomefromkenny.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004507; classtype:social-engineering; sid:6004507; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accounts-findmy.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"accounts-findmy.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004508; classtype:social-engineering; sid:6004508; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee-tbk777.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee-tbk777.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004509; classtype:social-engineering; sid:6004509; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (id-mycloud.us/ICL264/)"; flow:established,to_server; http.uri; content:"/ICL264/"; startswith; fast_pattern; http.host; content:"id-mycloud.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004510; classtype:social-engineering; sid:6004510; rev:1; metadata: signature_severity Major, created_et 2026_06_22, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox.com.bi/games/77182599101794/4nn1s-Place?privateServerLinkCode=89585493089521937689667490122223)"; flow:established,to_server; http.uri; content:"/games/77182599101794/4nn1s-Place?privateServerLinkCode=89585493089521937689667490122223"; startswith; fast_pattern; http.host; content:"www.roblox.com.bi"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004511; classtype:social-engineering; sid:6004511; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comprehensive-embeds-989109.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comprehensive-embeds-989109.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004512; classtype:social-engineering; sid:6004512; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store.workshopscommunityratemods.com/sharedfiles/filesdetails/id=35225482503/)"; flow:established,to_server; http.uri; content:"/sharedfiles/filesdetails/id=35225482503/"; startswith; fast_pattern; http.host; content:"store.workshopscommunityratemods.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004513; classtype:social-engineering; sid:6004513; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marina-tours.de/ykokgefei/Aykokgefei)"; flow:established,to_server; http.uri; content:"/ykokgefei/Aykokgefei"; startswith; fast_pattern; http.host; content:"marina-tours.de"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004514; classtype:social-engineering; sid:6004514; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (favorite-guava-958784.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"favorite-guava-958784.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004515; classtype:social-engineering; sid:6004515; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onedrive1.vtcyntrax.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"onedrive1.vtcyntrax.org"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004516; classtype:social-engineering; sid:6004516; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netzeroupdateterms9.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netzeroupdateterms9.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004517; classtype:social-engineering; sid:6004517; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sttart-ledgr-en.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sttart-ledgr-en.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004518; classtype:social-engineering; sid:6004518; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lic-home-ledger.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lic-home-ledger.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004519; classtype:social-engineering; sid:6004519; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fbmetamdtj-fbcasefb313035.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fbmetamdtj-fbcasefb313035.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004520; classtype:social-engineering; sid:6004520; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (37u2p-0pajw-x9ra-2757si-pl2.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"37u2p-0pajw-x9ra-2757si-pl2.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004521; classtype:social-engineering; sid:6004521; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox.com.ml/users/433131624045/profile)"; flow:established,to_server; http.uri; content:"/users/433131624045/profile"; startswith; fast_pattern; http.host; content:"www.roblox.com.ml"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004522; classtype:social-engineering; sid:6004522; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (u.to/roblox-com-users-350357745-profile/oc_YIg)"; flow:established,to_server; http.uri; content:"/roblox-com-users-350357745-profile/oc_YIg"; startswith; fast_pattern; http.host; content:"u.to"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004523; classtype:social-engineering; sid:6004523; rev:1; metadata: signature_severity Major, created_et 2026_07_30;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip3.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip3.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004524; classtype:social-engineering; sid:6004524; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marketbuffalo.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"marketbuffalo.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004525; classtype:social-engineering; sid:6004525; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dubai-bookingcomdubai.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dubai-bookingcomdubai.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004526; classtype:social-engineering; sid:6004526; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (juno189-vip.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"juno189-vip.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004527; classtype:social-engineering; sid:6004527; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking-com-dubaii-flights-tickets.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booking-com-dubaii-flights-tickets.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004528; classtype:social-engineering; sid:6004528; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-jcb-safe-japanmikuilo.icu/pages/login/index.php)"; flow:established,to_server; http.uri; content:"/pages/login/index.php"; startswith; fast_pattern; http.host; content:"my-jcb-safe-japanmikuilo.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004529; classtype:social-engineering; sid:6004529; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking-ceom-dubaei-thinges-todeo.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booking-ceom-dubaei-thinges-todeo.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004530; classtype:social-engineering; sid:6004530; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dubai---booking-com.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dubai---booking-com.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004531; classtype:social-engineering; sid:6004531; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (geminulogin.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"geminulogin.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004532; classtype:social-engineering; sid:6004532; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shirim.co.il/marl/)"; flow:established,to_server; http.uri; content:"/marl/"; startswith; fast_pattern; http.host; content:"shirim.co.il"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004533; classtype:social-engineering; sid:6004533; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.greatlakestiles.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.greatlakestiles.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004534; classtype:social-engineering; sid:6004534; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docsonlineshare.shorepowersolution.net/docusign/d0cs/Windows/utility.php/download/index.php)"; flow:established,to_server; http.uri; content:"/docusign/d0cs/Windows/utility.php/download/index.php"; startswith; fast_pattern; http.host; content:"docsonlineshare.shorepowersolution.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004535; classtype:social-engineering; sid:6004535; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking-online-dubai.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booking-online-dubai.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004536; classtype:social-engineering; sid:6004536; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.trezorio-start.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.trezorio-start.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004537; classtype:social-engineering; sid:6004537; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booki-ng-com-dubai-p-acka-ges.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booki-ng-com-dubai-p-acka-ges.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004538; classtype:social-engineering; sid:6004538; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tyido.azzuk.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tyido.azzuk.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004539; classtype:social-engineering; sid:6004539; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gc-controles.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.gc-controles.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004540; classtype:social-engineering; sid:6004540; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.trezrrsuite.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.trezrrsuite.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004541; classtype:social-engineering; sid:6004541; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (premio.services/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"premio.services"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004542; classtype:social-engineering; sid:6004542; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-i---trustcapital-com---help.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso-i---trustcapital-com---help.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004543; classtype:social-engineering; sid:6004543; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip9.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip9.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004544; classtype:social-engineering; sid:6004544; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rpcdebugdapp.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rpcdebugdapp.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004545; classtype:social-engineering; sid:6004545; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chatgpt0005.eu.org/category/product)"; flow:established,to_server; http.uri; content:"/category/product"; startswith; fast_pattern; http.host; content:"chatgpt0005.eu.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004546; classtype:social-engineering; sid:6004546; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (msnservicesecuritym.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"msnservicesecuritym.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004547; classtype:social-engineering; sid:6004547; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-live-lebbger.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"help-live-lebbger.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004548; classtype:social-engineering; sid:6004548; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (resourceful-season-703701.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"resourceful-season-703701.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004549; classtype:social-engineering; sid:6004549; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.uktzhm.shop/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.uktzhm.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004550; classtype:social-engineering; sid:6004550; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kwaancs.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kwaancs.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004551; classtype:social-engineering; sid:6004551; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xecloud.duckdns.org/cgi-bin/home.ha)"; flow:established,to_server; http.uri; content:"/cgi-bin/home.ha"; startswith; fast_pattern; http.host; content:"www.xecloud.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004552; classtype:social-engineering; sid:6004552; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wtl.sell.agenuinesaate.com/r.php)"; flow:established,to_server; http.uri; content:"/r.php"; startswith; fast_pattern; http.host; content:"wtl.sell.agenuinesaate.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004553; classtype:social-engineering; sid:6004553; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (profil-facebook-saya.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"profil-facebook-saya.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004554; classtype:social-engineering; sid:6004554; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-exod-us.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en-exod-us.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004555; classtype:social-engineering; sid:6004555; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityorgltd.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinityorgltd.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004556; classtype:social-engineering; sid:6004556; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-harshdeep.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-harshdeep.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004557; classtype:social-engineering; sid:6004557; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinty.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinty.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004558; classtype:social-engineering; sid:6004558; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ladger-com-start.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ladger-com-start.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004559; classtype:social-engineering; sid:6004559; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.amkhni.shop/pay/)"; flow:established,to_server; http.uri; content:"/pay/"; startswith; fast_pattern; http.host; content:"t-mobile.amkhni.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004560; classtype:social-engineering; sid:6004560; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (524446913.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"524446913.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004561; classtype:social-engineering; sid:6004561; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeejkt678.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopeejkt678.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004562; classtype:social-engineering; sid:6004562; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-css.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"support-css.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004563; classtype:social-engineering; sid:6004563; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (infomark.lk/s/A.html)"; flow:established,to_server; http.uri; content:"/s/A.html"; startswith; fast_pattern; http.host; content:"infomark.lk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004564; classtype:social-engineering; sid:6004564; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lihi2.me/k5ia1)"; flow:established,to_server; http.uri; content:"/k5ia1"; startswith; fast_pattern; http.host; content:"lihi2.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004565; classtype:social-engineering; sid:6004565; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.click-hostopoint-ch-redirect1221531.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.click-hostopoint-ch-redirect1221531.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004566; classtype:social-engineering; sid:6004566; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (itrusstcapitallogen.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"itrusstcapitallogen.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004567; classtype:social-engineering; sid:6004567; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortflow.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortflow.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004568; classtype:social-engineering; sid:6004568; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.profil-facebook-saya.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.profil-facebook-saya.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004569; classtype:social-engineering; sid:6004569; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fnzona.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fnzona.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004570; classtype:social-engineering; sid:6004570; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shingishagafukushi.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shingishagafukushi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004571; classtype:social-engineering; sid:6004571; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr.galabet-yeni-guncel-resmigiris.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tr.galabet-yeni-guncel-resmigiris.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004572; classtype:social-engineering; sid:6004572; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.134tyesy.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.134tyesy.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004573; classtype:social-engineering; sid:6004573; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (happy-ice-990137.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"happy-ice-990137.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004574; classtype:social-engineering; sid:6004574; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiahghyf2d37szl2h3mjae4aqbymgz7wsfv7wyn4aawr5ivlzqptzi.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiahghyf2d37szl2h3mjae4aqbymgz7wsfv7wyn4aawr5ivlzqptzi.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004575; classtype:social-engineering; sid:6004575; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ndaxlogn.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ndaxlogn.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004576; classtype:social-engineering; sid:6004576; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.evvietnam.com/tuhbjgp/ok/t7yh.html)"; flow:established,to_server; http.uri; content:"/tuhbjgp/ok/t7yh.html"; startswith; fast_pattern; http.host; content:"www.evvietnam.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004577; classtype:social-engineering; sid:6004577; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cu684624.tw1.ru/departement/)"; flow:established,to_server; http.uri; content:"/departement/"; startswith; fast_pattern; http.host; content:"cu684624.tw1.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004578; classtype:social-engineering; sid:6004578; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabetgiris.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabetgiris.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004579; classtype:social-engineering; sid:6004579; rev:1; metadata: signature_severity Major, created_et 2026_06_13, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ocidente-virtua.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ocidente-virtua.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004580; classtype:social-engineering; sid:6004580; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (colegioluren.edu.pe/pa/pr/)"; flow:established,to_server; http.uri; content:"/pa/pr/"; startswith; fast_pattern; http.host; content:"colegioluren.edu.pe"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004581; classtype:social-engineering; sid:6004581; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfin1tysupp0rtmail.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfin1tysupp0rtmail.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004582; classtype:social-engineering; sid:6004582; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kriisshhnnaa.github.io/netflix-clone/demo-login.html)"; flow:established,to_server; http.uri; content:"/netflix-clone/demo-login.html"; startswith; fast_pattern; http.host; content:"kriisshhnnaa.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004583; classtype:social-engineering; sid:6004583; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.xpj33884.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.xpj33884.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004584; classtype:social-engineering; sid:6004584; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ogfizwptvwizrdfxe-opv8tnjbjirlmiem7rwdle.vercel.app/gnhjw4jyteje4trhseh5dg)"; flow:established,to_server; http.uri; content:"/gnhjw4jyteje4trhseh5dg"; startswith; fast_pattern; http.host; content:"ogfizwptvwizrdfxe-opv8tnjbjirlmiem7rwdle.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004585; classtype:social-engineering; sid:6004585; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (noisy-gray-lecne856.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"noisy-gray-lecne856.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004586; classtype:social-engineering; sid:6004586; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafybeiaws4pqenzmeqsuoufsgcyhgtxc5azas2dsnh6i25xpe75b3rybti.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafybeiaws4pqenzmeqsuoufsgcyhgtxc5azas2dsnh6i25xpe75b3rybti.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004587; classtype:social-engineering; sid:6004587; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (costmerznpaylteridnx.sufisme.web.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"costmerznpaylteridnx.sufisme.web.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004588; classtype:social-engineering; sid:6004588; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (68-210-200-182.cprapid.com/de/kasse.php)"; flow:established,to_server; http.uri; content:"/de/kasse.php"; startswith; fast_pattern; http.host; content:"68-210-200-182.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004589; classtype:social-engineering; sid:6004589; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cityinnparis.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cityinnparis.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004590; classtype:social-engineering; sid:6004590; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinty.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinty.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004591; classtype:social-engineering; sid:6004591; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookaccountrecovery.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebookaccountrecovery.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004592; classtype:social-engineering; sid:6004592; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (taughdia.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"taughdia.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004593; classtype:social-engineering; sid:6004593; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pawsandfurs.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pawsandfurs.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004594; classtype:social-engineering; sid:6004594; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (l.gotourl.es/l/bab7d40aeeb5279424cc07b9970fded782d7474b?u=14125938)"; flow:established,to_server; http.uri; content:"/l/bab7d40aeeb5279424cc07b9970fded782d7474b?u=14125938"; startswith; fast_pattern; http.host; content:"l.gotourl.es"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004595; classtype:social-engineering; sid:6004595; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maira-castro.github.io/netflix/)"; flow:established,to_server; http.uri; content:"/netflix/"; startswith; fast_pattern; http.host; content:"maira-castro.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004596; classtype:social-engineering; sid:6004596; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedidosexpress-zedelivery.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedidosexpress-zedelivery.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004597; classtype:social-engineering; sid:6004597; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail-earthlink-net-newmessage.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webmail-earthlink-net-newmessage.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004598; classtype:social-engineering; sid:6004598; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityaccounthome.20-228-132-238.cpanel.site/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"xfinityaccounthome.20-228-132-238.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004599; classtype:social-engineering; sid:6004599; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fishing-app.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fishing-app.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004600; classtype:social-engineering; sid:6004600; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (divyanshu07112001.github.io/Apple_Clone/)"; flow:established,to_server; http.uri; content:"/Apple_Clone/"; startswith; fast_pattern; http.host; content:"divyanshu07112001.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004601; classtype:social-engineering; sid:6004601; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lastdropvillage.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lastdropvillage.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004602; classtype:social-engineering; sid:6004602; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arhumnasir.github.io/smit-assignment-Amazon-Clone)"; flow:established,to_server; http.uri; content:"/smit-assignment-Amazon-Clone"; startswith; fast_pattern; http.host; content:"arhumnasir.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004603; classtype:social-engineering; sid:6004603; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (debugmann.github.io/diskord)"; flow:established,to_server; http.uri; content:"/diskord"; startswith; fast_pattern; http.host; content:"debugmann.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004604; classtype:social-engineering; sid:6004604; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhavanamuneppa.github.io/amazon-cone/)"; flow:established,to_server; http.uri; content:"/amazon-cone/"; startswith; fast_pattern; http.host; content:"bhavanamuneppa.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004605; classtype:social-engineering; sid:6004605; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (poetic-bubblegum-e26dd8.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"poetic-bubblegum-e26dd8.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004606; classtype:social-engineering; sid:6004606; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gamane-login.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gamane-login.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004607; classtype:social-engineering; sid:6004607; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebookaccountrecovery.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebookaccountrecovery.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004608; classtype:social-engineering; sid:6004608; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (garbagebagpromotion.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"garbagebagpromotion.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004609; classtype:social-engineering; sid:6004609; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (use-live-docs.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"use-live-docs.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004610; classtype:social-engineering; sid:6004610; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (97b52e9e-b4e4-5e94-b2ab-docviewer3.reynoldsjace5.workers.dev/as6htt5w0ik/hotydhcvk)"; flow:established,to_server; http.uri; content:"/as6htt5w0ik/hotydhcvk"; startswith; fast_pattern; http.host; content:"97b52e9e-b4e4-5e94-b2ab-docviewer3.reynoldsjace5.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004611; classtype:social-engineering; sid:6004611; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (byrlek3riv.zoi9.pro/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"byrlek3riv.zoi9.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004612; classtype:social-engineering; sid:6004612; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (showsix.digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"showsix.digital"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004613; classtype:social-engineering; sid:6004613; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sparkasse-bayreuth.de/de/home/login-online-banking.html)"; flow:established,to_server; http.uri; content:"/de/home/login-online-banking.html"; startswith; fast_pattern; http.host; content:"www.sparkasse-bayreuth.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004614; classtype:social-engineering; sid:6004614; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deeparastogi07.github.io/Spotify-Clone/)"; flow:established,to_server; http.uri; content:"/Spotify-Clone/"; startswith; fast_pattern; http.host; content:"deeparastogi07.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004615; classtype:social-engineering; sid:6004615; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip8.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip8.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004616; classtype:social-engineering; sid:6004616; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jvr-nvzwq.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jvr-nvzwq.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004617; classtype:social-engineering; sid:6004617; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (logloop721-wgna.blogspot.com/2026/06/zerosignal-lost-connection.html)"; flow:established,to_server; http.uri; content:"/2026/06/zerosignal-lost-connection.html"; startswith; fast_pattern; http.host; content:"logloop721-wgna.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004618; classtype:social-engineering; sid:6004618; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anwarkhan5.github.io/Project/)"; flow:established,to_server; http.uri; content:"/Project/"; startswith; fast_pattern; http.host; content:"anwarkhan5.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004619; classtype:social-engineering; sid:6004619; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tdjreiqwwi.zoi9.pro/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"tdjreiqwwi.zoi9.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004620; classtype:social-engineering; sid:6004620; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ruddycruzc.github.io/clon-spotify/)"; flow:established,to_server; http.uri; content:"/clon-spotify/"; startswith; fast_pattern; http.host; content:"ruddycruzc.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004621; classtype:social-engineering; sid:6004621; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee7890.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee7890.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004622; classtype:social-engineering; sid:6004622; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (renmaintenance.dyezz.name/cgi-bin/index.ha/)"; flow:established,to_server; http.uri; content:"/cgi-bin/index.ha/"; startswith; fast_pattern; http.host; content:"renmaintenance.dyezz.name"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004623; classtype:social-engineering; sid:6004623; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (globalterdaftar.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"globalterdaftar.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004624; classtype:social-engineering; sid:6004624; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tioshxouy.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tioshxouy.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004625; classtype:social-engineering; sid:6004625; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klelnanzeigen-deutsch.id90117.info/getpaymentm/180308201/m9)"; flow:established,to_server; http.uri; content:"/getpaymentm/180308201/m9"; startswith; fast_pattern; http.host; content:"klelnanzeigen-deutsch.id90117.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004626; classtype:social-engineering; sid:6004626; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1cef02.site.tb-hosting.com/wp/wp-content/plugins/MADE/files/top.html)"; flow:established,to_server; http.uri; content:"/wp/wp-content/plugins/MADE/files/top.html"; startswith; fast_pattern; http.host; content:"1cef02.site.tb-hosting.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004627; classtype:social-engineering; sid:6004627; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kucoinlogginn.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kucoinlogginn.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004628; classtype:social-engineering; sid:6004628; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucoinlogginn.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kucoinlogginn.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004629; classtype:social-engineering; sid:6004629; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (profycom.co.rs/feisbuck-456756454645)"; flow:established,to_server; http.uri; content:"/feisbuck-456756454645"; startswith; fast_pattern; http.host; content:"profycom.co.rs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004630; classtype:social-engineering; sid:6004630; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hadiahshopee333.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hadiahshopee333.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004631; classtype:social-engineering; sid:6004631; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee9499.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee9499.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004632; classtype:social-engineering; sid:6004632; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abbas.mohammadzadeh-abbas65.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"abbas.mohammadzadeh-abbas65.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004633; classtype:social-engineering; sid:6004633; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (silent-voice-8321.eb791hq3.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"silent-voice-8321.eb791hq3.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004634; classtype:social-engineering; sid:6004634; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (betk365k16.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"betk365k16.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004635; classtype:social-engineering; sid:6004635; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fdjghfjdks-dp7840u77wuw.edgeone.dev/livebird.html)"; flow:established,to_server; http.uri; content:"/livebird.html"; startswith; fast_pattern; http.host; content:"fdjghfjdks-dp7840u77wuw.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004636; classtype:social-engineering; sid:6004636; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.educationpolicy.eu.keelingsobotka.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.educationpolicy.eu.keelingsobotka.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004637; classtype:social-engineering; sid:6004637; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mapsupport-iphones.help/pPlr)"; flow:established,to_server; http.uri; content:"/pPlr"; startswith; fast_pattern; http.host; content:"mapsupport-iphones.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004638; classtype:social-engineering; sid:6004638; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (parasag1310.github.io/spotify-clone/)"; flow:established,to_server; http.uri; content:"/spotify-clone/"; startswith; fast_pattern; http.host; content:"parasag1310.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004639; classtype:social-engineering; sid:6004639; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blog-your1425.blogspot.com/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"blog-your1425.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004640; classtype:social-engineering; sid:6004640; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smtp.romtelecom.net/?horde=ms5vufpvj5q02q1n45rot11mp7)"; flow:established,to_server; http.uri; content:"/?horde=ms5vufpvj5q02q1n45rot11mp7"; startswith; fast_pattern; http.host; content:"smtp.romtelecom.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004641; classtype:social-engineering; sid:6004641; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee7389.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee7389.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004642; classtype:social-engineering; sid:6004642; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ananyab-262005.github.io/Amazon_Homepage_Clone_Frontend/)"; flow:established,to_server; http.uri; content:"/Amazon_Homepage_Clone_Frontend/"; startswith; fast_pattern; http.host; content:"ananyab-262005.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004643; classtype:social-engineering; sid:6004643; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e43hciingepfdx74bsmy3z537tkumjvkzk2lpp6ixvsblwdgnsda.arweave.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e43hciingepfdx74bsmy3z537tkumjvkzk2lpp6ixvsblwdgnsda.arweave.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004644; classtype:social-engineering; sid:6004644; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moondoteth.github.io/wemail-login-xf0auth/)"; flow:established,to_server; http.uri; content:"/wemail-login-xf0auth/"; startswith; fast_pattern; http.host; content:"moondoteth.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004645; classtype:social-engineering; sid:6004645; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adb-secure.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"adb-secure.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004646; classtype:social-engineering; sid:6004646; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yzab1c.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yzab1c.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004647; classtype:social-engineering; sid:6004647; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tetarwalsachinkumar.github.io/amazonclone/)"; flow:established,to_server; http.uri; content:"/amazonclone/"; startswith; fast_pattern; http.host; content:"tetarwalsachinkumar.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004648; classtype:social-engineering; sid:6004648; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerserviceqe.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerserviceqe.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004649; classtype:social-engineering; sid:6004649; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortab.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortab.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004650; classtype:social-engineering; sid:6004650; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vigneshgandla11.github.io/Clone-UI/)"; flow:established,to_server; http.uri; content:"/Clone-UI/"; startswith; fast_pattern; http.host; content:"vigneshgandla11.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004651; classtype:social-engineering; sid:6004651; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f.digitalmailpath.com/igit/4/5jlrppuFyeurq27hxrFn9dFbpcrzerFbsyFdslF4hFxFq)"; flow:established,to_server; http.uri; content:"/igit/4/5jlrppuFyeurq27hxrFn9dFbpcrzerFbsyFdslF4hFxFq"; startswith; fast_pattern; http.host; content:"f.digitalmailpath.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004652; classtype:social-engineering; sid:6004652; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (learn-start--trezur.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"learn-start--trezur.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004653; classtype:social-engineering; sid:6004653; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fortsun.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fortsun.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004654; classtype:social-engineering; sid:6004654; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hadiahshopee333.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hadiahshopee333.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004655; classtype:social-engineering; sid:6004655; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zedeliverys-24h.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zedeliverys-24h.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004656; classtype:social-engineering; sid:6004656; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.57365h.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.57365h.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004657; classtype:social-engineering; sid:6004657; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee7890.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee7890.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004658; classtype:social-engineering; sid:6004658; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login-metsahelp.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login-metsahelp.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004659; classtype:social-engineering; sid:6004659; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (axfuehpruurx.objectstorage.ap-kulai-2.oci.customer-oci.com/n/axfuehpruurx/b/voicemail-mic12062026vm73078voice5625879mail2840protected036734mic/o/core.html)"; flow:established,to_server; http.uri; content:"/n/axfuehpruurx/b/voicemail-mic12062026vm73078voice5625879mail2840protected036734mic/o/core.html"; startswith; fast_pattern; http.host; content:"axfuehpruurx.objectstorage.ap-kulai-2.oci.customer-oci.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004660; classtype:social-engineering; sid:6004660; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucoeneleuiogin.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kucoeneleuiogin.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004661; classtype:social-engineering; sid:6004661; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bet4069.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bet4069.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004662; classtype:social-engineering; sid:6004662; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (offf-1-c-365-seg--assesortcn365.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"offf-1-c-365-seg--assesortcn365.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004663; classtype:social-engineering; sid:6004663; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booking-com-dubai-desert--safarii.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"booking-com-dubai-desert--safarii.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004664; classtype:social-engineering; sid:6004664; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.230yabo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.230yabo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004665; classtype:social-engineering; sid:6004665; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamask-restoreserver-page.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metamask-restoreserver-page.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004666; classtype:social-engineering; sid:6004666; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brainy-core-176300.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"brainy-core-176300.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004667; classtype:social-engineering; sid:6004667; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ewabsturz.com/Update-new/index.php)"; flow:established,to_server; http.uri; content:"/Update-new/index.php"; startswith; fast_pattern; http.host; content:"ewabsturz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004668; classtype:social-engineering; sid:6004668; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (40nqr.zoi9.pro/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"40nqr.zoi9.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004669; classtype:social-engineering; sid:6004669; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon500.dealsclick123.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon500.dealsclick123.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004670; classtype:social-engineering; sid:6004670; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sign-in-to-xfinity-876.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.sign-in-to-xfinity-876.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004671; classtype:social-engineering; sid:6004671; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (plasmaringa.com/archive/outh.html)"; flow:established,to_server; http.uri; content:"/archive/outh.html"; startswith; fast_pattern; http.host; content:"plasmaringa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004672; classtype:social-engineering; sid:6004672; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amz43.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amz43.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004673; classtype:social-engineering; sid:6004673; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (padisahbettggiris.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"padisahbettggiris.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004674; classtype:social-engineering; sid:6004674; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bookings-com-dubai-flights-tickets.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bookings-com-dubai-flights-tickets.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004675; classtype:social-engineering; sid:6004675; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (indoopaylterxz.hurokei.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"indoopaylterxz.hurokei.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004676; classtype:social-engineering; sid:6004676; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kucoin_loiigin.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kucoin_loiigin.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004677; classtype:social-engineering; sid:6004677; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pemenangshopee555.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.pemenangshopee555.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004678; classtype:social-engineering; sid:6004678; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roopansh123.github.io/apple-clone/)"; flow:established,to_server; http.uri; content:"/apple-clone/"; startswith; fast_pattern; http.host; content:"roopansh123.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004679; classtype:social-engineering; sid:6004679; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamzklogoo.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metamzklogoo.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004680; classtype:social-engineering; sid:6004680; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pravodopomoga24.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pravodopomoga24.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004681; classtype:social-engineering; sid:6004681; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeeid4888.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopeeid4888.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004682; classtype:social-engineering; sid:6004682; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.chekad.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.chekad.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004683; classtype:social-engineering; sid:6004683; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nfxclonee.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nfxclonee.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004684; classtype:social-engineering; sid:6004684; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-netlfix12.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-netlfix12.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004685; classtype:social-engineering; sid:6004685; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gurl.pro/wwwrobloxcom-users-774278901-profile/)"; flow:established,to_server; http.uri; content:"/wwwrobloxcom-users-774278901-profile/"; startswith; fast_pattern; http.host; content:"www.gurl.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004686; classtype:social-engineering; sid:6004686; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crsia1db1x.zoi9.pro/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"crsia1db1x.zoi9.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004687; classtype:social-engineering; sid:6004687; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (empresarialcaixa06-06.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"empresarialcaixa06-06.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004688; classtype:social-engineering; sid:6004688; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pusatshopee99.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pusatshopee99.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004689; classtype:social-engineering; sid:6004689; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (138wq.zoi9.pro/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"138wq.zoi9.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004690; classtype:social-engineering; sid:6004690; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify-badge-vip125.pages.dev/privacy-centers)"; flow:established,to_server; http.uri; content:"/privacy-centers"; startswith; fast_pattern; http.host; content:"verify-badge-vip125.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004691; classtype:social-engineering; sid:6004691; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (friendly-indigo-f946zusu.edgeone.app/?eta=veren8@86d9ac664f32b3117fef6b80c85afdd31edd.net)"; flow:established,to_server; http.uri; content:"/?eta=veren8@86d9ac664f32b3117fef6b80c85afdd31edd.net"; startswith; fast_pattern; http.host; content:"friendly-indigo-f946zusu.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004692; classtype:social-engineering; sid:6004692; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-l2pxkyyme.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-l2pxkyyme.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004693; classtype:social-engineering; sid:6004693; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lw-att-main.hopto.org/cgi-bin/home.ha/)"; flow:established,to_server; http.uri; content:"/cgi-bin/home.ha/"; startswith; fast_pattern; http.host; content:"lw-att-main.hopto.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004694; classtype:social-engineering; sid:6004694; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spotify-songs1.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spotify-songs1.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004695; classtype:social-engineering; sid:6004695; rev:1; metadata: signature_severity Major, created_et 2026_06_14, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.spf-amende.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.spf-amende.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004696; classtype:social-engineering; sid:6004696; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-jade-ten.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-jade-ten.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004697; classtype:social-engineering; sid:6004697; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (utensil-steep-dk.s3.ap-southeast-1.amazonaws.com/VSPt3S5ZdJKeeK?email=redacted@abuse.ionos.com)"; flow:established,to_server; http.uri; content:"/VSPt3S5ZdJKeeK?email=redacted@abuse.ionos.com"; startswith; fast_pattern; http.host; content:"utensil-steep-dk.s3.ap-southeast-1.amazonaws.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004698; classtype:social-engineering; sid:6004698; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spf-amende.com/main)"; flow:established,to_server; http.uri; content:"/main"; startswith; fast_pattern; http.host; content:"spf-amende.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004699; classtype:social-engineering; sid:6004699; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mcaavoli.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mcaavoli.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004700; classtype:social-engineering; sid:6004700; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cancelrtucmprahdlins.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cancelrtucmprahdlins.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004701; classtype:social-engineering; sid:6004701; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creditagricole-reactivation.bolt.host/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"creditagricole-reactivation.bolt.host"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004702; classtype:social-engineering; sid:6004702; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (solicitudesbhdrdprincipal.liveblog365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"solicitudesbhdrdprincipal.liveblog365.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004703; classtype:social-engineering; sid:6004703; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netempresas.lojaefata.com.br/pj)"; flow:established,to_server; http.uri; content:"/pj"; startswith; fast_pattern; http.host; content:"netempresas.lojaefata.com.br"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004704; classtype:social-engineering; sid:6004704; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bacsigad.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bacsigad.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004705; classtype:social-engineering; sid:6004705; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meusbonus.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meusbonus.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004706; classtype:social-engineering; sid:6004706; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegro.smart93281277.bond/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegro.smart93281277.bond"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004707; classtype:social-engineering; sid:6004707; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amuse-73035.bechshistory.com/challenge.php?t=MTc4MTU3Mjk5MHwxNzgxNTczMjkwfDBlZmQ1MzZjMjA0MGJhMzJ8NHxmZDA5ZDRlOTk0N2VjYmM4NjIxNjM1YzM2NjJiYjMyMHw2ODk1MGEyNDk0Y2I4YzVkOTZkNThkNDIyNmI4MmQ5OGRhOWFlYjVhOTlhNjU1YmI2YTQyZGFkNjQyMjVlODRj&r=Lz91MjkxND1hVzVtYjNKdFlXTnFaVUJ3YTI5aWNDNXdiQT09)"; flow:established,to_server; http.uri; content:"/challenge.php?t=MTc4MTU3Mjk5MHwxNzgxNTczMjkwfDBlZmQ1MzZjMjA0MGJhMzJ8NHxmZDA5ZDRlOTk0N2VjYmM4NjIxNjM1YzM2NjJiYjMyMHw2ODk1MGEyNDk0Y2I4YzVkOTZkNThkNDIyNmI4MmQ5OGRhOWFlYjVhOTlhNjU1YmI2YTQyZGFkNjQyMjVlODRj&r=Lz91MjkxND1hVzVtYjNKdFlXTnFaVUJ3YTI5aWNDNXdiQT09"; startswith; fast_pattern; http.host; content:"amuse-73035.bechshistory.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004708; classtype:social-engineering; sid:6004708; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ubiquitous-gingersnap-809853.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ubiquitous-gingersnap-809853.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004709; classtype:social-engineering; sid:6004709; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezor-login-x-us.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezor-login-x-us.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004710; classtype:social-engineering; sid:6004710; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (azirksa.com/Prestige_Law/)"; flow:established,to_server; http.uri; content:"/Prestige_Law/"; startswith; fast_pattern; http.host; content:"azirksa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004711; classtype:social-engineering; sid:6004711; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (consulta-prestamos-leon.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"consulta-prestamos-leon.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004712; classtype:social-engineering; sid:6004712; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prestamoalinstantebhddo.liveblog365.com/index2.html)"; flow:established,to_server; http.uri; content:"/index2.html"; startswith; fast_pattern; http.host; content:"prestamoalinstantebhddo.liveblog365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004713; classtype:social-engineering; sid:6004713; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (validar-liver365.webcindario.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"validar-liver365.webcindario.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004714; classtype:social-engineering; sid:6004714; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedagiofflowbrasil.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedagiofflowbrasil.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004715; classtype:social-engineering; sid:6004715; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bnparibas-reactivation.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bnparibas-reactivation.bolt.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004716; classtype:social-engineering; sid:6004716; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robinhiodlogmx.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"robinhiodlogmx.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004717; classtype:social-engineering; sid:6004717; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f.digital-pathway.com/igit/4/6ehopj7Nk3nay05fvpNv9bNv4i8miN9qwNxqjN2fNvNo)"; flow:established,to_server; http.uri; content:"/igit/4/6ehopj7Nk3nay05fvpNv9bNv4i8miN9qwNxqjN2fNvNo"; startswith; fast_pattern; http.host; content:"f.digital-pathway.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004718; classtype:social-engineering; sid:6004718; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ac156ollnno01010101010101010101.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ac156ollnno01010101010101010101.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004719; classtype:social-engineering; sid:6004719; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeetbk855.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopeetbk855.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004720; classtype:social-engineering; sid:6004720; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mayurkoli6311-ui.github.io/Amazon_clone)"; flow:established,to_server; http.uri; content:"/Amazon_clone"; startswith; fast_pattern; http.host; content:"mayurkoli6311-ui.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004721; classtype:social-engineering; sid:6004721; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nokaieoasptokies.com/Last/ch)"; flow:established,to_server; http.uri; content:"/Last/ch"; startswith; fast_pattern; http.host; content:"nokaieoasptokies.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004722; classtype:social-engineering; sid:6004722; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.threswk.click/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&dsh=S640721563%3A1781562791646131&followup=https%3A%2F%2Faccounts.google.com%2F&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AcDsRvx0zuqaXzuunDzIxiI_253rfe1PrHVRjqYA5L4VoZ3Bis9ZVfEmWTI8EBOM5iaj3AhPGmU4)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?continue=https%3A%2F%2Faccounts.google.com%2F&dsh=S640721563%3A1781562791646131&followup=https%3A%2F%2Faccounts.google.com%2F&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin&ifkv=AcDsRvx0zuqaXzuunDzIxiI_253rfe1PrHVRjqYA5L4VoZ3Bis9ZVfEmWTI8EBOM5iaj3AhPGmU4"; startswith; fast_pattern; http.host; content:"www.threswk.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004723; classtype:social-engineering; sid:6004723; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6a305c5c175de3338b2a1ff0--gleaming-pastelito-3dbfc9.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6a305c5c175de3338b2a1ff0--gleaming-pastelito-3dbfc9.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004724; classtype:social-engineering; sid:6004724; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezrrsuite.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezrrsuite.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004725; classtype:social-engineering; sid:6004725; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gacancersupport.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gacancersupport.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004726; classtype:social-engineering; sid:6004726; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freeflowrodovia.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"freeflowrodovia.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004727; classtype:social-engineering; sid:6004727; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lkoer7h8tg6h8j-dpjxu5uljddr.edgeone.dev/english.html)"; flow:established,to_server; http.uri; content:"/english.html"; startswith; fast_pattern; http.host; content:"lkoer7h8tg6h8j-dpjxu5uljddr.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004728; classtype:social-engineering; sid:6004728; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezor-suite-apps.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezor-suite-apps.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004729; classtype:social-engineering; sid:6004729; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7tcc4p.cn/mmixosct)"; flow:established,to_server; http.uri; content:"/mmixosct"; startswith; fast_pattern; http.host; content:"7tcc4p.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004730; classtype:social-engineering; sid:6004730; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (81zppv.cn/mmixosct/)"; flow:established,to_server; http.uri; content:"/mmixosct/"; startswith; fast_pattern; http.host; content:"81zppv.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004731; classtype:social-engineering; sid:6004731; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedagiofreeflow-online.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedagiofreeflow-online.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004732; classtype:social-engineering; sid:6004732; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vasusinghal0607.github.io/AmazonClone)"; flow:established,to_server; http.uri; content:"/AmazonClone"; startswith; fast_pattern; http.host; content:"vasusinghal0607.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004733; classtype:social-engineering; sid:6004733; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrr.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingrr.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004734; classtype:social-engineering; sid:6004734; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m2kxenskpr33cczh422ztadivhtnpi5rm5yd3s4enftckstngfya.legacy.datasprite-cdn.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m2kxenskpr33cczh422ztadivhtnpi5rm5yd3s4enftckstngfya.legacy.datasprite-cdn.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004735; classtype:social-engineering; sid:6004735; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appleb488b246b21446ed81078ceffa057666.3bozft.cn/Apple9f66ebcbca32436aa9bf433ac42d0365)"; flow:established,to_server; http.uri; content:"/Apple9f66ebcbca32436aa9bf433ac42d0365"; startswith; fast_pattern; http.host; content:"appleb488b246b21446ed81078ceffa057666.3bozft.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004736; classtype:social-engineering; sid:6004736; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tryugwyigiuqyugfq-tyieghoirurgqh.pages.dev/?e=aran@7998e30432222a0842c9980c5cd10770824a.com)"; flow:established,to_server; http.uri; content:"/?e=aran@7998e30432222a0842c9980c5cd10770824a.com"; startswith; fast_pattern; http.host; content:"tryugwyigiuqyugfq-tyieghoirurgqh.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004737; classtype:social-engineering; sid:6004737; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.askmeforsure.info/ad/i/)"; flow:established,to_server; http.uri; content:"/ad/i/"; startswith; fast_pattern; http.host; content:"www.askmeforsure.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004738; classtype:social-engineering; sid:6004738; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rm9977hj.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rm9977hj.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004739; classtype:social-engineering; sid:6004739; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xt42qzg4cfw3nlbrlpiuuudgvhtwkvsjqmannuqhhkysjehjjy4q.legacy.datasprite-cdn.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xt42qzg4cfw3nlbrlpiuuudgvhtwkvsjqmannuqhhkysjehjjy4q.legacy.datasprite-cdn.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004740; classtype:social-engineering; sid:6004740; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sincronizar-itau.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sincronizar-itau.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004741; classtype:social-engineering; sid:6004741; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tkibscvr.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tkibscvr.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004742; classtype:social-engineering; sid:6004742; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (movieflix-netflx-clone.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"movieflix-netflx-clone.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004743; classtype:social-engineering; sid:6004743; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.api-wsource1-epc78300000000000152669tfn-homesolution.educacaosobredrogas.com.br/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.api-wsource1-epc78300000000000152669tfn-homesolution.educacaosobredrogas.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004744; classtype:social-engineering; sid:6004744; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-portal-kuoin.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info-portal-kuoin.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004745; classtype:social-engineering; sid:6004745; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (layanan-dana-bantuan.github.io/dana-pemulihan/)"; flow:established,to_server; http.uri; content:"/dana-pemulihan/"; startswith; fast_pattern; http.host; content:"layanan-dana-bantuan.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004746; classtype:social-engineering; sid:6004746; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-io--trezore-login.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en-io--trezore-login.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004747; classtype:social-engineering; sid:6004747; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klausfhepp.com/ino)"; flow:established,to_server; http.uri; content:"/ino"; startswith; fast_pattern; http.host; content:"klausfhepp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004748; classtype:social-engineering; sid:6004748; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bnp-cledigitale.bolt.host/index.html/)"; flow:established,to_server; http.uri; content:"/index.html/"; startswith; fast_pattern; http.host; content:"bnp-cledigitale.bolt.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004749; classtype:social-engineering; sid:6004749; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrq.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingrq.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004750; classtype:social-engineering; sid:6004750; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (student-yuvraj2008.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"student-yuvraj2008.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004751; classtype:social-engineering; sid:6004751; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pauloherriqueggg259-bot.github.io/gov.c/)"; flow:established,to_server; http.uri; content:"/gov.c/"; startswith; fast_pattern; http.host; content:"pauloherriqueggg259-bot.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004752; classtype:social-engineering; sid:6004752; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gestaodeprojetos.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"gestaodeprojetos.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004753; classtype:social-engineering; sid:6004753; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (797jyr.cn/mmixosct)"; flow:established,to_server; http.uri; content:"/mmixosct"; startswith; fast_pattern; http.host; content:"797jyr.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004754; classtype:social-engineering; sid:6004754; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dg.mntbell.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dg.mntbell.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004755; classtype:social-engineering; sid:6004755; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (twpkfbbcwuqrlttc.deuthme.info/leds/)"; flow:established,to_server; http.uri; content:"/leds/"; startswith; fast_pattern; http.host; content:"twpkfbbcwuqrlttc.deuthme.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004756; classtype:social-engineering; sid:6004756; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freeflow-rodovia.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"freeflow-rodovia.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004757; classtype:social-engineering; sid:6004757; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ucpasportstationparis.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ucpasportstationparis.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004758; classtype:social-engineering; sid:6004758; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (io-trezer-en-us.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"io-trezer-en-us.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004759; classtype:social-engineering; sid:6004759; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedagiofflow.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedagiofflow.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004760; classtype:social-engineering; sid:6004760; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (quick-cloud-444.allcompredirectportalshare.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"quick-cloud-444.allcompredirectportalshare.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004761; classtype:social-engineering; sid:6004761; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bloki-logn.zapier.app/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"bloki-logn.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004762; classtype:social-engineering; sid:6004762; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mh89922.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mh89922.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004763; classtype:social-engineering; sid:6004763; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gvaridioll.s3.eu-north-1.amazonaws.com/tmv.html)"; flow:established,to_server; http.uri; content:"/tmv.html"; startswith; fast_pattern; http.host; content:"gvaridioll.s3.eu-north-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004764; classtype:social-engineering; sid:6004764; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (desktop-enn.framer.media/en/)"; flow:established,to_server; http.uri; content:"/en/"; startswith; fast_pattern; http.host; content:"desktop-enn.framer.media"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004765; classtype:social-engineering; sid:6004765; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.it-admincenter.com/5d5666/65f70345-c9d5-4fce-9b5e-b21dba23e077)"; flow:established,to_server; http.uri; content:"/5d5666/65f70345-c9d5-4fce-9b5e-b21dba23e077"; startswith; fast_pattern; http.host; content:"login.it-admincenter.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004766; classtype:social-engineering; sid:6004766; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bas.a9177395466.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bas.a9177395466.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004767; classtype:social-engineering; sid:6004767; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sbc-verifier-sign-in-84bfcd.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sbc-verifier-sign-in-84bfcd.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004768; classtype:social-engineering; sid:6004768; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shinzo23.github.io/Amazon-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-Clone"; startswith; fast_pattern; http.host; content:"shinzo23.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004769; classtype:social-engineering; sid:6004769; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (office-fredo.webhop.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"office-fredo.webhop.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004770; classtype:social-engineering; sid:6004770; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (azizullah-fedev.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"azizullah-fedev.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004771; classtype:social-engineering; sid:6004771; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (destek-edev1et.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"destek-edev1et.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004772; classtype:social-engineering; sid:6004772; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gleaming-pastelito-3dbfc9.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gleaming-pastelito-3dbfc9.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004773; classtype:social-engineering; sid:6004773; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kavitachaudhary16.github.io/Amazon-Clone-/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone-/"; startswith; fast_pattern; http.host; content:"kavitachaudhary16.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004774; classtype:social-engineering; sid:6004774; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrt.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingrt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004775; classtype:social-engineering; sid:6004775; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6a2d92a9d242d7b5e453154c--sweet-tarsier-be1a2a.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6a2d92a9d242d7b5e453154c--sweet-tarsier-be1a2a.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004776; classtype:social-engineering; sid:6004776; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sameerniku.github.io/Amazon-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-Clone"; startswith; fast_pattern; http.host; content:"sameerniku.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004777; classtype:social-engineering; sid:6004777; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inhouseplumbingcompany-sewer.pages.dev/dp/B0C2RXN77R?ref=MarsFS_AUCC_es/)"; flow:established,to_server; http.uri; content:"/dp/B0C2RXN77R?ref=MarsFS_AUCC_es/"; startswith; fast_pattern; http.host; content:"inhouseplumbingcompany-sewer.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004778; classtype:social-engineering; sid:6004778; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-page-creator--wolfwise.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-page-creator--wolfwise.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004779; classtype:social-engineering; sid:6004779; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrq.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingrq.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004780; classtype:social-engineering; sid:6004780; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (testes-esdicao.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"testes-esdicao.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004781; classtype:social-engineering; sid:6004781; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hafizikrashue.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"hafizikrashue.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004782; classtype:social-engineering; sid:6004782; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedagiofreeflowoficial.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedagiofreeflowoficial.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004783; classtype:social-engineering; sid:6004783; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (singhknpharsh.github.io/Amazon-Homepage-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Homepage-Clone/"; startswith; fast_pattern; http.host; content:"singhknpharsh.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004784; classtype:social-engineering; sid:6004784; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta66245-cmyk.github.io/Pusat-bantuan-/)"; flow:established,to_server; http.uri; content:"/Pusat-bantuan-/"; startswith; fast_pattern; http.host; content:"meta66245-cmyk.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004785; classtype:social-engineering; sid:6004785; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwv-roblox.com/games/5233782396/Creatures-of-Sonaria-Survive-Kaiju-Animals?privateServerLinkCode=863746617703768301)"; flow:established,to_server; http.uri; content:"/games/5233782396/Creatures-of-Sonaria-Survive-Kaiju-Animals?privateServerLinkCode=863746617703768301"; startswith; fast_pattern; http.host; content:"wwv-roblox.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004786; classtype:social-engineering; sid:6004786; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xyl8.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xyl8.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004787; classtype:social-engineering; sid:6004787; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thefarmhouserent.com/choiceandcontrol/choiceandcontrol.htm)"; flow:established,to_server; http.uri; content:"/choiceandcontrol/choiceandcontrol.htm"; startswith; fast_pattern; http.host; content:"thefarmhouserent.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004788; classtype:social-engineering; sid:6004788; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafybeicktlze5dqdqm3teumr5roddw3rehhjg7pl7yanrvd53yx26v5244.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafybeicktlze5dqdqm3teumr5roddw3rehhjg7pl7yanrvd53yx26v5244.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004789; classtype:social-engineering; sid:6004789; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (federalnewsmagazine.com/2513501.doc/18a80a/fad0f483-81b2-45c6-ad47-7272058d9cb6)"; flow:established,to_server; http.uri; content:"/2513501.doc/18a80a/fad0f483-81b2-45c6-ad47-7272058d9cb6"; startswith; fast_pattern; http.host; content:"federalnewsmagazine.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004790; classtype:social-engineering; sid:6004790; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedagiofreeflow-brasil.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedagiofreeflow-brasil.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004791; classtype:social-engineering; sid:6004791; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creditagricole-activation.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"creditagricole-activation.bolt.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004792; classtype:social-engineering; sid:6004792; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prestamoenlineabhddrd.liveblog365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"prestamoenlineabhddrd.liveblog365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004793; classtype:social-engineering; sid:6004793; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.freeflow-rodovias.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.freeflow-rodovias.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004794; classtype:social-engineering; sid:6004794; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (traditional-championship-945162.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"traditional-championship-945162.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004795; classtype:social-engineering; sid:6004795; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrw.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingrw.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004796; classtype:social-engineering; sid:6004796; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kuoxmiologen.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kuoxmiologen.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004797; classtype:social-engineering; sid:6004797; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imagorad.com.br/prot/)"; flow:established,to_server; http.uri; content:"/prot/"; startswith; fast_pattern; http.host; content:"imagorad.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004798; classtype:social-engineering; sid:6004798; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trzrstart.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trzrstart.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004799; classtype:social-engineering; sid:6004799; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hqrieta.s3.eu-north-1.amazonaws.com/tmv.html)"; flow:established,to_server; http.uri; content:"/tmv.html"; startswith; fast_pattern; http.host; content:"hqrieta.s3.eu-north-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004800; classtype:social-engineering; sid:6004800; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365bet211.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365bet211.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004801; classtype:social-engineering; sid:6004801; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (privacy-services-division.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"privacy-services-division.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004802; classtype:social-engineering; sid:6004802; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cse23r01a05cq.github.io/Amazon-project/)"; flow:established,to_server; http.uri; content:"/Amazon-project/"; startswith; fast_pattern; http.host; content:"cse23r01a05cq.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004803; classtype:social-engineering; sid:6004803; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ac-oll-15060101010101010101.vercel.app/Ma010chelpAbh1041/index.html?ph0nq=null)"; flow:established,to_server; http.uri; content:"/Ma010chelpAbh1041/index.html?ph0nq=null"; startswith; fast_pattern; http.host; content:"ac-oll-15060101010101010101.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004804; classtype:social-engineering; sid:6004804; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (camparyxseces.wasmer.app/sbadisaster)"; flow:established,to_server; http.uri; content:"/sbadisaster"; startswith; fast_pattern; http.host; content:"camparyxseces.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004805; classtype:social-engineering; sid:6004805; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unreal-closet-604598.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"unreal-closet-604598.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004806; classtype:social-engineering; sid:6004806; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jdcarnes.davidsabido.com/wp-content/2026/)"; flow:established,to_server; http.uri; content:"/wp-content/2026/"; startswith; fast_pattern; http.host; content:"jdcarnes.davidsabido.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004807; classtype:social-engineering; sid:6004807; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vivek.howtowpguide.info/48-1576-050626/?u=83C1576&e=galenhub@e9eabe75fd949e4bcb8da576a6e7f838a7d7.org&s3=Wojciech&s4=Kulas&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/48-1576-050626/?u=83C1576&e=galenhub@e9eabe75fd949e4bcb8da576a6e7f838a7d7.org&s3=Wojciech&s4=Kulas&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"vivek.howtowpguide.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004808; classtype:social-engineering; sid:6004808; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.105633222.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.105633222.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004809; classtype:social-engineering; sid:6004809; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ubs.cx/customers/signin)"; flow:established,to_server; http.uri; content:"/customers/signin"; startswith; fast_pattern; http.host; content:"ubs.cx"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004810; classtype:social-engineering; sid:6004810; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agricole-espace.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"agricole-espace.bolt.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004811; classtype:social-engineering; sid:6004811; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verific-page.shop/project/Flverr)"; flow:established,to_server; http.uri; content:"/project/Flverr"; startswith; fast_pattern; http.host; content:"verific-page.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004812; classtype:social-engineering; sid:6004812; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (buildan.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"buildan.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004813; classtype:social-engineering; sid:6004813; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedagio-online.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedagio-online.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004814; classtype:social-engineering; sid:6004814; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6a305e2813dfbd3fb78810c4--ubiquitous-gingersnap-809853.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6a305e2813dfbd3fb78810c4--ubiquitous-gingersnap-809853.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004815; classtype:social-engineering; sid:6004815; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingry.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingry.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004816; classtype:social-engineering; sid:6004816; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ww-brasilrodovias.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ww-brasilrodovias.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004817; classtype:social-engineering; sid:6004817; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iesjsfvengcsdntd.meganelxspt.info/leds/)"; flow:established,to_server; http.uri; content:"/leds/"; startswith; fast_pattern; http.host; content:"iesjsfvengcsdntd.meganelxspt.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004818; classtype:social-engineering; sid:6004818; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rong1209.github.io/faecbook)"; flow:established,to_server; http.uri; content:"/faecbook"; startswith; fast_pattern; http.host; content:"rong1209.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004819; classtype:social-engineering; sid:6004819; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingre.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingre.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004820; classtype:social-engineering; sid:6004820; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brachunchun.com/js/made.in.china/membercenter.made-in-china.com/index.html)"; flow:established,to_server; http.uri; content:"/js/made.in.china/membercenter.made-in-china.com/index.html"; startswith; fast_pattern; http.host; content:"brachunchun.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004821; classtype:social-engineering; sid:6004821; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (topicguides.info/CH41-N1515-D090606/?u=12C1515&e=loronz@6f8f9751bf2f7641fa38e1584d18b293653e.net&s3=&s4=&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/CH41-N1515-D090606/?u=12C1515&e=loronz@6f8f9751bf2f7641fa38e1584d18b293653e.net&s3=&s4=&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"topicguides.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004822; classtype:social-engineering; sid:6004822; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (service-trezor.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"service-trezor.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004823; classtype:social-engineering; sid:6004823; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (michealbolaji024-web.github.io/Netflix)"; flow:established,to_server; http.uri; content:"/Netflix"; startswith; fast_pattern; http.host; content:"michealbolaji024-web.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004824; classtype:social-engineering; sid:6004824; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.thegmfinancial.com/Mac/utility.php)"; flow:established,to_server; http.uri; content:"/Mac/utility.php"; startswith; fast_pattern; http.host; content:"www.thegmfinancial.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004825; classtype:social-engineering; sid:6004825; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ar245.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ar245.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004826; classtype:social-engineering; sid:6004826; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (worker-ancient-cherry-d115.cumphlw-ilip-hr.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"worker-ancient-cherry-d115.cumphlw-ilip-hr.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004827; classtype:social-engineering; sid:6004827; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gaamsinilogon.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gaamsinilogon.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004828; classtype:social-engineering; sid:6004828; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s0luc10n-4mar1ll4.gamer.gd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"s0luc10n-4mar1ll4.gamer.gd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004829; classtype:social-engineering; sid:6004829; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7hhbh8.cn/mmixosct)"; flow:established,to_server; http.uri; content:"/mmixosct"; startswith; fast_pattern; http.host; content:"7hhbh8.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004830; classtype:social-engineering; sid:6004830; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cm280896.tw1.ru/emn/gomn/)"; flow:established,to_server; http.uri; content:"/emn/gomn/"; startswith; fast_pattern; http.host; content:"cm280896.tw1.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004831; classtype:social-engineering; sid:6004831; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ac156ollnno01010101010101010101.vercel.app/Wi010nhelpAbh1041/index.html?ph0nq=null)"; flow:established,to_server; http.uri; content:"/Wi010nhelpAbh1041/index.html?ph0nq=null"; startswith; fast_pattern; http.host; content:"ac156ollnno01010101010101010101.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004832; classtype:social-engineering; sid:6004832; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (charter.itupdates.support/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/"; startswith; fast_pattern; http.host; content:"charter.itupdates.support"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004833; classtype:social-engineering; sid:6004833; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cn-imtoken.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cn-imtoken.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004834; classtype:social-engineering; sid:6004834; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (awesome-sapphire-coyote.31-22-7-7.cpanel.site/registrar/)"; flow:established,to_server; http.uri; content:"/registrar/"; startswith; fast_pattern; http.host; content:"awesome-sapphire-coyote.31-22-7-7.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004835; classtype:social-engineering; sid:6004835; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bnp-reactivatio.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bnp-reactivatio.bolt.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004836; classtype:social-engineering; sid:6004836; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enel-ba.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"enel-ba.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004837; classtype:social-engineering; sid:6004837; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (endive-iris-7232.squarespace.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"endive-iris-7232.squarespace.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004838; classtype:social-engineering; sid:6004838; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (discreet-mountain-005558.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"discreet-mountain-005558.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004839; classtype:social-engineering; sid:6004839; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (restaurantlayalina.ro/Adobe_Acrobat_Reader/)"; flow:established,to_server; http.uri; content:"/Adobe_Acrobat_Reader/"; startswith; fast_pattern; http.host; content:"restaurantlayalina.ro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004840; classtype:social-engineering; sid:6004840; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingry.cyou/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingry.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004841; classtype:social-engineering; sid:6004841; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja76.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja76.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004842; classtype:social-engineering; sid:6004842; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thoughtful-years-447976.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"thoughtful-years-447976.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004843; classtype:social-engineering; sid:6004843; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freeflow.com.kz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"freeflow.com.kz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004844; classtype:social-engineering; sid:6004844; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metododeliberacao.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"metododeliberacao.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004845; classtype:social-engineering; sid:6004845; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (consulta-aqui-rd.iceiy.com/index2.html)"; flow:established,to_server; http.uri; content:"/index2.html"; startswith; fast_pattern; http.host; content:"consulta-aqui-rd.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004846; classtype:social-engineering; sid:6004846; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cathoaixarles.fr/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cathoaixarles.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004847; classtype:social-engineering; sid:6004847; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhdprestamospersonal.infinityfree.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bhdprestamospersonal.infinityfree.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004848; classtype:social-engineering; sid:6004848; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-digital.click/pedagio/)"; flow:established,to_server; http.uri; content:"/pedagio/"; startswith; fast_pattern; http.host; content:"app-digital.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004849; classtype:social-engineering; sid:6004849; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (practical-lavender-lstlcjg0-dpj54c25wmbe.edgeone.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"practical-lavender-lstlcjg0-dpj54c25wmbe.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004850; classtype:social-engineering; sid:6004850; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (krishnatuwar.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"krishnatuwar.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004851; classtype:social-engineering; sid:6004851; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (delightful-halva-8272c8.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"delightful-halva-8272c8.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004852; classtype:social-engineering; sid:6004852; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingre.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingre.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004853; classtype:social-engineering; sid:6004853; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrt.shop/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingrt.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004854; classtype:social-engineering; sid:6004854; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tyret-1-ya.028426.com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/"; startswith; fast_pattern; http.host; content:"tyret-1-ya.028426.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004855; classtype:social-engineering; sid:6004855; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bo6iur2.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bo6iur2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004856; classtype:social-engineering; sid:6004856; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agricole-activation1.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"agricole-activation1.bolt.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004857; classtype:social-engineering; sid:6004857; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (engenhariaviolet.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"engenhariaviolet.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004858; classtype:social-engineering; sid:6004858; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.usbank-brc.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.usbank-brc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004859; classtype:social-engineering; sid:6004859; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.site-4hencvzd9.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.site-4hencvzd9.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004860; classtype:social-engineering; sid:6004860; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prestamos-bhdleon-2026.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"prestamos-bhdleon-2026.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004861; classtype:social-engineering; sid:6004861; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedagiofflowbr.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedagiofflowbr.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004862; classtype:social-engineering; sid:6004862; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.alncsc.fit/Adobe/Adobefile.html)"; flow:established,to_server; http.uri; content:"/Adobe/Adobefile.html"; startswith; fast_pattern; http.host; content:"www.alncsc.fit"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004863; classtype:social-engineering; sid:6004863; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (privacy-authentication-desk.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"privacy-authentication-desk.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004864; classtype:social-engineering; sid:6004864; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secureloginonline.com/?rid=Hsk8TMX)"; flow:established,to_server; http.uri; content:"/?rid=Hsk8TMX"; startswith; fast_pattern; http.host; content:"secureloginonline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004865; classtype:social-engineering; sid:6004865; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3inew-3y4.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3inew-3y4.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004866; classtype:social-engineering; sid:6004866; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-uphold-cdn.infinityfreeapp.com/?i=1/)"; flow:established,to_server; http.uri; content:"/?i=1/"; startswith; fast_pattern; http.host; content:"sso-uphold-cdn.infinityfreeapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004867; classtype:social-engineering; sid:6004867; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp-archive-view.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp-archive-view.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004868; classtype:social-engineering; sid:6004868; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t-mobile.agzjis.top/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"t-mobile.agzjis.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004869; classtype:social-engineering; sid:6004869; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yashank-25.github.io/Amazon-Fronted-Project)"; flow:established,to_server; http.uri; content:"/Amazon-Fronted-Project"; startswith; fast_pattern; http.host; content:"yashank-25.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004870; classtype:social-engineering; sid:6004870; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedagiobrasil.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedagiobrasil.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004871; classtype:social-engineering; sid:6004871; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qr.codes/hbiDUB)"; flow:established,to_server; http.uri; content:"/hbiDUB"; startswith; fast_pattern; http.host; content:"qr.codes"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004872; classtype:social-engineering; sid:6004872; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unicorn.creditfacts.info/48-1576-050626/?u=81C1576&e=galus9@55e4ab42926fe8e3deb94d60df82eb62bb6b.net&s3=Wojciech&s4=Kulas&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/48-1576-050626/?u=81C1576&e=galus9@55e4ab42926fe8e3deb94d60df82eb62bb6b.net&s3=Wojciech&s4=Kulas&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"unicorn.creditfacts.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004873; classtype:social-engineering; sid:6004873; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8a-coder.github.io/amazon_clone)"; flow:established,to_server; http.uri; content:"/amazon_clone"; startswith; fast_pattern; http.host; content:"8a-coder.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004874; classtype:social-engineering; sid:6004874; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agritrader.net.ve/weblog/log.php)"; flow:established,to_server; http.uri; content:"/weblog/log.php"; startswith; fast_pattern; http.host; content:"agritrader.net.ve"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004875; classtype:social-engineering; sid:6004875; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cyoung-studio.com/jp)"; flow:established,to_server; http.uri; content:"/jp"; startswith; fast_pattern; http.host; content:"cyoung-studio.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004876; classtype:social-engineering; sid:6004876; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeeid4888.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopeeid4888.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004877; classtype:social-engineering; sid:6004877; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (swisborg-logiapp.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"swisborg-logiapp.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004878; classtype:social-engineering; sid:6004878; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (organizacaometodo.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"organizacaometodo.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004879; classtype:social-engineering; sid:6004879; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xupdate-105039.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xupdate-105039.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004880; classtype:social-engineering; sid:6004880; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aumentoja77.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"aumentoja77.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004881; classtype:social-engineering; sid:6004881; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prasantdumre837-cell.github.io/Amazon-Website-Clone-HTML-CSS-/)"; flow:established,to_server; http.uri; content:"/Amazon-Website-Clone-HTML-CSS-/"; startswith; fast_pattern; http.host; content:"prasantdumre837-cell.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004882; classtype:social-engineering; sid:6004882; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (escovashopee.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"escovashopee.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004883; classtype:social-engineering; sid:6004883; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (andrawshaj.github.io/Amazon-Project)"; flow:established,to_server; http.uri; content:"/Amazon-Project"; startswith; fast_pattern; http.host; content:"andrawshaj.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004884; classtype:social-engineering; sid:6004884; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maurimedis.com/wp-content/languages/themes/dhl/dhl/3/4.php/)"; flow:established,to_server; http.uri; content:"/wp-content/languages/themes/dhl/dhl/3/4.php/"; startswith; fast_pattern; http.host; content:"maurimedis.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004885; classtype:social-engineering; sid:6004885; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (74ze98.cn/mmixosct/)"; flow:established,to_server; http.uri; content:"/mmixosct/"; startswith; fast_pattern; http.host; content:"74ze98.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004886; classtype:social-engineering; sid:6004886; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smooth-copper-jcvlgeq4.edgeone.app/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"smooth-copper-jcvlgeq4.edgeone.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004887; classtype:social-engineering; sid:6004887; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pinipenaveena.github.io/Netflix-Homepage-UI-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Homepage-UI-Clone/"; startswith; fast_pattern; http.host; content:"pinipenaveena.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004888; classtype:social-engineering; sid:6004888; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ar24-connexion181554462874ar24.jimdofree.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ar24-connexion181554462874ar24.jimdofree.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004889; classtype:social-engineering; sid:6004889; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trzr-io-start.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trzr-io-start.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004890; classtype:social-engineering; sid:6004890; rev:1; metadata: signature_severity Major, created_et 2026_06_15, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (audio92872.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"audio92872.icu"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004891; classtype:social-engineering; sid:6004891; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ww547.selectiondulocker.com/?19vnMT3S=tkn)"; flow:established,to_server; http.uri; content:"/?19vnMT3S=tkn"; startswith; fast_pattern; http.host; content:"ww547.selectiondulocker.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004892; classtype:social-engineering; sid:6004892; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zsjcaaq.cdyhmh.cn/optmer-prefere_html/)"; flow:established,to_server; http.uri; content:"/optmer-prefere_html/"; startswith; fast_pattern; http.host; content:"zsjcaaq.cdyhmh.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004893; classtype:social-engineering; sid:6004893; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (encontrar-mixup.us/a.php)"; flow:established,to_server; http.uri; content:"/a.php"; startswith; fast_pattern; http.host; content:"encontrar-mixup.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004894; classtype:social-engineering; sid:6004894; rev:1; metadata: signature_severity Major, created_et 2026_06_16, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2f5doi.share-eu1.hsforms.com/2gfPH58UaQFeTjWusWySvVg)"; flow:established,to_server; http.uri; content:"/2gfPH58UaQFeTjWusWySvVg"; startswith; fast_pattern; http.host; content:"2f5doi.share-eu1.hsforms.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004895; classtype:social-engineering; sid:6004895; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cl.s13.exct.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cl.s13.exct.net"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004896; classtype:social-engineering; sid:6004896; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrl.top/com/)"; flow:established,to_server; http.uri; content:"/com/"; startswith; fast_pattern; http.host; content:"www.gov-parkingrl.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004897; classtype:social-engineering; sid:6004897; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bdvappclientes.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bdvappclientes.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004898; classtype:social-engineering; sid:6004898; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (im.nbpublic.com/loading_page/paypal/paypal_cf_11/index.html?lptoken=17046900585411739193)"; flow:established,to_server; http.uri; content:"/loading_page/paypal/paypal_cf_11/index.html?lptoken=17046900585411739193"; startswith; fast_pattern; http.host; content:"im.nbpublic.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004899; classtype:social-engineering; sid:6004899; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zggntgailz.github.io/Netflix/)"; flow:established,to_server; http.uri; content:"/Netflix/"; startswith; fast_pattern; http.host; content:"zggntgailz.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004900; classtype:social-engineering; sid:6004900; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-index--camarerotem.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-index--camarerotem.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004901; classtype:social-engineering; sid:6004901; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerservicei.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerservicei.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004902; classtype:social-engineering; sid:6004902; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.customerserviceb.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.customerserviceb.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004903; classtype:social-engineering; sid:6004903; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hkae-whatsapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hkae-whatsapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004904; classtype:social-engineering; sid:6004904; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fnlockercheck.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fnlockercheck.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004905; classtype:social-engineering; sid:6004905; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedagio-dobrasil.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pedagio-dobrasil.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004906; classtype:social-engineering; sid:6004906; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hshsfrfr.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hshsfrfr.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004907; classtype:social-engineering; sid:6004907; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nwgy3vtq-eekh5635oi9gda.ams3.digitaloceanspaces.com/InvoicingInstructions)"; flow:established,to_server; http.uri; content:"/InvoicingInstructions"; startswith; fast_pattern; http.host; content:"nwgy3vtq-eekh5635oi9gda.ams3.digitaloceanspaces.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004908; classtype:social-engineering; sid:6004908; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sender.zohoinsights.eu/ck1/13ef.4aba358de/a4ad29d0-6510-11f1-bae2-e23f717f7d6f/b6faded6ec3255299ebf1d0898c19333b83951ca/2?e=xw3brQBS%2FleRIw2zZ8W4o2SKFWmJEdVU6%2BUbQoBdGzo%3D)"; flow:established,to_server; http.uri; content:"/ck1/13ef.4aba358de/a4ad29d0-6510-11f1-bae2-e23f717f7d6f/b6faded6ec3255299ebf1d0898c19333b83951ca/2?e=xw3brQBS%2FleRIw2zZ8W4o2SKFWmJEdVU6%2BUbQoBdGzo%3D"; startswith; fast_pattern; http.host; content:"sender.zohoinsights.eu"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004909; classtype:social-engineering; sid:6004909; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (banruralbancavirtualgt.biz.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"banruralbancavirtualgt.biz.site"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004910; classtype:social-engineering; sid:6004910; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (banruralvirtualgt.biz.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"banruralvirtualgt.biz.site"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004911; classtype:social-engineering; sid:6004911; rev:1; metadata: signature_severity Major, created_et 2026_06_17, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee8717.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopee8717.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004912; classtype:social-engineering; sid:6004912; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (petropolisclub.com/metalworkservice/index.php/)"; flow:established,to_server; http.uri; content:"/metalworkservice/index.php/"; startswith; fast_pattern; http.host; content:"petropolisclub.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004913; classtype:social-engineering; sid:6004913; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8ac76743.shield-signin.com/?d=SkX6BvRWql8n89OalyoWx)"; flow:established,to_server; http.uri; content:"/?d=SkX6BvRWql8n89OalyoWx"; startswith; fast_pattern; http.host; content:"8ac76743.shield-signin.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004914; classtype:social-engineering; sid:6004914; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.appealhelpspage.store/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.appealhelpspage.store"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004915; classtype:social-engineering; sid:6004915; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingtt.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingtt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004916; classtype:social-engineering; sid:6004916; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b63.asia/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b63.asia"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004917; classtype:social-engineering; sid:6004917; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (io-suitetrezr-en.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"io-suitetrezr-en.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004918; classtype:social-engineering; sid:6004918; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (learn-io-start-trezo.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"learn-io-start-trezo.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004919; classtype:social-engineering; sid:6004919; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (patelnikhil5245-blip.github.io/Amazone_Clone_)"; flow:established,to_server; http.uri; content:"/Amazone_Clone_"; startswith; fast_pattern; http.host; content:"patelnikhil5245-blip.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004920; classtype:social-engineering; sid:6004920; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adrianstore.com.co/wp-content/I-Bots/CH/final/CHFINALE/)"; flow:established,to_server; http.uri; content:"/wp-content/I-Bots/CH/final/CHFINALE/"; startswith; fast_pattern; http.host; content:"adrianstore.com.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004921; classtype:social-engineering; sid:6004921; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfiinityy.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfiinityy.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004922; classtype:social-engineering; sid:6004922; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (foxinteriorsllc.com/~r5g8ldveioxpnxqm/assets/images/images/12/lng/login.php)"; flow:established,to_server; http.uri; content:"/~r5g8ldveioxpnxqm/assets/images/images/12/lng/login.php"; startswith; fast_pattern; http.host; content:"foxinteriorsllc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004923; classtype:social-engineering; sid:6004923; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingrv.cyou/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingrv.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004924; classtype:social-engineering; sid:6004924; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gov-parkingty.top/com)"; flow:established,to_server; http.uri; content:"/com"; startswith; fast_pattern; http.host; content:"www.gov-parkingty.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004925; classtype:social-engineering; sid:6004925; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (saibo2506.vip/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"saibo2506.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004926; classtype:social-engineering; sid:6004926; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-mocha-three.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-mocha-three.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004927; classtype:social-engineering; sid:6004927; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amplatzgifting.info/mediahub7818/?uo=161C1515&e=admin%2540jpn-online.ch&s3=&s4=&s5=&s6=&s7=&s8=&fol=m3R4wX2HoqiBoGCqm4R0f32dpqSHuZM)"; flow:established,to_server; http.uri; content:"/mediahub7818/?uo=161C1515&e=admin%2540jpn-online.ch&s3=&s4=&s5=&s6=&s7=&s8=&fol=m3R4wX2HoqiBoGCqm4R0f32dpqSHuZM"; startswith; fast_pattern; http.host; content:"amplatzgifting.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004928; classtype:social-engineering; sid:6004928; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.boafiles.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.boafiles.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004929; classtype:social-engineering; sid:6004929; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (swapdev.clovernode.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"swapdev.clovernode.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004930; classtype:social-engineering; sid:6004930; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ynlendriyonuzknk23154.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ynlendriyonuzknk23154.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004931; classtype:social-engineering; sid:6004931; rev:1; metadata: signature_severity Major, created_et 2026_06_19, updated_et 2026_06_25;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lyananxformndanaaz.sigibum.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lyananxformndanaaz.sigibum.my.id"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6004932; classtype:social-engineering; sid:6004932; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (novositepaybonu.lovable.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"novositepaybonu.lovable.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004933; classtype:social-engineering; sid:6004933; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-page-editor--louisemansfield.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-page-editor--louisemansfield.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004934; classtype:social-engineering; sid:6004934; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (project-sub31.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"project-sub31.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004935; classtype:social-engineering; sid:6004935; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-belvurin-biz8-forex-danik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-belvurin-biz8-forex-danik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004936; classtype:social-engineering; sid:6004936; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (applepayservices-fndjgffqasabh6hs.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"applepayservices-fndjgffqasabh6hs.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004937; classtype:social-engineering; sid:6004937; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tkshop27.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tkshop27.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004938; classtype:social-engineering; sid:6004938; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home-io-trez-start-us.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"home-io-trez-start-us.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004939; classtype:social-engineering; sid:6004939; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robloxanimalhospitalplush.com/product/animal-hospital-anomaly-plush-001/)"; flow:established,to_server; http.uri; content:"/product/animal-hospital-anomaly-plush-001/"; startswith; fast_pattern; http.host; content:"robloxanimalhospitalplush.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004940; classtype:social-engineering; sid:6004940; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p29c.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p29c.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004941; classtype:social-engineering; sid:6004941; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mybt-payment-107385-109649.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mybt-payment-107385-109649.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004942; classtype:social-engineering; sid:6004942; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xrp-flare-connection.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xrp-flare-connection.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004943; classtype:social-engineering; sid:6004943; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ap.demosite.cz/components/lanka/diff.html)"; flow:established,to_server; http.uri; content:"/components/lanka/diff.html"; startswith; fast_pattern; http.host; content:"ap.demosite.cz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004944; classtype:social-engineering; sid:6004944; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appleoficial.support/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"appleoficial.support"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004945; classtype:social-engineering; sid:6004945; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chat.ring-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chat.ring-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004946; classtype:social-engineering; sid:6004946; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blox.watevergames.net/?etext=2202.qpFFdK3n5TynURa0Dp41MLjfNqdq_zETO_FdSQ3BNUgkXFTFBuqX2zxnREJighFna3pveHdpa2lxa2FnaG5hcQ.959a12a9fadbd7d653165c4402edd97c11572e99)"; flow:established,to_server; http.uri; content:"/?etext=2202.qpFFdK3n5TynURa0Dp41MLjfNqdq_zETO_FdSQ3BNUgkXFTFBuqX2zxnREJighFna3pveHdpa2lxa2FnaG5hcQ.959a12a9fadbd7d653165c4402edd97c11572e99"; startswith; fast_pattern; http.host; content:"blox.watevergames.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004947; classtype:social-engineering; sid:6004947; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (itrustcapital-lo0gin.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"itrustcapital-lo0gin.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004948; classtype:social-engineering; sid:6004948; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paysecureverify.fr/?r=4a8140ac-c0c4-4d18-aaa3-92284417540a&rg=eu)"; flow:established,to_server; http.uri; content:"/?r=4a8140ac-c0c4-4d18-aaa3-92284417540a&rg=eu"; startswith; fast_pattern; http.host; content:"paysecureverify.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004949; classtype:social-engineering; sid:6004949; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netcoinss-logii.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netcoinss-logii.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004950; classtype:social-engineering; sid:6004950; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ad25477.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ad25477.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004951; classtype:social-engineering; sid:6004951; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-page-builder--kamilapatricia2.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-page-builder--kamilapatricia2.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004952; classtype:social-engineering; sid:6004952; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (opieum.github.io/Robloxprofile)"; flow:established,to_server; http.uri; content:"/Robloxprofile"; startswith; fast_pattern; http.host; content:"opieum.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004953; classtype:social-engineering; sid:6004953; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (staking5portfolio.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"staking5portfolio.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004954; classtype:social-engineering; sid:6004954; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uus-robinhood-apli.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uus-robinhood-apli.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004955; classtype:social-engineering; sid:6004955; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (get-strt-trezr-io.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"get-strt-trezr-io.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004956; classtype:social-engineering; sid:6004956; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webozip.in/fgeyork/ihoxyud/1fqlehu/Passcode.html)"; flow:established,to_server; http.uri; content:"/fgeyork/ihoxyud/1fqlehu/Passcode.html"; startswith; fast_pattern; http.host; content:"webozip.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004957; classtype:social-engineering; sid:6004957; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (97ee4.catex.at/cnbcard/cab3994js.php)"; flow:established,to_server; http.uri; content:"/cnbcard/cab3994js.php"; startswith; fast_pattern; http.host; content:"97ee4.catex.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004958; classtype:social-engineering; sid:6004958; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cecs-fagpdnd5cnatgfez.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cecs-fagpdnd5cnatgfez.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004959; classtype:social-engineering; sid:6004959; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinity.payment-profile.info/update-agreement)"; flow:established,to_server; http.uri; content:"/update-agreement"; startswith; fast_pattern; http.host; content:"xfinity.payment-profile.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004960; classtype:social-engineering; sid:6004960; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (extralimitedagosto.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"extralimitedagosto.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004961; classtype:social-engineering; sid:6004961; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-login-page-4g6p.onrender.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-login-page-4g6p.onrender.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004962; classtype:social-engineering; sid:6004962; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-clone-xi-three.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-clone-xi-three.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004963; classtype:social-engineering; sid:6004963; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-page-builder--nidala77.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-page-builder--nidala77.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004964; classtype:social-engineering; sid:6004964; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mercadolibre-details-challenge-kohl.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mercadolibre-details-challenge-kohl.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004965; classtype:social-engineering; sid:6004965; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (office365.statichost.page/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"office365.statichost.page"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004966; classtype:social-engineering; sid:6004966; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.my.gov.au-taxstatement26.de5.net/confirmtax/otp.html)"; flow:established,to_server; http.uri; content:"/confirmtax/otp.html"; startswith; fast_pattern; http.host; content:"login.my.gov.au-taxstatement26.de5.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004967; classtype:social-engineering; sid:6004967; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (staking3portfolio.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"staking3portfolio.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004968; classtype:social-engineering; sid:6004968; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.solicitudyaumentoagrupoamigo360.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.solicitudyaumentoagrupoamigo360.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004969; classtype:social-engineering; sid:6004969; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thr-sho52.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"thr-sho52.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004970; classtype:social-engineering; sid:6004970; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (san6-gvhagaa8ftgnhffc.z02.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"san6-gvhagaa8ftgnhffc.z02.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004971; classtype:social-engineering; sid:6004971; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (masaka-academy.org/wp-admin/mail/veri.html)"; flow:established,to_server; http.uri; content:"/wp-admin/mail/veri.html"; startswith; fast_pattern; http.host; content:"masaka-academy.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004972; classtype:social-engineering; sid:6004972; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adobe-review.github.io/sign/)"; flow:established,to_server; http.uri; content:"/sign/"; startswith; fast_pattern; http.host; content:"adobe-review.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004973; classtype:social-engineering; sid:6004973; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.5mp.eu/fajlok2/saopoulo/index_www.5mp.eu_.html)"; flow:established,to_server; http.uri; content:"/fajlok2/saopoulo/index_www.5mp.eu_.html"; startswith; fast_pattern; http.host; content:"www.5mp.eu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004974; classtype:social-engineering; sid:6004974; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dangkypaypal.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.dangkypaypal.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004975; classtype:social-engineering; sid:6004975; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (delightful-home-526187.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"delightful-home-526187.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004976; classtype:social-engineering; sid:6004976; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (achdh-dpdwwrdxc0a9.edgeone.dev/onnn.html)"; flow:established,to_server; http.uri; content:"/onnn.html"; startswith; fast_pattern; http.host; content:"achdh-dpdwwrdxc0a9.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004977; classtype:social-engineering; sid:6004977; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chat.connect-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chat.connect-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004978; classtype:social-engineering; sid:6004978; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metanet-auth.office.jekklim.org/metanet/)"; flow:established,to_server; http.uri; content:"/metanet/"; startswith; fast_pattern; http.host; content:"metanet-auth.office.jekklim.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004979; classtype:social-engineering; sid:6004979; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ttkpay-master.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ttkpay-master.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004980; classtype:social-engineering; sid:6004980; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dtwq1mz6skqlr.cloudfront.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dtwq1mz6skqlr.cloudfront.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004981; classtype:social-engineering; sid:6004981; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stunning-kulfi-78ebef.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"stunning-kulfi-78ebef.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004982; classtype:social-engineering; sid:6004982; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (89betlc.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"89betlc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004983; classtype:social-engineering; sid:6004983; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezor-wallet-e.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezor-wallet-e.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004984; classtype:social-engineering; sid:6004984; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flixorbit-login.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"flixorbit-login.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004985; classtype:social-engineering; sid:6004985; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agenciatributariaqazd.eu.cc/es)"; flow:established,to_server; http.uri; content:"/es"; startswith; fast_pattern; http.host; content:"agenciatributariaqazd.eu.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004986; classtype:social-engineering; sid:6004986; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-rolvex-biz8-darim-keson.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-rolvex-biz8-darim-keson.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004987; classtype:social-engineering; sid:6004987; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (csca-cmdhe6e9atfjd5ah.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"csca-cmdhe6e9atfjd5ah.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004988; classtype:social-engineering; sid:6004988; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bespoke-alfajores-fef1ce.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bespoke-alfajores-fef1ce.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004989; classtype:social-engineering; sid:6004989; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (one.buzz-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"one.buzz-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004990; classtype:social-engineering; sid:6004990; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ttkpay-master.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ttkpay-master.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004991; classtype:social-engineering; sid:6004991; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tcy6-1n0-emeco-qbv7ql-qmsr5f.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tcy6-1n0-emeco-qbv7ql-qmsr5f.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004992; classtype:social-engineering; sid:6004992; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (haleema7502.github.io/Netflix_Clone)"; flow:established,to_server; http.uri; content:"/Netflix_Clone"; startswith; fast_pattern; http.host; content:"haleema7502.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004993; classtype:social-engineering; sid:6004993; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (viewpackagetracking.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"viewpackagetracking.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004994; classtype:social-engineering; sid:6004994; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (closestone.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"closestone.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004995; classtype:social-engineering; sid:6004995; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (staking4portfolio.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"staking4portfolio.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004996; classtype:social-engineering; sid:6004996; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wa.connect-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wa.connect-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004997; classtype:social-engineering; sid:6004997; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chat.buzz-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chat.buzz-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004998; classtype:social-engineering; sid:6004998; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (team-task-hub--kinnyb.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"team-task-hub--kinnyb.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6004999; classtype:social-engineering; sid:6004999; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-friendship-dare.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"instagram-friendship-dare.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005000; classtype:social-engineering; sid:6005000; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.yxrrggaulragjcrjugzj.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.yxrrggaulragjcrjugzj.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005001; classtype:social-engineering; sid:6005001; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-eight-taupe.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-eight-taupe.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005002; classtype:social-engineering; sid:6005002; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eclectic-dolphin-b539ec.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eclectic-dolphin-b539ec.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005003; classtype:social-engineering; sid:6005003; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bitmartloggine.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bitmartloggine.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005004; classtype:social-engineering; sid:6005004; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (met-wemask-exten-sion.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"met-wemask-exten-sion.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005005; classtype:social-engineering; sid:6005005; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.solicitudyaumentodecupobancol360.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.solicitudyaumentodecupobancol360.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005006; classtype:social-engineering; sid:6005006; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portal-netcoinas.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portal-netcoinas.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005007; classtype:social-engineering; sid:6005007; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-dervax-biz8-korex-lamin.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-dervax-biz8-korex-lamin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005008; classtype:social-engineering; sid:6005008; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sgin12-dhl.mdbgo.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sgin12-dhl.mdbgo.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005009; classtype:social-engineering; sid:6005009; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.99nt.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.99nt.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005010; classtype:social-engineering; sid:6005010; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (offical-start-led-ger-en.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"offical-start-led-ger-en.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005011; classtype:social-engineering; sid:6005011; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (erp.saina.com.tr/web/login)"; flow:established,to_server; http.uri; content:"/web/login"; startswith; fast_pattern; http.host; content:"erp.saina.com.tr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005012; classtype:social-engineering; sid:6005012; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-parvurin-biz8-zurem-falon.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-parvurin-biz8-zurem-falon.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005013; classtype:social-engineering; sid:6005013; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usc1.contabostorage.com/cc5b4ed1cd0c4a71b3e0acde77b5f3ed:pagee/myweb-secure.html)"; flow:established,to_server; http.uri; content:"/cc5b4ed1cd0c4a71b3e0acde77b5f3ed:pagee/myweb-secure.html"; startswith; fast_pattern; http.host; content:"usc1.contabostorage.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005014; classtype:social-engineering; sid:6005014; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (183.181.205.92.host.secureserver.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"183.181.205.92.host.secureserver.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005015; classtype:social-engineering; sid:6005015; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (endeveteasetsxmimgqiye.vercel.app/?dispatch=jh91649f3c0i7527aa1k4cj93f85i7e1jaf3k1d&id=81gcc47b1gc1fjga6bc2h7hi89fa4kf26fhjhdcj463cc7b562j998hkhk7ia9c38c&websrc=1zz689j0dmqnco09puk2kab4uewocewn2vl4tav0unpzdzbak1dgmaojchao8km42sjywloc9htdhyh8zzmj1m6825zqpjz59ysjd1o3oji97eemwlszhf57ioyx0mz1id2x)"; flow:established,to_server; http.uri; content:"/?dispatch=jh91649f3c0i7527aa1k4cj93f85i7e1jaf3k1d&id=81gcc47b1gc1fjga6bc2h7hi89fa4kf26fhjhdcj463cc7b562j998hkhk7ia9c38c&websrc=1zz689j0dmqnco09puk2kab4uewocewn2vl4tav0unpzdzbak1dgmaojchao8km42sjywloc9htdhyh8zzmj1m6825zqpjz59ysjd1o3oji97eemwlszhf57ioyx0mz1id2x"; startswith; fast_pattern; http.host; content:"endeveteasetsxmimgqiye.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005016; classtype:social-engineering; sid:6005016; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ing-gray.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ing-gray.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005017; classtype:social-engineering; sid:6005017; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eloquent-bublanina-d0dc9b.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eloquent-bublanina-d0dc9b.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005018; classtype:social-engineering; sid:6005018; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robloto.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"robloto.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005019; classtype:social-engineering; sid:6005019; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (php-web-server--activo2888.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"php-web-server--activo2888.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005020; classtype:social-engineering; sid:6005020; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mlcrosoft.cluod.qubicdev.nl/AwudtjYz)"; flow:established,to_server; http.uri; content:"/AwudtjYz"; startswith; fast_pattern; http.host; content:"mlcrosoft.cluod.qubicdev.nl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005021; classtype:social-engineering; sid:6005021; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-navrix-biz8-jorel-tumax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-navrix-biz8-jorel-tumax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005022; classtype:social-engineering; sid:6005022; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (swiftyl.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"swiftyl.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005023; classtype:social-engineering; sid:6005023; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sunnycode9325.github.io/netflix.clone.github.io)"; flow:established,to_server; http.uri; content:"/netflix.clone.github.io"; startswith; fast_pattern; http.host; content:"sunnycode9325.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005024; classtype:social-engineering; sid:6005024; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trzorlogin.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trzorlogin.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005025; classtype:social-engineering; sid:6005025; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-qarvexo-biz8-kurem-ladon.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-qarvexo-biz8-kurem-ladon.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005026; classtype:social-engineering; sid:6005026; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (to.lk/MkmAzg)"; flow:established,to_server; http.uri; content:"/MkmAzg"; startswith; fast_pattern; http.host; content:"to.lk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005027; classtype:social-engineering; sid:6005027; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rss.sayler.at/go/y2c4y254/y274x274)"; flow:established,to_server; http.uri; content:"/go/y2c4y254/y274x274"; startswith; fast_pattern; http.host; content:"rss.sayler.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005028; classtype:social-engineering; sid:6005028; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gredx.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gredx.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005029; classtype:social-engineering; sid:6005029; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pay-com.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.pay-com.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005030; classtype:social-engineering; sid:6005030; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (am.gckhr.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"am.gckhr.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005031; classtype:social-engineering; sid:6005031; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.santander-protocolo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.santander-protocolo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005032; classtype:social-engineering; sid:6005032; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.myonlinebellfacturation.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.myonlinebellfacturation.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005033; classtype:social-engineering; sid:6005033; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atharvnavlakhe.github.io/amazon-homepage-clone)"; flow:established,to_server; http.uri; content:"/amazon-homepage-clone"; startswith; fast_pattern; http.host; content:"atharvnavlakhe.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005034; classtype:social-engineering; sid:6005034; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ledger-native.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ledger-native.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005035; classtype:social-engineering; sid:6005035; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j138l.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j138l.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005036; classtype:social-engineering; sid:6005036; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-forvurin-biz8-zorex-lamik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-forvurin-biz8-zorex-lamik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005037; classtype:social-engineering; sid:6005037; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox.com.bi/communities/932771512364/theones)"; flow:established,to_server; http.uri; content:"/communities/932771512364/theones"; startswith; fast_pattern; http.host; content:"roblox.com.bi"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005038; classtype:social-engineering; sid:6005038; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j9s-0ocsy-npc-g1bvk-k0v74.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j9s-0ocsy-npc-g1bvk-k0v74.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005039; classtype:social-engineering; sid:6005039; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booklngstay-prearrlvalnotlce.com/kpwejlkx)"; flow:established,to_server; http.uri; content:"/kpwejlkx"; startswith; fast_pattern; http.host; content:"booklngstay-prearrlvalnotlce.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005040; classtype:social-engineering; sid:6005040; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ww.array-expo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ww.array-expo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005041; classtype:social-engineering; sid:6005041; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fotosdemorrodochapeuba.com.br/enclosed/confidentiality.html)"; flow:established,to_server; http.uri; content:"/enclosed/confidentiality.html"; startswith; fast_pattern; http.host; content:"www.fotosdemorrodochapeuba.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005042; classtype:social-engineering; sid:6005042; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (world-dobraya-raduga.shop/id=5162802847)"; flow:established,to_server; http.uri; content:"/id=5162802847"; startswith; fast_pattern; http.host; content:"world-dobraya-raduga.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005043; classtype:social-engineering; sid:6005043; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (beautiful-hummingbird-8f2323.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"beautiful-hummingbird-8f2323.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005044; classtype:social-engineering; sid:6005044; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (certifiedsafepages.net/landing/form/dc0d13f6-1394-4a0e-96cc-40808b79d5cb)"; flow:established,to_server; http.uri; content:"/landing/form/dc0d13f6-1394-4a0e-96cc-40808b79d5cb"; startswith; fast_pattern; http.host; content:"certifiedsafepages.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005045; classtype:social-engineering; sid:6005045; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (staking2portfolio.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"staking2portfolio.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005046; classtype:social-engineering; sid:6005046; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lambent-mermaid-5c62b0.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lambent-mermaid-5c62b0.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005047; classtype:social-engineering; sid:6005047; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledzrlognn.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledzrlognn.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005048; classtype:social-engineering; sid:6005048; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (khaki-octopus-59420.zap.cloud/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"khaki-octopus-59420.zap.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005049; classtype:social-engineering; sid:6005049; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vaishnaviraut3003-cyber.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"vaishnaviraut3003-cyber.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005050; classtype:social-engineering; sid:6005050; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-clone-xi-three.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-clone-xi-three.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005051; classtype:social-engineering; sid:6005051; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hittps-roblox.com/users/2022513948/profile)"; flow:established,to_server; http.uri; content:"/users/2022513948/profile"; startswith; fast_pattern; http.host; content:"hittps-roblox.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005052; classtype:social-engineering; sid:6005052; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eu-facebook.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eu-facebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005053; classtype:social-engineering; sid:6005053; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (firhitirtlhd.click/index/main/)"; flow:established,to_server; http.uri; content:"/index/main/"; startswith; fast_pattern; http.host; content:"firhitirtlhd.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005054; classtype:social-engineering; sid:6005054; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.segurossurah360.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.segurossurah360.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005055; classtype:social-engineering; sid:6005055; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (macjsiy.us.cc/5g/home.html)"; flow:established,to_server; http.uri; content:"/5g/home.html"; startswith; fast_pattern; http.host; content:"macjsiy.us.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005056; classtype:social-engineering; sid:6005056; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (errcode-blond.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"errcode-blond.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005057; classtype:social-engineering; sid:6005057; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jellyfish-app-eshkj.ondigitalocean.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jellyfish-app-eshkj.ondigitalocean.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005058; classtype:social-engineering; sid:6005058; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-i29ewn21k.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-i29ewn21k.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005059; classtype:social-engineering; sid:6005059; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox.com.et/users/515085061099/profile)"; flow:established,to_server; http.uri; content:"/users/515085061099/profile"; startswith; fast_pattern; http.host; content:"roblox.com.et"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005060; classtype:social-engineering; sid:6005060; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lucent-florentine-4217dd.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lucent-florentine-4217dd.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005061; classtype:social-engineering; sid:6005061; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.amazon-project-with-java-script.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-project-with-java-script.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005062; classtype:social-engineering; sid:6005062; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (devxnsh1.github.io/demoamazon/)"; flow:established,to_server; http.uri; content:"/demoamazon/"; startswith; fast_pattern; http.host; content:"devxnsh1.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005063; classtype:social-engineering; sid:6005063; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.meta-facebook-pro.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.meta-facebook-pro.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005064; classtype:social-engineering; sid:6005064; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ayaankumar08260-hue.github.io/Instagram.com/)"; flow:established,to_server; http.uri; content:"/Instagram.com/"; startswith; fast_pattern; http.host; content:"ayaankumar08260-hue.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005065; classtype:social-engineering; sid:6005065; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.robiox.com.gr/users/4205973659/profile)"; flow:established,to_server; http.uri; content:"/users/4205973659/profile"; startswith; fast_pattern; http.host; content:"www.robiox.com.gr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005066; classtype:social-engineering; sid:6005066; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cf352485.tw1.ru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cf352485.tw1.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005067; classtype:social-engineering; sid:6005067; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pay-com.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"pay-com.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005068; classtype:social-engineering; sid:6005068; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.25fshop77.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.25fshop77.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005069; classtype:social-engineering; sid:6005069; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mateladepormhub.phemayameltahub.site/incident-migrate-strict-linux-trigger-vaul)"; flow:established,to_server; http.uri; content:"/incident-migrate-strict-linux-trigger-vaul"; startswith; fast_pattern; http.host; content:"mateladepormhub.phemayameltahub.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005070; classtype:social-engineering; sid:6005070; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-pardevik-biz8-durex-fazim.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-pardevik-biz8-durex-fazim.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005071; classtype:social-engineering; sid:6005071; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ashishjadhav544.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"ashishjadhav544.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005072; classtype:social-engineering; sid:6005072; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metemeskwalet.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metemeskwalet.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005073; classtype:social-engineering; sid:6005073; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.2547rr.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.2547rr.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005074; classtype:social-engineering; sid:6005074; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-delmorin-biz8-zurem-falok.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-delmorin-biz8-zurem-falok.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005075; classtype:social-engineering; sid:6005075; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zucutti.lat/s/FZpFQV)"; flow:established,to_server; http.uri; content:"/s/FZpFQV"; startswith; fast_pattern; http.host; content:"zucutti.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005076; classtype:social-engineering; sid:6005076; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kuccoinlognzs.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kuccoinlognzs.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005077; classtype:social-engineering; sid:6005077; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (make-courgette-949087.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"make-courgette-949087.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005078; classtype:social-engineering; sid:6005078; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mobilekaitori.com/UsAAif1iqfOtCFK7kiptb0811KUfyb/usa-m/)"; flow:established,to_server; http.uri; content:"/UsAAif1iqfOtCFK7kiptb0811KUfyb/usa-m/"; startswith; fast_pattern; http.host; content:"www.mobilekaitori.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005079; classtype:social-engineering; sid:6005079; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prtraf.github.io/rb/?p=5krob)"; flow:established,to_server; http.uri; content:"/rb/?p=5krob"; startswith; fast_pattern; http.host; content:"prtraf.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005080; classtype:social-engineering; sid:6005080; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebooklogin1234.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebooklogin1234.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005081; classtype:social-engineering; sid:6005081; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (office-365-new.s3.ca-west-1.amazonaws.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"office-365-new.s3.ca-west-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005082; classtype:social-engineering; sid:6005082; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jolly-themes-327857.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jolly-themes-327857.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005083; classtype:social-engineering; sid:6005083; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-dorevak-biz8-lurem-kason.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-dorevak-biz8-lurem-kason.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005084; classtype:social-engineering; sid:6005084; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezr-io-start-cloud-sso.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezr-io-start-cloud-sso.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005085; classtype:social-engineering; sid:6005085; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (af83c2f7-e94f-4908-9e04-6e96269d358a-00-3m1tfo9zpuwcp.picard.replit.dev/index2.html)"; flow:established,to_server; http.uri; content:"/index2.html"; startswith; fast_pattern; http.host; content:"af83c2f7-e94f-4908-9e04-6e96269d358a-00-3m1tfo9zpuwcp.picard.replit.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005086; classtype:social-engineering; sid:6005086; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.sf.tumee.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login.sf.tumee.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005087; classtype:social-engineering; sid:6005087; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.teamrre.com/p/csef-qajt/SJFJRIFK/)"; flow:established,to_server; http.uri; content:"/p/csef-qajt/SJFJRIFK/"; startswith; fast_pattern; http.host; content:"s.teamrre.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005088; classtype:social-engineering; sid:6005088; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spontaneous-starlight-b8be34.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spontaneous-starlight-b8be34.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005089; classtype:social-engineering; sid:6005089; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (green-awx.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"green-awx.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005090; classtype:social-engineering; sid:6005090; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (truexarchetypalkz-f5h0d2f3g8hgegef.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"truexarchetypalkz-f5h0d2f3g8hgegef.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005091; classtype:social-engineering; sid:6005091; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wa.utter-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wa.utter-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005092; classtype:social-engineering; sid:6005092; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct-fureq-biz8-vamek-horin.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct-fureq-biz8-vamek-horin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005093; classtype:social-engineering; sid:6005093; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (techie-25.github.io/Amazon_clone2)"; flow:established,to_server; http.uri; content:"/Amazon_clone2"; startswith; fast_pattern; http.host; content:"techie-25.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005094; classtype:social-engineering; sid:6005094; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tearns-misrasoft.com/?rid=ByPgU0J)"; flow:established,to_server; http.uri; content:"/?rid=ByPgU0J"; startswith; fast_pattern; http.host; content:"tearns-misrasoft.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005095; classtype:social-engineering; sid:6005095; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wa.chans-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wa.chans-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005096; classtype:social-engineering; sid:6005096; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (23x23x2x.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"23x23x2x.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005097; classtype:social-engineering; sid:6005097; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paineldedisponibilidade.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"paineldedisponibilidade.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005098; classtype:social-engineering; sid:6005098; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazonbyibrahim.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazonbyibrahim.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005099; classtype:social-engineering; sid:6005099; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tiny.cc/3hy5101)"; flow:established,to_server; http.uri; content:"/3hy5101"; startswith; fast_pattern; http.host; content:"tiny.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005100; classtype:social-engineering; sid:6005100; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coce-crccbadch4gae8f2.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coce-crccbadch4gae8f2.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005101; classtype:social-engineering; sid:6005101; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (saeedebrahimi.ir/0e94p06/index.php)"; flow:established,to_server; http.uri; content:"/0e94p06/index.php"; startswith; fast_pattern; http.host; content:"saeedebrahimi.ir"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005102; classtype:social-engineering; sid:6005102; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sf.tumee.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sf.tumee.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005103; classtype:social-engineering; sid:6005103; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alldbgdhhdhhdhhhchhchdhdm-dp9hzij3r3mr.edgeone.dev/ALL-DOMAIN-PAGE007.html)"; flow:established,to_server; http.uri; content:"/ALL-DOMAIN-PAGE007.html"; startswith; fast_pattern; http.host; content:"alldbgdhhdhhdhhhchhchdhdm-dp9hzij3r3mr.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005104; classtype:social-engineering; sid:6005104; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagramprofilelinks.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagramprofilelinks.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005105; classtype:social-engineering; sid:6005105; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zulqarnain-wali.github.io/Netflix-clone-webpage/)"; flow:established,to_server; http.uri; content:"/Netflix-clone-webpage/"; startswith; fast_pattern; http.host; content:"zulqarnain-wali.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005106; classtype:social-engineering; sid:6005106; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (451238.help/dpd/pl)"; flow:established,to_server; http.uri; content:"/dpd/pl"; startswith; fast_pattern; http.host; content:"451238.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005107; classtype:social-engineering; sid:6005107; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danaindonesia-l.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danaindonesia-l.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005108; classtype:social-engineering; sid:6005108; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (162.89.74.97.host.secureserver.net/scl.swisscom-kundenservice/CH-DE/)"; flow:established,to_server; http.uri; content:"/scl.swisscom-kundenservice/CH-DE/"; startswith; fast_pattern; http.host; content:"162.89.74.97.host.secureserver.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005109; classtype:social-engineering; sid:6005109; rev:1; metadata: signature_severity Major, created_et 2026_07_31;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2026-08-01.urldance.com/us?howtosuecslplasma.org#nolanguage)"; flow:established,to_server; http.uri; content:"/us?howtosuecslplasma.org#nolanguage"; startswith; fast_pattern; http.host; content:"2026-08-01.urldance.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005110; classtype:social-engineering; sid:6005110; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (poetic-raindrop-6b2d15.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"poetic-raindrop-6b2d15.netlify.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005111; classtype:social-engineering; sid:6005111; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-rurek-biz8-folim-maven.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-rurek-biz8-folim-maven.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005112; classtype:social-engineering; sid:6005112; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (247correo-outlook.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"247correo-outlook.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005113; classtype:social-engineering; sid:6005113; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.powr.io/media-gallery/i/41496466)"; flow:established,to_server; http.uri; content:"/media-gallery/i/41496466"; startswith; fast_pattern; http.host; content:"www.powr.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005114; classtype:social-engineering; sid:6005114; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trc-click-out-2b82f5-nonce-7d8f2e.vercel.app/?token=cmrb1ov0b005tpvx2nklfc7dc:cms2jwqet1k62pvmtm13o4pob:CxNWU0ocVwhUAlcQSl5K:1785290931097&dn=huber-bleger.fr&pid=1073&sp=fr)"; flow:established,to_server; http.uri; content:"/?token=cmrb1ov0b005tpvx2nklfc7dc:cms2jwqet1k62pvmtm13o4pob:CxNWU0ocVwhUAlcQSl5K:1785290931097&dn=huber-bleger.fr&pid=1073&sp=fr"; startswith; fast_pattern; http.host; content:"trc-click-out-2b82f5-nonce-7d8f2e.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005115; classtype:social-engineering; sid:6005115; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cfzpv-pubzm-g0y2-062-tdv.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cfzpv-pubzm-g0y2-062-tdv.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005116; classtype:social-engineering; sid:6005116; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp3ct-purnex-biz8-kelvik-sarom.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp3ct-purnex-biz8-kelvik-sarom.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005117; classtype:social-engineering; sid:6005117; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6e9-7ew56-doqszs-e15e6t-glomf.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6e9-7ew56-doqszs-e15e6t-glomf.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005118; classtype:social-engineering; sid:6005118; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp3ct-renlor-biz8-makvik-hosen.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp3ct-renlor-biz8-makvik-hosen.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005119; classtype:social-engineering; sid:6005119; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nadfgdfhuert.eu.cc/es)"; flow:established,to_server; http.uri; content:"/es"; startswith; fast_pattern; http.host; content:"nadfgdfhuert.eu.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005120; classtype:social-engineering; sid:6005120; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bntp3725nhw-yfhcnfyn-7d5e0f-xk266a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bntp3725nhw-yfhcnfyn-7d5e0f-xk266a.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005121; classtype:social-engineering; sid:6005121; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j4uh4-owrpo-ioqpi7-1ji-e3d.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j4uh4-owrpo-ioqpi7-1ji-e3d.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005122; classtype:social-engineering; sid:6005122; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vd1-6mno-cijzs-s4uc-wgcr4.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vd1-6mno-cijzs-s4uc-wgcr4.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005123; classtype:social-engineering; sid:6005123; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (11uth-gr.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"11uth-gr.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005124; classtype:social-engineering; sid:6005124; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nasrgdfjhqaz.eu.cc/es)"; flow:established,to_server; http.uri; content:"/es"; startswith; fast_pattern; http.host; content:"nasrgdfjhqaz.eu.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005125; classtype:social-engineering; sid:6005125; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (donnabellaeventos.com.br/cgi-sys/suspendedpage.cgi)"; flow:established,to_server; http.uri; content:"/cgi-sys/suspendedpage.cgi"; startswith; fast_pattern; http.host; content:"donnabellaeventos.com.br"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005126; classtype:social-engineering; sid:6005126; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortquick.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortquick.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005127; classtype:social-engineering; sid:6005127; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-jervax-biz8-lorex-kafim.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-jervax-biz8-lorex-kafim.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005128; classtype:social-engineering; sid:6005128; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-tarok-biz8-furem-dazin.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-tarok-biz8-furem-dazin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005129; classtype:social-engineering; sid:6005129; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whaia.webcindario.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whaia.webcindario.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005130; classtype:social-engineering; sid:6005130; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.phone-lcloud.site/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.phone-lcloud.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005131; classtype:social-engineering; sid:6005131; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mc7-t7r-mueh-8or-yqhlqk-74qrb.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mc7-t7r-mueh-8or-yqhlqk-74qrb.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005132; classtype:social-engineering; sid:6005132; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lobster-app-97o5r.ondigitalocean.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lobster-app-97o5r.ondigitalocean.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005133; classtype:social-engineering; sid:6005133; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trelvo-samrik-46f29d-brbn-hf2406xto.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trelvo-samrik-46f29d-brbn-hf2406xto.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005134; classtype:social-engineering; sid:6005134; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mghub.phemayameltahub.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mghub.phemayameltahub.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005135; classtype:social-engineering; sid:6005135; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-ca.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-ca.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005136; classtype:social-engineering; sid:6005136; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (g4lqky-epxe-z5c92-x130x-5p9.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"g4lqky-epxe-z5c92-x130x-5p9.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005137; classtype:social-engineering; sid:6005137; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zor-xqrc8c-04k-nzv0-k0q5nq.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zor-xqrc8c-04k-nzv0-k0q5nq.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005138; classtype:social-engineering; sid:6005138; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (w1xgy-ddna0-x5cczz-f9h-i9s9qa.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"w1xgy-ddna0-x5cczz-f9h-i9s9qa.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005139; classtype:social-engineering; sid:6005139; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pygq-lulrq-wnc-lv1v2a-hsie2.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pygq-lulrq-wnc-lv1v2a-hsie2.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005140; classtype:social-engineering; sid:6005140; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lw1j6-db3ts-eti4is-dyo-nfvr.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lw1j6-db3ts-eti4is-dyo-nfvr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005141; classtype:social-engineering; sid:6005141; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mydollarduck.com/land/)"; flow:established,to_server; http.uri; content:"/land/"; startswith; fast_pattern; http.host; content:"mydollarduck.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005142; classtype:social-engineering; sid:6005142; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-dorek-biz8-zurem-kafin.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-dorek-biz8-zurem-kafin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005143; classtype:social-engineering; sid:6005143; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tsatw-81n-d7u-0c6u-952iy.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tsatw-81n-d7u-0c6u-952iy.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005144; classtype:social-engineering; sid:6005144; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sud-0qek4-n2z-lb3cm-e6e-w6i37q.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sud-0qek4-n2z-lb3cm-e6e-w6i37q.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005145; classtype:social-engineering; sid:6005145; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ozbv-s6a3mk-rvhbj7-42s69.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ozbv-s6a3mk-rvhbj7-42s69.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005146; classtype:social-engineering; sid:6005146; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fn4pn-31h-gmb7o9-2cyq-sdm.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fn4pn-31h-gmb7o9-2cyq-sdm.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005147; classtype:social-engineering; sid:6005147; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ctj-rr9-2e2ui0-3mcc-8we-akbg.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ctj-rr9-2e2ui0-3mcc-8we-akbg.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005148; classtype:social-engineering; sid:6005148; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.team-fz.com/p/fhtb-mrgw/nwjrmgwv/)"; flow:established,to_server; http.uri; content:"/p/fhtb-mrgw/nwjrmgwv/"; startswith; fast_pattern; http.host; content:"s.team-fz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005149; classtype:social-engineering; sid:6005149; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-dafem-biz8-murek-lorin.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-dafem-biz8-murek-lorin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005150; classtype:social-engineering; sid:6005150; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (evoluaagora.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"evoluaagora.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005151; classtype:social-engineering; sid:6005151; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-surek-biz8-zavom-lirek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-surek-biz8-zavom-lirek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005152; classtype:social-engineering; sid:6005152; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp3ct-lanvik-biz8-forsel-qadun.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp3ct-lanvik-biz8-forsel-qadun.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005153; classtype:social-engineering; sid:6005153; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c5d-sjhq05-dci1cp-rqtum-efwhz.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c5d-sjhq05-dci1cp-rqtum-efwhz.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005154; classtype:social-engineering; sid:6005154; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (automotriztempanoice.com.ve/dairysolutionsinc/dairysolutionsinc-secure-verify.html)"; flow:established,to_server; http.uri; content:"/dairysolutionsinc/dairysolutionsinc-secure-verify.html"; startswith; fast_pattern; http.host; content:"automotriztempanoice.com.ve"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005155; classtype:social-engineering; sid:6005155; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pldxu-jpa-dakfrj-zivem-eroo.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pldxu-jpa-dakfrj-zivem-eroo.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005156; classtype:social-engineering; sid:6005156; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (morlita-kig-felquro-r4x8dw26.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"morlita-kig-felquro-r4x8dw26.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005157; classtype:social-engineering; sid:6005157; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (goldfish-app-5rkrt.ondigitalocean.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"goldfish-app-5rkrt.ondigitalocean.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005158; classtype:social-engineering; sid:6005158; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (k82o.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"k82o.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005159; classtype:social-engineering; sid:6005159; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shubhamkumar-25.github.io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"shubhamkumar-25.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005160; classtype:social-engineering; sid:6005160; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wtestresolve-ena.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wtestresolve-ena.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005161; classtype:social-engineering; sid:6005161; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ifind-maps-recover.com/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"ifind-maps-recover.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005162; classtype:social-engineering; sid:6005162; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (121dax.senes.at/stakings/?b=YTo0OntzOjU6ImxhYmVsIjtzOjA6IiI7czozOiJ1c3IiO2k6MTY0NDtzOjQ6Im5vcGQiO3M6MTM6InJzcy5zYXlsZXIuYXQiO3M6MToibyI7aToxMTM2O30=)"; flow:established,to_server; http.uri; content:"/stakings/?b=YTo0OntzOjU6ImxhYmVsIjtzOjA6IiI7czozOiJ1c3IiO2k6MTY0NDtzOjQ6Im5vcGQiO3M6MTM6InJzcy5zYXlsZXIuYXQiO3M6MToibyI7aToxMTM2O30="; startswith; fast_pattern; http.host; content:"121dax.senes.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005163; classtype:social-engineering; sid:6005163; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-wardelon-biz8-lorex-kasok.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-wardelon-biz8-lorex-kasok.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005164; classtype:social-engineering; sid:6005164; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tg5tg-wf4c-4oai-x163b8-4wli.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tg5tg-wf4c-4oai-x163b8-4wli.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005165; classtype:social-engineering; sid:6005165; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d7hrh-q8l-5pmo-wmj81-ih2.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d7hrh-q8l-5pmo-wmj81-ih2.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005166; classtype:social-engineering; sid:6005166; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (encontrar-lphone.top/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"encontrar-lphone.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005167; classtype:social-engineering; sid:6005167; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wjrsk8agpxo-mzgqlmja-9e5f9b-wjr06c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wjrsk8agpxo-mzgqlmja-9e5f9b-wjr06c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005168; classtype:social-engineering; sid:6005168; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mateladepormhub.phemayameltahub.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mateladepormhub.phemayameltahub.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005169; classtype:social-engineering; sid:6005169; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-gurex-biz8-kafem-lorin.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-gurex-biz8-kafem-lorin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005170; classtype:social-engineering; sid:6005170; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-hurep-biz8-kavem-doril.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-hurep-biz8-kavem-doril.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005171; classtype:social-engineering; sid:6005171; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-hovam-biz8-kurex-lisen.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-hovam-biz8-kurex-lisen.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005172; classtype:social-engineering; sid:6005172; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-lafik-biz8-durem-zorel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-lafik-biz8-durem-zorel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005173; classtype:social-engineering; sid:6005173; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-savorek-biz8-forax-lunem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-savorek-biz8-forax-lunem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005174; classtype:social-engineering; sid:6005174; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (okzsah-38pd-jvw-wbsma4-pknr.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"okzsah-38pd-jvw-wbsma4-pknr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005175; classtype:social-engineering; sid:6005175; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (btrzp4a92vs-klmqwmja-2d5e0f-btq14c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"btrzp4a92vs-klmqwmja-2d5e0f-btq14c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005176; classtype:social-engineering; sid:6005176; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aerodromeresolve.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aerodromeresolve.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005177; classtype:social-engineering; sid:6005177; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-durex-biz8-folam-zirev.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-durex-biz8-folam-zirev.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005178; classtype:social-engineering; sid:6005178; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp3ct-zelvik-biz8-korsan-hudek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp3ct-zelvik-biz8-korsan-hudek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005179; classtype:social-engineering; sid:6005179; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-vafik-biz8-lurem-zosen.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-vafik-biz8-lurem-zosen.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005180; classtype:social-engineering; sid:6005180; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.globaldigital.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.globaldigital.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005181; classtype:social-engineering; sid:6005181; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-mardorin-biz8-lorex-dafik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-mardorin-biz8-lorex-dafik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005182; classtype:social-engineering; sid:6005182; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bankofamericamailcompte.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bankofamericamailcompte.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005183; classtype:social-engineering; sid:6005183; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (to3y14-az8mby-7xj-jjdu1-4pwix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"to3y14-az8mby-7xj-jjdu1-4pwix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005184; classtype:social-engineering; sid:6005184; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (other-help-488578.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"other-help-488578.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005185; classtype:social-engineering; sid:6005185; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marketingideal.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"marketingideal.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005186; classtype:social-engineering; sid:6005186; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lae47-z8x6u-m7z-yvde-ebp6.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lae47-z8x6u-m7z-yvde-ebp6.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005187; classtype:social-engineering; sid:6005187; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-wllt-io.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-wllt-io.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005188; classtype:social-engineering; sid:6005188; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-zedelivery24h.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-zedelivery24h.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005189; classtype:social-engineering; sid:6005189; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.my-info-irecover.com/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.my-info-irecover.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005190; classtype:social-engineering; sid:6005190; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shubhamsinha6244-hub.github.io/netfilx-clone/)"; flow:established,to_server; http.uri; content:"/netfilx-clone/"; startswith; fast_pattern; http.host; content:"shubhamsinha6244-hub.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005191; classtype:social-engineering; sid:6005191; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-clone-umber-five.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-umber-five.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005192; classtype:social-engineering; sid:6005192; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (parcel-globals-trackings.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"parcel-globals-trackings.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005193; classtype:social-engineering; sid:6005193; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.location-ios-find.us/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.location-ios-find.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005194; classtype:social-engineering; sid:6005194; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-xarvol-biz8-nurem-zalix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-xarvol-biz8-nurem-zalix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005195; classtype:social-engineering; sid:6005195; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creditopichincha-2026--credipichincha2.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"creditopichincha-2026--credipichincha2.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005196; classtype:social-engineering; sid:6005196; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (globaldigital.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"globaldigital.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005197; classtype:social-engineering; sid:6005197; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp3ct-morqas-biz8-telvik-hurem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp3ct-morqas-biz8-telvik-hurem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005198; classtype:social-engineering; sid:6005198; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.doc-aavmdlr.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.doc-aavmdlr.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005199; classtype:social-engineering; sid:6005199; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-zebebidass.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-zebebidass.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005200; classtype:social-engineering; sid:6005200; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prathamsquad18.github.io/Netflix-Clone-Webpage/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone-Webpage/"; startswith; fast_pattern; http.host; content:"prathamsquad18.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005201; classtype:social-engineering; sid:6005201; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp29ct-qelvik-biz-zarmel-hontak.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp29ct-qelvik-biz-zarmel-hontak.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005202; classtype:social-engineering; sid:6005202; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vormelo-gld-larqumi-r1q5dk63.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vormelo-gld-larqumi-r1q5dk63.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005203; classtype:social-engineering; sid:6005203; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stkl-f07ata-gsbmb-5ge3-oe4lgw.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"stkl-f07ata-gsbmb-5ge3-oe4lgw.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005204; classtype:social-engineering; sid:6005204; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-valem-biz8-lurek-fodin.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-valem-biz8-lurek-fodin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005205; classtype:social-engineering; sid:6005205; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortniter.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortniter.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005206; classtype:social-engineering; sid:6005206; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sympathetic-forms-118600.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sympathetic-forms-118600.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005207; classtype:social-engineering; sid:6005207; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-jurem-biz8-mafor-zilek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-jurem-biz8-mafor-zilek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005208; classtype:social-engineering; sid:6005208; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (quas7-qfv9-q26ep-h8p8h-vd2y7.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"quas7-qfv9-q26ep-h8p8h-vd2y7.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005209; classtype:social-engineering; sid:6005209; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brilliant-arithmetic-84258c.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"brilliant-arithmetic-84258c.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005210; classtype:social-engineering; sid:6005210; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp3ct-xorvak-biz8-turnel-qimor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp3ct-xorvak-biz8-turnel-qimor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005211; classtype:social-engineering; sid:6005211; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lxm0js-yvp-63kbp-v8ifyt-nv5b.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lxm0js-yvp-63kbp-v8ifyt-nv5b.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005212; classtype:social-engineering; sid:6005212; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lww-jslbt1-rvfpu-n36tl-w34k9r.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lww-jslbt1-rvfpu-n36tl-w34k9r.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005213; classtype:social-engineering; sid:6005213; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lovzy-daifuku-9b1d7c-ht1204g-b-2406vhw.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lovzy-daifuku-9b1d7c-ht1204g-b-2406vhw.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005214; classtype:social-engineering; sid:6005214; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-durex-biz8-folam-zirev-d6o.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-durex-biz8-folam-zirev-d6o.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005215; classtype:social-engineering; sid:6005215; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp3ct-karnel-biz8-volrik-fasen.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp3ct-karnel-biz8-volrik-fasen.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005216; classtype:social-engineering; sid:6005216; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pldwf2e18kq-mkrjbplos-9c0d7a-ltp18w.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pldwf2e18kq-mkrjbplos-9c0d7a-ltp18w.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005217; classtype:social-engineering; sid:6005217; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ehq2q1-uom2-v8a-ste-38j52p.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ehq2q1-uom2-v8a-ste-38j52p.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005218; classtype:social-engineering; sid:6005218; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp3ct-brenas-biz8-falqor-litem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp3ct-brenas-biz8-falqor-litem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005219; classtype:social-engineering; sid:6005219; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (majzstic-dout-8241f2-grb1204-bb-2406zcn.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"majzstic-dout-8241f2-grb1204-bb-2406zcn.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005220; classtype:social-engineering; sid:6005220; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vronz-vlypx-zclod-7e26cf-urkt-zorgon.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vronz-vlypx-zclod-7e26cf-urkt-zorgon.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005221; classtype:social-engineering; sid:6005221; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp3ct-nexqor-biz8-pardel-fusim.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp3ct-nexqor-biz8-pardel-fusim.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005222; classtype:social-engineering; sid:6005222; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-yarekon-biz8-lovik-farem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-yarekon-biz8-lovik-farem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005223; classtype:social-engineering; sid:6005223; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp3ct-borvik-biz8-hesnar-qifel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp3ct-borvik-biz8-hesnar-qifel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005224; classtype:social-engineering; sid:6005224; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.find-cioud-phone.us/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.find-cioud-phone.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005225; classtype:social-engineering; sid:6005225; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vxk5q-wh27-edjt-tz4xy3-1svhl4.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vxk5q-wh27-edjt-tz4xy3-1svhl4.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005226; classtype:social-engineering; sid:6005226; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m1c2c-iz1u08-9wq-n44v-fw8.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m1c2c-iz1u08-9wq-n44v-fw8.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005227; classtype:social-engineering; sid:6005227; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hkdo-eq8-snu-q2od2-cfz3-4seu6.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hkdo-eq8-snu-q2od2-cfz3-4seu6.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005228; classtype:social-engineering; sid:6005228; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (satander2026.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"satander2026.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005229; classtype:social-engineering; sid:6005229; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comgrats-for-invite-blue.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comgrats-for-invite-blue.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005230; classtype:social-engineering; sid:6005230; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (z4dw-4nio-cw5vf-z3p-kf4-rl7b6.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"z4dw-4nio-cw5vf-z3p-kf4-rl7b6.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005231; classtype:social-engineering; sid:6005231; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagramsnp.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagramsnp.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005232; classtype:social-engineering; sid:6005232; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lcs5-7bfe-tji-4o5-04nrzp.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lcs5-7bfe-tji-4o5-04nrzp.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005233; classtype:social-engineering; sid:6005233; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (owxc2v-vb5u2-yupgq-zmft0g.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"owxc2v-vb5u2-yupgq-zmft0g.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005234; classtype:social-engineering; sid:6005234; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (k1ppj0-hzup-5cka2p-ym5k4.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"k1ppj0-hzup-5cka2p-ym5k4.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005235; classtype:social-engineering; sid:6005235; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpa-s8jh-i4mv4t-uhc-xawm6p.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dpa-s8jh-i4mv4t-uhc-xawm6p.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005236; classtype:social-engineering; sid:6005236; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (syzmm-y1z-9os6ik-d81n-9hu0w.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"syzmm-y1z-9os6ik-d81n-9hu0w.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005237; classtype:social-engineering; sid:6005237; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.icloud-zr.com/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.icloud-zr.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005238; classtype:social-engineering; sid:6005238; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yimqj-bqo-w75-5qug-7u11vw.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yimqj-bqo-w75-5qug-7u11vw.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005239; classtype:social-engineering; sid:6005239; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp7ct-jorqal-biz8-mesnor-plavik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp7ct-jorqal-biz8-mesnor-plavik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005240; classtype:social-engineering; sid:6005240; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cal0f-zz3-8vfq4-33xph-faryd.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cal0f-zz3-8vfq4-33xph-faryd.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005241; classtype:social-engineering; sid:6005241; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-register.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"instagram-register.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005242; classtype:social-engineering; sid:6005242; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ei641-w9db-l5dq-2s2q8v-prkum.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ei641-w9db-l5dq-2s2q8v-prkum.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005243; classtype:social-engineering; sid:6005243; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-info-irecover.com/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"my-info-irecover.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005244; classtype:social-engineering; sid:6005244; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (l-lcloud-com.site/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"l-lcloud-com.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005245; classtype:social-engineering; sid:6005245; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ca787478.tw1.ru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ca787478.tw1.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005246; classtype:social-engineering; sid:6005246; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.logs-inky-alpha.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.logs-inky-alpha.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005247; classtype:social-engineering; sid:6005247; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lnk.ink/robIox.com.users-35149531842.profile)"; flow:established,to_server; http.uri; content:"/robIox.com.users-35149531842.profile"; startswith; fast_pattern; http.host; content:"lnk.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005248; classtype:social-engineering; sid:6005248; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lr1z9-zlym-pkl-8ghy-slusx.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lr1z9-zlym-pkl-8ghy-slusx.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005249; classtype:social-engineering; sid:6005249; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.metamask-docs-git-request-execution-p-73cacd-consensys-ddffed67.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.metamask-docs-git-request-execution-p-73cacd-consensys-ddffed67.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005250; classtype:social-engineering; sid:6005250; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bigshopee26.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bigshopee26.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005251; classtype:social-engineering; sid:6005251; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s4w.in/https-www-roblox-com-users-1689710508-profile)"; flow:established,to_server; http.uri; content:"/https-www-roblox-com-users-1689710508-profile"; startswith; fast_pattern; http.host; content:"s4w.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005252; classtype:social-engineering; sid:6005252; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (phone-lcloud.site/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"phone-lcloud.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005253; classtype:social-engineering; sid:6005253; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-qelmorin-biz8-lorem-zafun.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-qelmorin-biz8-lorem-zafun.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005254; classtype:social-engineering; sid:6005254; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hpf1r8-yjwemc-wu9fk-oji-6ue.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hpf1r8-yjwemc-wu9fk-oji-6ue.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005255; classtype:social-engineering; sid:6005255; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pvga-gxj-udc5-q2y-wxaa0-8ud.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pvga-gxj-udc5-q2y-wxaa0-8ud.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005256; classtype:social-engineering; sid:6005256; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ewxexewx.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ewxexewx.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005257; classtype:social-engineering; sid:6005257; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zcw6-0pl-8keetw-813mpj-fk9.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zcw6-0pl-8keetw-813mpj-fk9.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005258; classtype:social-engineering; sid:6005258; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-curex-biz8-lomar-vesik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-curex-biz8-lomar-vesik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005259; classtype:social-engineering; sid:6005259; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sxyc9-ngu-j0jq10-1qz9-d1u.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sxyc9-ngu-j0jq10-1qz9-d1u.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005260; classtype:social-engineering; sid:6005260; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (startemseulimite.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"startemseulimite.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005261; classtype:social-engineering; sid:6005261; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp3ct-helvok-biz8-prasik-dunor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp3ct-helvok-biz8-prasik-dunor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005262; classtype:social-engineering; sid:6005262; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp3ct-lasqen-biz8-horvak-pirel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp3ct-lasqen-biz8-horvak-pirel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005263; classtype:social-engineering; sid:6005263; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.item.ehay.com.login.secures-wr8wsvzt.construccionesjlfabririssas.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.item.ehay.com.login.secures-wr8wsvzt.construccionesjlfabririssas.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005264; classtype:social-engineering; sid:6005264; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hgser.closer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hgser.closer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005265; classtype:social-engineering; sid:6005265; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hskm0-4ptyr-02ic-ftes5-6ra.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hskm0-4ptyr-02ic-ftes5-6ra.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005266; classtype:social-engineering; sid:6005266; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oyhzy-v6kvlc-hu74-6tuh-gvo.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"oyhzy-v6kvlc-hu74-6tuh-gvo.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005267; classtype:social-engineering; sid:6005267; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zeexpress-oficial.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zeexpress-oficial.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005268; classtype:social-engineering; sid:6005268; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-mx.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-mx.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005269; classtype:social-engineering; sid:6005269; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hz9-b1mk-5eg61-j7myx-j7e1nq.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hz9-b1mk-5eg61-j7myx-j7e1nq.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005270; classtype:social-engineering; sid:6005270; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.onlinebankofamerica.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login.onlinebankofamerica.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005271; classtype:social-engineering; sid:6005271; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-corem-biz8-zuram-lifek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-corem-biz8-zuram-lifek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005272; classtype:social-engineering; sid:6005272; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp3ct-yolqik-biz8-dersan-furem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp3ct-yolqik-biz8-dersan-furem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005273; classtype:social-engineering; sid:6005273; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (greatislamicscholars.com/wp-admin/user/admin/js/)"; flow:established,to_server; http.uri; content:"/wp-admin/user/admin/js/"; startswith; fast_pattern; http.host; content:"greatislamicscholars.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005274; classtype:social-engineering; sid:6005274; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2017.peterboonen.be/images/qyxmwzh/ebcfthq/aujdnpi/otslm/loginn.html)"; flow:established,to_server; http.uri; content:"/images/qyxmwzh/ebcfthq/aujdnpi/otslm/loginn.html"; startswith; fast_pattern; http.host; content:"2017.peterboonen.be"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005275; classtype:social-engineering; sid:6005275; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (irrelevant-amethyst-kkwymbkj.edgeone.dev/home)"; flow:established,to_server; http.uri; content:"/home"; startswith; fast_pattern; http.host; content:"irrelevant-amethyst-kkwymbkj.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005276; classtype:social-engineering; sid:6005276; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookloginnp.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"facebookloginnp.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005277; classtype:social-engineering; sid:6005277; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (w009zi-dc67dx-ssl-rz5-tvygz3.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"w009zi-dc67dx-ssl-rz5-tvygz3.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005278; classtype:social-engineering; sid:6005278; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-iapple-located.com/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"my-iapple-located.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005279; classtype:social-engineering; sid:6005279; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yfhcn445nh-xkvdjlpw-1b1a8d-yfh50c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yfhcn445nh-xkvdjlpw-1b1a8d-yfh50c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005280; classtype:social-engineering; sid:6005280; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (doc-aavmdlr.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"doc-aavmdlr.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005281; classtype:social-engineering; sid:6005281; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-nalem-biz8-murek-lovin.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-nalem-biz8-murek-lovin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005282; classtype:social-engineering; sid:6005282; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dravexa-kig-larquna-c5t6hp97.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dravexa-kig-larquna-c5t6hp97.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005283; classtype:social-engineering; sid:6005283; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-jurek-biz8-lovek-mazin.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-jurek-biz8-lovek-mazin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005284; classtype:social-engineering; sid:6005284; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xkjgjv-gfhr7-03o-wrg71u-k8xoa.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xkjgjv-gfhr7-03o-wrg71u-k8xoa.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005285; classtype:social-engineering; sid:6005285; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ciyg-odkrkz-d7eer-jgjybd.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ciyg-odkrkz-d7eer-jgjybd.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005286; classtype:social-engineering; sid:6005286; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-zeexpresss24h.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-zeexpresss24h.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005287; classtype:social-engineering; sid:6005287; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (l6t-0at-1fguw6-hfo67-hy9.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"l6t-0at-1fguw6-hfo67-hy9.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005288; classtype:social-engineering; sid:6005288; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.ifind-maps-recover.com/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.ifind-maps-recover.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005289; classtype:social-engineering; sid:6005289; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.fy-iapple-alert.com/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.fy-iapple-alert.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005290; classtype:social-engineering; sid:6005290; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp29ct-lavqen-biz-forsik-merkal.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp29ct-lavqen-biz-forsik-merkal.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005291; classtype:social-engineering; sid:6005291; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dextestresolve-2qe.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dextestresolve-2qe.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005292; classtype:social-engineering; sid:6005292; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c9ah9-zih-co3f-cmfeam-cwdtk.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c9ah9-zih-co3f-cmfeam-cwdtk.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005293; classtype:social-engineering; sid:6005293; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uphuld-walet-eng.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uphuld-walet-eng.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005294; classtype:social-engineering; sid:6005294; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.2025-beta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.2025-beta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005295; classtype:social-engineering; sid:6005295; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (q83m-gtxu-596487-k3tr3-44gbd.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"q83m-gtxu-596487-k3tr3-44gbd.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005296; classtype:social-engineering; sid:6005296; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail-shaws-logins-s-zimbra.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webmail-shaws-logins-s-zimbra.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005297; classtype:social-engineering; sid:6005297; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (recover-phone.sbs/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"recover-phone.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005298; classtype:social-engineering; sid:6005298; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (localizar-mi-lphone.life/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"localizar-mi-lphone.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005299; classtype:social-engineering; sid:6005299; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.recover-phone.sbs/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.recover-phone.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005300; classtype:social-engineering; sid:6005300; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-gorev-biz8-murep-zalin.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-gorev-biz8-murep-zalin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005301; classtype:social-engineering; sid:6005301; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sea-turtle-app-dk9tf.ondigitalocean.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sea-turtle-app-dk9tf.ondigitalocean.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005302; classtype:social-engineering; sid:6005302; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x2ae7-m5q0t1-9kz-cxdn6p-zgi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"x2ae7-m5q0t1-9kz-cxdn6p-zgi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005303; classtype:social-engineering; sid:6005303; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (phone-cloud.site/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"phone-cloud.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005304; classtype:social-engineering; sid:6005304; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-curev-biz8-fazom-lirep.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-curev-biz8-fazom-lirep.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005305; classtype:social-engineering; sid:6005305; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dravixa-gld-lormeta-r2v6hq39.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dravixa-gld-lormeta-r2v6hq39.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005306; classtype:social-engineering; sid:6005306; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-lendor-biz-kazvik-pronsel.pages.dev/rtyu-iopj-qewr-thjm?welcome=870183689516134&idnp=870183689516134&name_idnp=Arumi%20Companions)"; flow:established,to_server; http.uri; content:"/rtyu-iopj-qewr-thjm?welcome=870183689516134&idnp=870183689516134&name_idnp=Arumi%20Companions"; startswith; fast_pattern; http.host; content:"sp12ct-lendor-biz-kazvik-pronsel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005307; classtype:social-engineering; sid:6005307; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ojxp-p7ls-o9cks-akvlyx-yd3kr.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ojxp-p7ls-o9cks-akvlyx-yd3kr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005308; classtype:social-engineering; sid:6005308; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f1jphe-yotvb-d2d-rpsum-wsoo.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f1jphe-yotvb-d2d-rpsum-wsoo.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005309; classtype:social-engineering; sid:6005309; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-us-ledgive.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en-us-ledgive.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005310; classtype:social-engineering; sid:6005310; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (capacitynubankwithdrawal-limits.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"capacitynubankwithdrawal-limits.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005311; classtype:social-engineering; sid:6005311; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zqhi-vyu-excih-7eg-mgsubs.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zqhi-vyu-excih-7eg-mgsubs.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005312; classtype:social-engineering; sid:6005312; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t5d8e-qjh-ate9-1z9omv-a4px.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"t5d8e-qjh-ate9-1z9omv-a4px.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005313; classtype:social-engineering; sid:6005313; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bntp374x-yfhcn39zfn-5e8a-wjr73k.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bntp374x-yfhcn39zfn-5e8a-wjr73k.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005314; classtype:social-engineering; sid:6005314; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bet365nz-net.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bet365nz-net.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005315; classtype:social-engineering; sid:6005315; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ojt-zp3-habj2-30d-vve-nrqd.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ojt-zp3-habj2-30d-vve-nrqd.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005316; classtype:social-engineering; sid:6005316; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hammerhead-app-ub55h.ondigitalocean.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hammerhead-app-ub55h.ondigitalocean.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005317; classtype:social-engineering; sid:6005317; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.rom2-nine.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.rom2-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005318; classtype:social-engineering; sid:6005318; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mb8905-vxepq9-uz89o-d2j-pbv.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mb8905-vxepq9-uz89o-d2j-pbv.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005319; classtype:social-engineering; sid:6005319; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gor2rw-0qb2r7-4k4mx-x5xr.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gor2rw-0qb2r7-4k4mx-x5xr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005320; classtype:social-engineering; sid:6005320; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kvrraviteja.github.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kvrraviteja.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005321; classtype:social-engineering; sid:6005321; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.react-whatsapp-clone-ten.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.react-whatsapp-clone-ten.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005322; classtype:social-engineering; sid:6005322; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whatsapp-correo.webcindario.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsapp-correo.webcindario.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005323; classtype:social-engineering; sid:6005323; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h1nxr-hv5cg4-pgu-w47lb-rq5r0a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"h1nxr-hv5cg4-pgu-w47lb-rq5r0a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005324; classtype:social-engineering; sid:6005324; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vxxqbm-a5zc-p1r-vhiuwt-5es278.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vxxqbm-a5zc-p1r-vhiuwt-5es278.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005325; classtype:social-engineering; sid:6005325; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (heliusonbaording.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"heliusonbaording.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005326; classtype:social-engineering; sid:6005326; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-ledgrwalite.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en-ledgrwalite.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005327; classtype:social-engineering; sid:6005327; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-jurel-biz8-darev-fosin.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-jurel-biz8-darev-fosin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005328; classtype:social-engineering; sid:6005328; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-nurev-biz8-lokam-fires.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-nurev-biz8-lokam-fires.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005329; classtype:social-engineering; sid:6005329; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.phone-cloud.site/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.phone-cloud.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005330; classtype:social-engineering; sid:6005330; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp29ct-lorqik-biz-femtor-varnel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp29ct-lorqik-biz-femtor-varnel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005331; classtype:social-engineering; sid:6005331; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vormelu-gld-belquro-r5m3dw41.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vormelu-gld-belquro-r5m3dw41.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005332; classtype:social-engineering; sid:6005332; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fy-iapple-alert.com/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"fy-iapple-alert.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005333; classtype:social-engineering; sid:6005333; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.l-lcloud-com.site/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.l-lcloud-com.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005334; classtype:social-engineering; sid:6005334; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-curek-biz8-farem-lovin.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-curek-biz8-farem-lovin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005335; classtype:social-engineering; sid:6005335; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xelquro-gld-zarmita-c7m4hp68.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xelquro-gld-zarmita-c7m4hp68.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005336; classtype:social-engineering; sid:6005336; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pl6c-wbak2s-kkff8e-rllgwp.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pl6c-wbak2s-kkff8e-rllgwp.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005337; classtype:social-engineering; sid:6005337; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp3ct-vesnak-biz8-kolqer-lidun.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp3ct-vesnak-biz8-kolqer-lidun.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005338; classtype:social-engineering; sid:6005338; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-furex-biz8-lozam-kirel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-furex-biz8-lozam-kirel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005339; classtype:social-engineering; sid:6005339; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paperlesspost-partymonica.velnora.vu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paperlesspost-partymonica.velnora.vu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005340; classtype:social-engineering; sid:6005340; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ks0-s66ao-s2mp68-zl4-yjw98p.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ks0-s66ao-s2mp68-zl4-yjw98p.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005341; classtype:social-engineering; sid:6005341; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (o4ge-a907i-v5ftua-807v-s1law.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"o4ge-a907i-v5ftua-807v-s1law.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005342; classtype:social-engineering; sid:6005342; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xin3vs-1nm-o0fae8-bbua80.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xin3vs-1nm-o0fae8-bbua80.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005343; classtype:social-engineering; sid:6005343; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oauth.onedrive.biz.id/v3/signin/identifier?continue=https%3A%2F%2Fmail.google.com%2Fmail%2F&followup=https%3A%2F%2Fmail.google.com%2Fmail%2F&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin)"; flow:established,to_server; http.uri; content:"/v3/signin/identifier?continue=https%3A%2F%2Fmail.google.com%2Fmail%2F&followup=https%3A%2F%2Fmail.google.com%2Fmail%2F&passive=1209600&flowName=GlifWebSignIn&flowEntry=ServiceLogin"; startswith; fast_pattern; http.host; content:"oauth.onedrive.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005344; classtype:social-engineering; sid:6005344; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ciaz8h-8njujr-xch4l-nr1b.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ciaz8h-8njujr-xch4l-nr1b.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005345; classtype:social-engineering; sid:6005345; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.chat.ring-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.chat.ring-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005346; classtype:social-engineering; sid:6005346; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (location-ios-find.us/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"location-ios-find.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005347; classtype:social-engineering; sid:6005347; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.linktr.ee/arhuxtable2/)"; flow:established,to_server; http.uri; content:"/arhuxtable2/"; startswith; fast_pattern; http.host; content:"www.linktr.ee"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005348; classtype:social-engineering; sid:6005348; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ldgr-secure-live.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ldgr-secure-live.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005349; classtype:social-engineering; sid:6005349; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp3ct-purnel-biz8-falqor-mivan.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp3ct-purnel-biz8-falqor-mivan.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005350; classtype:social-engineering; sid:6005350; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xelzavi-kig-fentora-c7x2fc45.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xelzavi-kig-fentora-c7x2fc45.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005351; classtype:social-engineering; sid:6005351; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.free-sign-bluemark-now.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.free-sign-bluemark-now.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005352; classtype:social-engineering; sid:6005352; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp3ct-drelok-biz8-havqen-misur.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp3ct-drelok-biz8-havqen-misur.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005353; classtype:social-engineering; sid:6005353; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (menatextiles.com/tryharder/)"; flow:established,to_server; http.uri; content:"/tryharder/"; startswith; fast_pattern; http.host; content:"menatextiles.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005354; classtype:social-engineering; sid:6005354; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.encontrar-lphone.top/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.encontrar-lphone.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005355; classtype:social-engineering; sid:6005355; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cytheraonline.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cytheraonline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005356; classtype:social-engineering; sid:6005356; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebooklogin19.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebooklogin19.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005357; classtype:social-engineering; sid:6005357; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mjf3-7m1q-k1g77-pi2vn6-gshs.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mjf3-7m1q-k1g77-pi2vn6-gshs.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005358; classtype:social-engineering; sid:6005358; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (we4-n716e-5nijgj-am73-8dh.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"we4-n716e-5nijgj-am73-8dh.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005359; classtype:social-engineering; sid:6005359; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (y54s8p-er2-rdlrnt-xivf-jk00.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"y54s8p-er2-rdlrnt-xivf-jk00.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005360; classtype:social-engineering; sid:6005360; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p4xv-w9h1c-t29435-r6t6u-f5ubzc.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p4xv-w9h1c-t29435-r6t6u-f5ubzc.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005361; classtype:social-engineering; sid:6005361; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (find-cioud-phone.us/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"find-cioud-phone.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005362; classtype:social-engineering; sid:6005362; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hk4-7h3cx-xqhoa-e2b-q0s-s320.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hk4-7h3cx-xqhoa-e2b-q0s-s320.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005363; classtype:social-engineering; sid:6005363; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cocfz-9ek-9k3-c6k7b-q7bcw.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cocfz-9ek-9k3-c6k7b-q7bcw.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005364; classtype:social-engineering; sid:6005364; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (of1-qdb1-pfscbe-m6zk-zlgxtb.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"of1-qdb1-pfscbe-m6zk-zlgxtb.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005365; classtype:social-engineering; sid:6005365; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.localizar-mi-lphone.life/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.localizar-mi-lphone.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005366; classtype:social-engineering; sid:6005366; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (w10-2abw-8hgms-ndt-95c-z1m.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"w10-2abw-8hgms-ndt-95c-z1m.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005367; classtype:social-engineering; sid:6005367; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-zebebidas24h.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-zebebidas24h.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005368; classtype:social-engineering; sid:6005368; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qernelo-gld-lormavi-a2k3dw79.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qernelo-gld-lormavi-a2k3dw79.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005369; classtype:social-engineering; sid:6005369; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ggee-har6b-ty1p6s-539xis.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ggee-har6b-ty1p6s-539xis.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005370; classtype:social-engineering; sid:6005370; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ntn2so-xdbdw-ruz8b6-xw4j.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ntn2so-xdbdw-ruz8b6-xw4j.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005371; classtype:social-engineering; sid:6005371; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x6j-8qxax-fi2yqg-sybxrp-l2mkkr.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"x6j-8qxax-fi2yqg-sybxrp-l2mkkr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005372; classtype:social-engineering; sid:6005372; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.parcel-globals-trackings.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.parcel-globals-trackings.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005373; classtype:social-engineering; sid:6005373; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zedeliverys-express.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zedeliverys-express.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005374; classtype:social-engineering; sid:6005374; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telmora-gld-felquza-r6t3hq98.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telmora-gld-felquza-r6t3hq98.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005375; classtype:social-engineering; sid:6005375; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-gurem-biz8-movel-kasin.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-gurem-biz8-movel-kasin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005376; classtype:social-engineering; sid:6005376; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-ralom-biz8-kurem-fasel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-ralom-biz8-kurem-fasel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005377; classtype:social-engineering; sid:6005377; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zeexpress-48h.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zeexpress-48h.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005378; classtype:social-engineering; sid:6005378; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-kersol-biz-vandik-frolen.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-kersol-biz-vandik-frolen.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005379; classtype:social-engineering; sid:6005379; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (njbp7-7m4vn4-2wg-4hnj-pldu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"njbp7-7m4vn4-2wg-4hnj-pldu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005380; classtype:social-engineering; sid:6005380; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinbase-invest--camrongraves4.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coinbase-invest--camrongraves4.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005381; classtype:social-engineering; sid:6005381; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp29ct-kalvik-biz-femtor-hansel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp29ct-kalvik-biz-femtor-hansel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005382; classtype:social-engineering; sid:6005382; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (l6yw-h5x-mzrx-uono-j6nf-hef802.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"l6yw-h5x-mzrx-uono-j6nf-hef802.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005383; classtype:social-engineering; sid:6005383; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.alula-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.alula-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005384; classtype:social-engineering; sid:6005384; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (banhcafe4.github.io/hablameeee/)"; flow:established,to_server; http.uri; content:"/hablameeee/"; startswith; fast_pattern; http.host; content:"banhcafe4.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005385; classtype:social-engineering; sid:6005385; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (devrakibulrahman.github.io/facebook-login-clone/)"; flow:established,to_server; http.uri; content:"/facebook-login-clone/"; startswith; fast_pattern; http.host; content:"devrakibulrahman.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005386; classtype:social-engineering; sid:6005386; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (o2wz-eis-jtnm-4cc-4on-k09w.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"o2wz-eis-jtnm-4cc-4on-k09w.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005387; classtype:social-engineering; sid:6005387; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (live-leedgers-un-en.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"live-leedgers-un-en.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005388; classtype:social-engineering; sid:6005388; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-orvakon-biz8-larem-dusik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-orvakon-biz8-larem-dusik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005389; classtype:social-engineering; sid:6005389; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.get-all-information-for-blue.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.get-all-information-for-blue.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005390; classtype:social-engineering; sid:6005390; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.expressshoppers.co.uk/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login.expressshoppers.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005391; classtype:social-engineering; sid:6005391; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ing-gray.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ing-gray.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005392; classtype:social-engineering; sid:6005392; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ms22r-2xm-jsd9-kfbcg-cjhc2.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ms22r-2xm-jsd9-kfbcg-cjhc2.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005393; classtype:social-engineering; sid:6005393; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (travixa-gld-zarquni-r6m7hp15.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"travixa-gld-zarquni-r6m7hp15.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005394; classtype:social-engineering; sid:6005394; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f6o4cs-g38-1yho-ryv6-c06dmn.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f6o4cs-g38-1yho-ryv6-c06dmn.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005395; classtype:social-engineering; sid:6005395; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mxy090-i6zaj-2y5-t3vwhy-qq5n.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mxy090-i6zaj-2y5-t3vwhy-qq5n.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005396; classtype:social-engineering; sid:6005396; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (w70m-7qt-p4i-3w6ywy-id9ax2.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"w70m-7qt-p4i-3w6ywy-id9ax2.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005397; classtype:social-engineering; sid:6005397; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wbple7-1gv-jsg-gujo3-b4nr.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wbple7-1gv-jsg-gujo3-b4nr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005398; classtype:social-engineering; sid:6005398; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.eu-facebook.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.eu-facebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005399; classtype:social-engineering; sid:6005399; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tikshop.xin/h5/)"; flow:established,to_server; http.uri; content:"/h5/"; startswith; fast_pattern; http.host; content:"tikshop.xin"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005400; classtype:social-engineering; sid:6005400; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-purem-biz8-korep-dazin.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-purem-biz8-korep-dazin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005401; classtype:social-engineering; sid:6005401; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tr-binancelogin.com/tr/auth)"; flow:established,to_server; http.uri; content:"/tr/auth"; startswith; fast_pattern; http.host; content:"tr-binancelogin.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005402; classtype:social-engineering; sid:6005402; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.compelete-verified-blue.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.compelete-verified-blue.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005403; classtype:social-engineering; sid:6005403; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tda2-9n9kv-a9q3-02ndsp-ohzc.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tda2-9n9kv-a9q3-02ndsp-ohzc.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005404; classtype:social-engineering; sid:6005404; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kg7y1y-espj1w-u0w-egt-vy4y5.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kg7y1y-espj1w-u0w-egt-vy4y5.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005405; classtype:social-engineering; sid:6005405; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qrate.africa/en/webm/#tech@namecheaphosting.com)"; flow:established,to_server; http.uri; content:"/en/webm/#tech@namecheaphosting.com"; startswith; fast_pattern; http.host; content:"qrate.africa"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005406; classtype:social-engineering; sid:6005406; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6740bet.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6740bet.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005407; classtype:social-engineering; sid:6005407; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.allegrolokalnie.pl-5891795691.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.allegrolokalnie.pl-5891795691.sbs"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005408; classtype:social-engineering; sid:6005408; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.factura-confirmacion.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.factura-confirmacion.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005409; classtype:social-engineering; sid:6005409; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.monaccmonthly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.monaccmonthly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005410; classtype:social-engineering; sid:6005410; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mvm-nexthu.com/captcha)"; flow:established,to_server; http.uri; content:"/captcha"; startswith; fast_pattern; http.host; content:"mvm-nexthu.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005411; classtype:social-engineering; sid:6005411; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwwcashapppaymentonline.bn1i2.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wwwcashapppaymentonline.bn1i2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005412; classtype:social-engineering; sid:6005412; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (muf-52356.bubbleapps.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"muf-52356.bubbleapps.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005413; classtype:social-engineering; sid:6005413; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.doc-ythvvbc.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.doc-ythvvbc.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005414; classtype:social-engineering; sid:6005414; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bq3awf-4by1dk-7n7u-i4n9-p32gxm.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bq3awf-4by1dk-7n7u-i4n9-p32gxm.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005415; classtype:social-engineering; sid:6005415; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eng-en-trxrsuite.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eng-en-trxrsuite.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005416; classtype:social-engineering; sid:6005416; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (get-information-blue-badge.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"get-information-blue-badge.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005417; classtype:social-engineering; sid:6005417; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freeinstagramfollowersherenow.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"freeinstagramfollowersherenow.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005418; classtype:social-engineering; sid:6005418; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hubcert.com.br/owa.auth.logon.aspx/)"; flow:established,to_server; http.uri; content:"/owa.auth.logon.aspx/"; startswith; fast_pattern; http.host; content:"www.hubcert.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005419; classtype:social-engineering; sid:6005419; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-secure-live.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-secure-live.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005420; classtype:social-engineering; sid:6005420; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-page-builder--gregweirconcret.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-page-builder--gregweirconcret.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005421; classtype:social-engineering; sid:6005421; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi-34.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi-34.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005422; classtype:social-engineering; sid:6005422; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loginfacebook31.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"loginfacebook31.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005423; classtype:social-engineering; sid:6005423; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cancelarcardiffbncolb360.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cancelarcardiffbncolb360.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005424; classtype:social-engineering; sid:6005424; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (augmentse.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"augmentse.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005425; classtype:social-engineering; sid:6005425; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wellsfraudsupport.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wellsfraudsupport.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005426; classtype:social-engineering; sid:6005426; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gau80rav-9155.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"gau80rav-9155.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005427; classtype:social-engineering; sid:6005427; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (saiffarid-dev.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"saiffarid-dev.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005428; classtype:social-engineering; sid:6005428; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lofzsm.wittenbornplasticsurgery.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lofzsm.wittenbornplasticsurgery.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005429; classtype:social-engineering; sid:6005429; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.vvbattambanghotel.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.vvbattambanghotel.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005430; classtype:social-engineering; sid:6005430; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ik2npu-rez-7hrh-1db8wd-0dg.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ik2npu-rez-7hrh-1db8wd-0dg.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005431; classtype:social-engineering; sid:6005431; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram.webpromotion-business.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram.webpromotion-business.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005432; classtype:social-engineering; sid:6005432; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (menu-aktivasi-laterid.offcou.beauty/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"menu-aktivasi-laterid.offcou.beauty"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005433; classtype:social-engineering; sid:6005433; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagramprofilelinks.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagramprofilelinks.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005434; classtype:social-engineering; sid:6005434; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.z-facebook.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.z-facebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005435; classtype:social-engineering; sid:6005435; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imootken.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"imootken.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005436; classtype:social-engineering; sid:6005436; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pos.augmentse.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pos.augmentse.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005437; classtype:social-engineering; sid:6005437; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-b778210b76e7433886ec399564e5d4a5.r2.dev/0-0-index-yahoo%20mine.html)"; flow:established,to_server; http.uri; content:"/0-0-index-yahoo%20mine.html"; startswith; fast_pattern; http.host; content:"pub-b778210b76e7433886ec399564e5d4a5.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005438; classtype:social-engineering; sid:6005438; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clarityjpoint.info/Y2gtZmVkZXgtMjAyNg/)"; flow:established,to_server; http.uri; content:"/Y2gtZmVkZXgtMjAyNg/"; startswith; fast_pattern; http.host; content:"clarityjpoint.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005439; classtype:social-engineering; sid:6005439; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp3ct-farnik-biz8-zelqor-mudor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp3ct-farnik-biz8-zelqor-mudor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005440; classtype:social-engineering; sid:6005440; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dweb.link/ipfs/QmQoz7JmtWNhGvdCM3XJ7zT8ULhHiRTN2YUKtuj1DEF82U/)"; flow:established,to_server; http.uri; content:"/ipfs/QmQoz7JmtWNhGvdCM3XJ7zT8ULhHiRTN2YUKtuj1DEF82U/"; startswith; fast_pattern; http.host; content:"dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005441; classtype:social-engineering; sid:6005441; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (muhammadabdulhamimnahidxy-code.github.io/Mylink/)"; flow:established,to_server; http.uri; content:"/Mylink/"; startswith; fast_pattern; http.host; content:"muhammadabdulhamimnahidxy-code.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005442; classtype:social-engineering; sid:6005442; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.permanent-verified-blue-tick.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.permanent-verified-blue-tick.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005443; classtype:social-engineering; sid:6005443; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-corlen-biz8-farix-novel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-corlen-biz8-farix-novel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005444; classtype:social-engineering; sid:6005444; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kldzp3d82pl-sfmgbyhy-3c8d5e-vq701a.pages.dev/welcome_aboard?welcome=1000055790630960&token248=1000055790630960&name_token136=Harden%20Offroad)"; flow:established,to_server; http.uri; content:"/welcome_aboard?welcome=1000055790630960&token248=1000055790630960&name_token136=Harden%20Offroad"; startswith; fast_pattern; http.host; content:"kldzp3d82pl-sfmgbyhy-3c8d5e-vq701a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005445; classtype:social-engineering; sid:6005445; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (msxlkjis.us.cc/5g/home.html)"; flow:established,to_server; http.uri; content:"/5g/home.html"; startswith; fast_pattern; http.host; content:"msxlkjis.us.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005446; classtype:social-engineering; sid:6005446; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ramadhan-shop25.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ramadhan-shop25.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005447; classtype:social-engineering; sid:6005447; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.blue-badge-instant-apply.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.blue-badge-instant-apply.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005448; classtype:social-engineering; sid:6005448; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zn-chat-whatapps.hi.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zn-chat-whatapps.hi.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005449; classtype:social-engineering; sid:6005449; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jiya-byte.github.io/insta-clone)"; flow:established,to_server; http.uri; content:"/insta-clone"; startswith; fast_pattern; http.host; content:"jiya-byte.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005450; classtype:social-engineering; sid:6005450; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezr-secure-suite.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezr-secure-suite.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005451; classtype:social-engineering; sid:6005451; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (836sp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"836sp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005452; classtype:social-engineering; sid:6005452; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fidelityan.cyou/1rjxx4/page.html)"; flow:established,to_server; http.uri; content:"/1rjxx4/page.html"; startswith; fast_pattern; http.host; content:"fidelityan.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005453; classtype:social-engineering; sid:6005453; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ehall.it.it.m.sonicmenusprices.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ehall.it.it.m.sonicmenusprices.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005454; classtype:social-engineering; sid:6005454; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (compliance.it-communications.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"compliance.it-communications.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005455; classtype:social-engineering; sid:6005455; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (midasbuys.mobileaccesx-events.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"midasbuys.mobileaccesx-events.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005456; classtype:social-engineering; sid:6005456; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-wallet-app-xxa8.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-wallet-app-xxa8.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005457; classtype:social-engineering; sid:6005457; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fide1iltyo.cyou/k1fnjm/page.html)"; flow:established,to_server; http.uri; content:"/k1fnjm/page.html"; startswith; fast_pattern; http.host; content:"fide1iltyo.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005458; classtype:social-engineering; sid:6005458; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (athensdotshop.com/Korea.html)"; flow:established,to_server; http.uri; content:"/Korea.html"; startswith; fast_pattern; http.host; content:"athensdotshop.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005459; classtype:social-engineering; sid:6005459; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (melltnnhk-wollet.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"melltnnhk-wollet.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005460; classtype:social-engineering; sid:6005460; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp.nm.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp.nm.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005461; classtype:social-engineering; sid:6005461; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wa.comm-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wa.comm-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005462; classtype:social-engineering; sid:6005462; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zimbplaauy.s3-website.fr-par.scw.cloud/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zimbplaauy.s3-website.fr-par.scw.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005463; classtype:social-engineering; sid:6005463; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (financiamentositau.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"financiamentositau.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005464; classtype:social-engineering; sid:6005464; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shop.midasbuygames.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shop.midasbuygames.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005465; classtype:social-engineering; sid:6005465; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (airbnbs-clone.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"airbnbs-clone.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005466; classtype:social-engineering; sid:6005466; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct-kovel-biz8-furem-sarin.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct-kovel-biz8-furem-sarin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005467; classtype:social-engineering; sid:6005467; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4971-nj3.sumsubio.com/sumsub2)"; flow:established,to_server; http.uri; content:"/sumsub2"; startswith; fast_pattern; http.host; content:"4971-nj3.sumsubio.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005468; classtype:social-engineering; sid:6005468; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nitinyadav726.github.io/image/)"; flow:established,to_server; http.uri; content:"/image/"; startswith; fast_pattern; http.host; content:"nitinyadav726.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005469; classtype:social-engineering; sid:6005469; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fide1iltyp.cyou/izbkfxy?kyw=bRIMFy)"; flow:established,to_server; http.uri; content:"/izbkfxy?kyw=bRIMFy"; startswith; fast_pattern; http.host; content:"fide1iltyp.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005470; classtype:social-engineering; sid:6005470; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.submit-application.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.submit-application.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005471; classtype:social-engineering; sid:6005471; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (followers-increase-instagram.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"followers-increase-instagram.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005472; classtype:social-engineering; sid:6005472; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (standardsecurity.co.za/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"standardsecurity.co.za"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005473; classtype:social-engineering; sid:6005473; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pt-shopee5315.blogspot.com/?m=1/)"; flow:established,to_server; http.uri; content:"/?m=1/"; startswith; fast_pattern; http.host; content:"pt-shopee5315.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005474; classtype:social-engineering; sid:6005474; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cancelarcardiffbncolb360.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cancelarcardiffbncolb360.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005475; classtype:social-engineering; sid:6005475; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecossistemadeoportunidades.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"ecossistemadeoportunidades.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005476; classtype:social-engineering; sid:6005476; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bmqbeauty.com.br/eSignature09372019374039/Shared-Document090283701902MB3729MSJ20DH36A984BHM2LS0S7HB4NSKLD95721NMLAO045KKJLA0LMN/docusign/)"; flow:established,to_server; http.uri; content:"/eSignature09372019374039/Shared-Document090283701902MB3729MSJ20DH36A984BHM2LS0S7HB4NSKLD95721NMLAO045KKJLA0LMN/docusign/"; startswith; fast_pattern; http.host; content:"bmqbeauty.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005477; classtype:social-engineering; sid:6005477; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-gervax-biz8-vorem-kanil.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-gervax-biz8-vorem-kanil.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005478; classtype:social-engineering; sid:6005478; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kloclibkblink-dp73tqm8r6w5.edgeone.dev/AUXILL?eta=)"; flow:established,to_server; http.uri; content:"/AUXILL?eta="; startswith; fast_pattern; http.host; content:"kloclibkblink-dp73tqm8r6w5.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005479; classtype:social-engineering; sid:6005479; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi-36.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi-36.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005480; classtype:social-engineering; sid:6005480; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.2026ee.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.2026ee.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005481; classtype:social-engineering; sid:6005481; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bhgvfdre.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bhgvfdre.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005482; classtype:social-engineering; sid:6005482; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ynlndirckinmecnmsnsnbnm.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ynlndirckinmecnmsnsnbnm.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005483; classtype:social-engineering; sid:6005483; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-resmi-24.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-resmi-24.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005484; classtype:social-engineering; sid:6005484; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (i.gal/gmnrV)"; flow:established,to_server; http.uri; content:"/gmnrV"; startswith; fast_pattern; http.host; content:"i.gal"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005485; classtype:social-engineering; sid:6005485; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.wetransfer-pink.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.wetransfer-pink.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005486; classtype:social-engineering; sid:6005486; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fidelltyao.cyou/xepqf7e/page.html)"; flow:established,to_server; http.uri; content:"/xepqf7e/page.html"; startswith; fast_pattern; http.host; content:"fidelltyao.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005487; classtype:social-engineering; sid:6005487; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp.glutoes.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp.glutoes.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005488; classtype:social-engineering; sid:6005488; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (location-viewlive.support/Y4P)"; flow:established,to_server; http.uri; content:"/Y4P"; startswith; fast_pattern; http.host; content:"location-viewlive.support"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005489; classtype:social-engineering; sid:6005489; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ing-ledgerr.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ing-ledgerr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005490; classtype:social-engineering; sid:6005490; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (u55u.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"u55u.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005491; classtype:social-engineering; sid:6005491; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (purolator.com-ftpb.life/a)"; flow:established,to_server; http.uri; content:"/a"; startswith; fast_pattern; http.host; content:"purolator.com-ftpb.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005492; classtype:social-engineering; sid:6005492; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2bingenieria.com.ve/Acrobat)"; flow:established,to_server; http.uri; content:"/Acrobat"; startswith; fast_pattern; http.host; content:"2bingenieria.com.ve"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005493; classtype:social-engineering; sid:6005493; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nitinyadav932.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"nitinyadav932.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005494; classtype:social-engineering; sid:6005494; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pay-profiles-lp1fpmcxb-walletconnect.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pay-profiles-lp1fpmcxb-walletconnect.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005495; classtype:social-engineering; sid:6005495; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rz44z.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rz44z.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005496; classtype:social-engineering; sid:6005496; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktifkaanpaylattersx.iux.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktifkaanpaylattersx.iux.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005497; classtype:social-engineering; sid:6005497; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fidelltyan.cyou/6v9kc1?opn=xLfhgb)"; flow:established,to_server; http.uri; content:"/6v9kc1?opn=xLfhgb"; startswith; fast_pattern; http.host; content:"fidelltyan.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005498; classtype:social-engineering; sid:6005498; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagramlogin556.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"instagramlogin556.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005499; classtype:social-engineering; sid:6005499; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mdent.pro/Kundenservice)"; flow:established,to_server; http.uri; content:"/Kundenservice"; startswith; fast_pattern; http.host; content:"mdent.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005500; classtype:social-engineering; sid:6005500; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (special-event-landing.vercel.app/amazon.html)"; flow:established,to_server; http.uri; content:"/amazon.html"; startswith; fast_pattern; http.host; content:"special-event-landing.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005501; classtype:social-engineering; sid:6005501; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (norquza-gld-fentavi-p8q5fc93.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"norquza-gld-fentavi-p8q5fc93.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005502; classtype:social-engineering; sid:6005502; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abhinav54884-creator.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"abhinav54884-creator.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005503; classtype:social-engineering; sid:6005503; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bigshopee26.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bigshopee26.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005504; classtype:social-engineering; sid:6005504; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ag88oa.123111.cyou/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ag88oa.123111.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005505; classtype:social-engineering; sid:6005505; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagramlogin556.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagramlogin556.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005506; classtype:social-engineering; sid:6005506; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookfakepage.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebookfakepage.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005507; classtype:social-engineering; sid:6005507; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whatsapp-pc.zn-chat-whatapps.hi.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsapp-pc.zn-chat-whatapps.hi.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005508; classtype:social-engineering; sid:6005508; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booklng-pagadaconfidate.com/1879507396/)"; flow:established,to_server; http.uri; content:"/1879507396/"; startswith; fast_pattern; http.host; content:"booklng-pagadaconfidate.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005509; classtype:social-engineering; sid:6005509; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fifththirdohio.live/promo/newmarket/tem.php)"; flow:established,to_server; http.uri; content:"/promo/newmarket/tem.php"; startswith; fast_pattern; http.host; content:"fifththirdohio.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005510; classtype:social-engineering; sid:6005510; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.thr-shopee52.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.thr-shopee52.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005511; classtype:social-engineering; sid:6005511; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zsori.com.mx/index.html?eta=lorik8@29fab75385899aeb60892931e5c2bff91f60.org)"; flow:established,to_server; http.uri; content:"/index.html?eta=lorik8@29fab75385899aeb60892931e5c2bff91f60.org"; startswith; fast_pattern; http.host; content:"zsori.com.mx"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005512; classtype:social-engineering; sid:6005512; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.yqq.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.yqq.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005513; classtype:social-engineering; sid:6005513; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (od0dm-kqv-5da1ma-8pbr-5380.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"od0dm-kqv-5da1ma-8pbr-5380.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005514; classtype:social-engineering; sid:6005514; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bookidgupdsonliinse.com/1193014269/)"; flow:established,to_server; http.uri; content:"/1193014269/"; startswith; fast_pattern; http.host; content:"bookidgupdsonliinse.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005515; classtype:social-engineering; sid:6005515; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (btrzp2b51dr-xjnshpli-2a7b3f-btq85c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"btrzp2b51dr-xjnshpli-2a7b3f-btq85c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005516; classtype:social-engineering; sid:6005516; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (timeupdatecharter.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"timeupdatecharter.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005517; classtype:social-engineering; sid:6005517; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (annudev.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"annudev.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005518; classtype:social-engineering; sid:6005518; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.staking2portfolio.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.staking2portfolio.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005519; classtype:social-engineering; sid:6005519; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hqehall.hqehall.fzgh.sonicmenusprices.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hqehall.hqehall.fzgh.sonicmenusprices.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005520; classtype:social-engineering; sid:6005520; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bookdngupsites.com/194153642)"; flow:established,to_server; http.uri; content:"/194153642"; startswith; fast_pattern; http.host; content:"bookdngupsites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005521; classtype:social-engineering; sid:6005521; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct-borel-biz8-kurex-sanim.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct-borel-biz8-kurex-sanim.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005522; classtype:social-engineering; sid:6005522; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coenbaze.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coenbaze.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005523; classtype:social-engineering; sid:6005523; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (service-account-instgram.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"service-account-instgram.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005524; classtype:social-engineering; sid:6005524; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ipfs.io/ipfs/bafkreih6t3naoh76ahsn5mg5hexvtqfupwqrgvmyxtafm7hmbgn4gw3xem)"; flow:established,to_server; http.uri; content:"/ipfs/bafkreih6t3naoh76ahsn5mg5hexvtqfupwqrgvmyxtafm7hmbgn4gw3xem"; startswith; fast_pattern; http.host; content:"ipfs.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005525; classtype:social-engineering; sid:6005525; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rajkumar1509-rr.github.io/face-book)"; flow:established,to_server; http.uri; content:"/face-book"; startswith; fast_pattern; http.host; content:"rajkumar1509-rr.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005526; classtype:social-engineering; sid:6005526; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fide1iltyn.cyou/7zcj85f?for=myiFiE)"; flow:established,to_server; http.uri; content:"/7zcj85f?for=myiFiE"; startswith; fast_pattern; http.host; content:"fide1iltyn.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005527; classtype:social-engineering; sid:6005527; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-wallet-app.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-wallet-app.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005528; classtype:social-engineering; sid:6005528; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mtoken-im.cv/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mtoken-im.cv"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005529; classtype:social-engineering; sid:6005529; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.get-information-blue-badge.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.get-information-blue-badge.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005530; classtype:social-engineering; sid:6005530; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sharp-material-234227.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sharp-material-234227.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005531; classtype:social-engineering; sid:6005531; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.baseservices.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.baseservices.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005532; classtype:social-engineering; sid:6005532; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pay-profiles-37o1dpaa2-walletconnect.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pay-profiles-37o1dpaa2-walletconnect.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005533; classtype:social-engineering; sid:6005533; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcast120support.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcast120support.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005534; classtype:social-engineering; sid:6005534; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-resmi-34.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info-resmi-34.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005535; classtype:social-engineering; sid:6005535; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (terminaltransport.vercel.app/tunsr.html/)"; flow:established,to_server; http.uri; content:"/tunsr.html/"; startswith; fast_pattern; http.host; content:"terminaltransport.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005536; classtype:social-engineering; sid:6005536; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (10000mutual.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"10000mutual.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005537; classtype:social-engineering; sid:6005537; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instgram-account-ginxl9n.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instgram-account-ginxl9n.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005538; classtype:social-engineering; sid:6005538; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledjgjh-s0sdfjhkgksd.pages.dev/index.htm)"; flow:established,to_server; http.uri; content:"/index.htm"; startswith; fast_pattern; http.host; content:"ledjgjh-s0sdfjhkgksd.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005539; classtype:social-engineering; sid:6005539; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (patelprince2006.github.io/Netflix_Clone/)"; flow:established,to_server; http.uri; content:"/Netflix_Clone/"; startswith; fast_pattern; http.host; content:"patelprince2006.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005540; classtype:social-engineering; sid:6005540; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (build-81688.bubbleapps.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"build-81688.bubbleapps.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005541; classtype:social-engineering; sid:6005541; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (httpshttpsus1-files-document-storage-files-s9046-3.storage-id-406936.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"httpshttpsus1-files-document-storage-files-s9046-3.storage-id-406936.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005542; classtype:social-engineering; sid:6005542; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (divyaguled202.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"divyaguled202.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005543; classtype:social-engineering; sid:6005543; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tiktok-2026.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tiktok-2026.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005544; classtype:social-engineering; sid:6005544; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verkrs.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"verkrs.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005545; classtype:social-engineering; sid:6005545; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (giant-ways-340713.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"giant-ways-340713.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005546; classtype:social-engineering; sid:6005546; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mercadolibre-details-challenge-kohl.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mercadolibre-details-challenge-kohl.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005547; classtype:social-engineering; sid:6005547; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (assistance.leboncoin.info/hc/fr/categories/8477442763410-Mon-c)"; flow:established,to_server; http.uri; content:"/hc/fr/categories/8477442763410-Mon-c"; startswith; fast_pattern; http.host; content:"assistance.leboncoin.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005548; classtype:social-engineering; sid:6005548; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abdul-basith-06.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"abdul-basith-06.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005549; classtype:social-engineering; sid:6005549; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcast120support.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcast120support.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005550; classtype:social-engineering; sid:6005550; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (doc-ythvvbc.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"doc-ythvvbc.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005551; classtype:social-engineering; sid:6005551; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kandenkomm.webstarterz.com/wp-content/open-soursco/CH.html)"; flow:established,to_server; http.uri; content:"/wp-content/open-soursco/CH.html"; startswith; fast_pattern; http.host; content:"www.kandenkomm.webstarterz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005552; classtype:social-engineering; sid:6005552; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ex2x2x32x.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ex2x2x32x.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005553; classtype:social-engineering; sid:6005553; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freerobuxforfreelegit.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"freerobuxforfreelegit.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005554; classtype:social-engineering; sid:6005554; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebookwebsite9.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebookwebsite9.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005555; classtype:social-engineering; sid:6005555; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aadhyagoel011-create.github.io/amazon-homepage-clone/)"; flow:established,to_server; http.uri; content:"/amazon-homepage-clone/"; startswith; fast_pattern; http.host; content:"aadhyagoel011-create.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005556; classtype:social-engineering; sid:6005556; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (php-web-server--univunitt.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"php-web-server--univunitt.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005557; classtype:social-engineering; sid:6005557; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pay-profiles-bkk7iy70a-walletconnect.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pay-profiles-bkk7iy70a-walletconnect.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005558; classtype:social-engineering; sid:6005558; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhlsiprod.eu23.smartcommunications.cloud/produce/Account/Login?ReturnUrl=%2Fproduce%2Fwizard%2F83148dc0-31ac-41b5-9f40-219536aaee4b%2F%3FWorkflowId%3Dbd699f01-ca74-3571-b8ac-1caf35fb9f5d)"; flow:established,to_server; http.uri; content:"/produce/Account/Login?ReturnUrl=%2Fproduce%2Fwizard%2F83148dc0-31ac-41b5-9f40-219536aaee4b%2F%3FWorkflowId%3Dbd699f01-ca74-3571-b8ac-1caf35fb9f5d"; startswith; fast_pattern; http.host; content:"dhlsiprod.eu23.smartcommunications.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005559; classtype:social-engineering; sid:6005559; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ledger-wallet-app-xxa8.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ledger-wallet-app-xxa8.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005560; classtype:social-engineering; sid:6005560; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rklqw-pvyq-ar8-e0vg0f-orih.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rklqw-pvyq-ar8-e0vg0f-orih.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005561; classtype:social-engineering; sid:6005561; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp-pc.zn-chat-whatapps.hi.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp-pc.zn-chat-whatapps.hi.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005562; classtype:social-engineering; sid:6005562; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (neon59903-alt.github.io/Instagram-login-page-/)"; flow:established,to_server; http.uri; content:"/Instagram-login-page-/"; startswith; fast_pattern; http.host; content:"neon59903-alt.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005563; classtype:social-engineering; sid:6005563; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwmilntu-tw.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wwmilntu-tw.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005564; classtype:social-engineering; sid:6005564; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instragam-login-oficial.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instragam-login-oficial.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005565; classtype:social-engineering; sid:6005565; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ghezminelogon.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ghezminelogon.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005566; classtype:social-engineering; sid:6005566; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (topup-koro.github.io/FaceWorld)"; flow:established,to_server; http.uri; content:"/FaceWorld"; startswith; fast_pattern; http.host; content:"topup-koro.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005567; classtype:social-engineering; sid:6005567; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steamcommunitty-workspacedesigner.shop/workshop/glock18/balance/)"; flow:established,to_server; http.uri; content:"/workshop/glock18/balance/"; startswith; fast_pattern; http.host; content:"steamcommunitty-workspacedesigner.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005568; classtype:social-engineering; sid:6005568; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vibhu025.github.io/family-ledger/)"; flow:established,to_server; http.uri; content:"/family-ledger/"; startswith; fast_pattern; http.host; content:"vibhu025.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005569; classtype:social-engineering; sid:6005569; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usa-phantom--auth.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"usa-phantom--auth.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005570; classtype:social-engineering; sid:6005570; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (panfilova2.msk.ru/earthm/)"; flow:established,to_server; http.uri; content:"/earthm/"; startswith; fast_pattern; http.host; content:"panfilova2.msk.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005571; classtype:social-engineering; sid:6005571; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onlinaccountsantandeer.bcqsolutions.com.mx/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"onlinaccountsantandeer.bcqsolutions.com.mx"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005572; classtype:social-engineering; sid:6005572; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fidelityap.cyou/8bnuml/page.html)"; flow:established,to_server; http.uri; content:"/8bnuml/page.html"; startswith; fast_pattern; http.host; content:"fidelityap.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005573; classtype:social-engineering; sid:6005573; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shoppingclothessredamansuiseeonline.shn-host.ru//wp/wp-admin/maint/loginschwinze/?token=)"; flow:established,to_server; http.uri; content:"//wp/wp-admin/maint/loginschwinze/?token="; startswith; fast_pattern; http.host; content:"shoppingclothessredamansuiseeonline.shn-host.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005574; classtype:social-engineering; sid:6005574; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fituree-menupay-id.offcou.beauty/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fituree-menupay-id.offcou.beauty"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005575; classtype:social-engineering; sid:6005575; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (permanent-verified-blue-tick.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"permanent-verified-blue-tick.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005576; classtype:social-engineering; sid:6005576; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (22aa-dvg3avgwc7aqgcdx.z02.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"22aa-dvg3avgwc7aqgcdx.z02.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005577; classtype:social-engineering; sid:6005577; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trzor-secure-suite.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trzor-secure-suite.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005578; classtype:social-engineering; sid:6005578; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (redwinezoonma.12hp.ch/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php)"; flow:established,to_server; http.uri; content:"/wp-includes/theme-compat/dfr1mxl/vglorbt/dxvcagm/Netease/neteasyes/neteasyest/900/index.php"; startswith; fast_pattern; http.host; content:"redwinezoonma.12hp.ch"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005579; classtype:social-engineering; sid:6005579; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezr-brige-us-nifo.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezr-brige-us-nifo.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005580; classtype:social-engineering; sid:6005580; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-login5.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-login5.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005581; classtype:social-engineering; sid:6005581; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h5.msg-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"h5.msg-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005582; classtype:social-engineering; sid:6005582; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.wegiveyouinstagramfollowers.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.wegiveyouinstagramfollowers.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005583; classtype:social-engineering; sid:6005583; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instgram-ginx-l9n.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instgram-ginx-l9n.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005584; classtype:social-engineering; sid:6005584; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (information-portal-945a.46573576.workers.dev/privacy-information-center)"; flow:established,to_server; http.uri; content:"/privacy-information-center"; startswith; fast_pattern; http.host; content:"information-portal-945a.46573576.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005585; classtype:social-engineering; sid:6005585; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.loginfacebook31.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.loginfacebook31.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005586; classtype:social-engineering; sid:6005586; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (global-accelerationr3que5f-dpojca32e2u6.edgeone.dev/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"global-accelerationr3que5f-dpojca32e2u6.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005587; classtype:social-engineering; sid:6005587; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shubhxtech61-org.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"shubhxtech61-org.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005588; classtype:social-engineering; sid:6005588; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pay-profiles-im1mog7fq-walletconnect.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pay-profiles-im1mog7fq-walletconnect.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005589; classtype:social-engineering; sid:6005589; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox.com.am/users/312366013156/profile)"; flow:established,to_server; http.uri; content:"/users/312366013156/profile"; startswith; fast_pattern; http.host; content:"roblox.com.am"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005590; classtype:social-engineering; sid:6005590; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.wawacomcomcom.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.wawacomcomcom.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005591; classtype:social-engineering; sid:6005591; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wegiveyouinstagramfollowers.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wegiveyouinstagramfollowers.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005592; classtype:social-engineering; sid:6005592; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.staking4portfolio.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.staking4portfolio.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005593; classtype:social-engineering; sid:6005593; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yourmailaccount.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yourmailaccount.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005594; classtype:social-engineering; sid:6005594; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (z-facebook.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"z-facebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005595; classtype:social-engineering; sid:6005595; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qr.link/1Cc0KZ)"; flow:established,to_server; http.uri; content:"/1Cc0KZ"; startswith; fast_pattern; http.host; content:"qr.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005596; classtype:social-engineering; sid:6005596; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wmwmilntu-edutw.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wmwmilntu-edutw.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005597; classtype:social-engineering; sid:6005597; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ing-ledgerx.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ing-ledgerx.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005598; classtype:social-engineering; sid:6005598; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamask.github.io/sdk/)"; flow:established,to_server; http.uri; content:"/sdk/"; startswith; fast_pattern; http.host; content:"metamask.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005599; classtype:social-engineering; sid:6005599; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loginfaebook.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"loginfaebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005600; classtype:social-engineering; sid:6005600; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.apply-blue-mark-now.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.apply-blue-mark-now.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005601; classtype:social-engineering; sid:6005601; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (get-instant-loan-us-bank-applynow.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"get-instant-loan-us-bank-applynow.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005602; classtype:social-engineering; sid:6005602; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebologin.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"facebologin.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005603; classtype:social-engineering; sid:6005603; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.followers-increase-instagram.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.followers-increase-instagram.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005604; classtype:social-engineering; sid:6005604; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (z3sh-7y5-dhusy-nui4-qxyt.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"z3sh-7y5-dhusy-nui4-qxyt.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005605; classtype:social-engineering; sid:6005605; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pay-profiles-8uz0h1h4f-walletconnect.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pay-profiles-8uz0h1h4f-walletconnect.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005606; classtype:social-engineering; sid:6005606; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiifkanpaylaterzz.unn.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiifkanpaylaterzz.unn.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005607; classtype:social-engineering; sid:6005607; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookwebsite9.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"facebookwebsite9.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005608; classtype:social-engineering; sid:6005608; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.staking5portfolio.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.staking5portfolio.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005609; classtype:social-engineering; sid:6005609; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thomasdev199.github.io/taller4-bootstrap-git)"; flow:established,to_server; http.uri; content:"/taller4-bootstrap-git"; startswith; fast_pattern; http.host; content:"thomasdev199.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005610; classtype:social-engineering; sid:6005610; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nexushub.info/spectru/)"; flow:established,to_server; http.uri; content:"/spectru/"; startswith; fast_pattern; http.host; content:"nexushub.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005611; classtype:social-engineering; sid:6005611; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (khushboo954.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"khushboo954.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005612; classtype:social-engineering; sid:6005612; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xn--klver-kua.se/404page/?NotFound)"; flow:established,to_server; http.uri; content:"/404page/?NotFound"; startswith; fast_pattern; http.host; content:"xn--klver-kua.se"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005613; classtype:social-engineering; sid:6005613; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nbbaorun.com/tS7jU2uL/sasaki/?ssid=tOb9qNQRq)"; flow:established,to_server; http.uri; content:"/tS7jU2uL/sasaki/?ssid=tOb9qNQRq"; startswith; fast_pattern; http.host; content:"nbbaorun.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005614; classtype:social-engineering; sid:6005614; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docusign-altroncommunications.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"docusign-altroncommunications.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005615; classtype:social-engineering; sid:6005615; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vigilance89.github.io/vigilane8viewdocument/)"; flow:established,to_server; http.uri; content:"/vigilane8viewdocument/"; startswith; fast_pattern; http.host; content:"vigilance89.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005616; classtype:social-engineering; sid:6005616; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.program-shopee48.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.program-shopee48.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005617; classtype:social-engineering; sid:6005617; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-app-ledgorr.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-app-ledgorr.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005618; classtype:social-engineering; sid:6005618; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (muradalam7352.github.io/NetflixClone/)"; flow:established,to_server; http.uri; content:"/NetflixClone/"; startswith; fast_pattern; http.host; content:"muradalam7352.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005619; classtype:social-engineering; sid:6005619; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santandermx.dothome.co.kr/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"santandermx.dothome.co.kr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005620; classtype:social-engineering; sid:6005620; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhargavinallam12.github.io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"bhargavinallam12.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005621; classtype:social-engineering; sid:6005621; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trck-spl-04.aarauheat.ch/ga/click/2-111454900-1510-15659-30511-16986-9d0e8f8058-3911a87029)"; flow:established,to_server; http.uri; content:"/ga/click/2-111454900-1510-15659-30511-16986-9d0e8f8058-3911a87029"; startswith; fast_pattern; http.host; content:"trck-spl-04.aarauheat.ch"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005622; classtype:social-engineering; sid:6005622; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yashbajaj973-ship-it.github.io/Ledger/)"; flow:established,to_server; http.uri; content:"/Ledger/"; startswith; fast_pattern; http.host; content:"yashbajaj973-ship-it.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005623; classtype:social-engineering; sid:6005623; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-rus.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-rus.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005624; classtype:social-engineering; sid:6005624; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vvbattambanghotel.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"vvbattambanghotel.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005625; classtype:social-engineering; sid:6005625; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (miaowenhuan.com/Gfks1shVsu9alsi/help/?id=4h9Ci4dq)"; flow:established,to_server; http.uri; content:"/Gfks1shVsu9alsi/help/?id=4h9Ci4dq"; startswith; fast_pattern; http.host; content:"miaowenhuan.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005626; classtype:social-engineering; sid:6005626; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wa.links-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wa.links-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005627; classtype:social-engineering; sid:6005627; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (relaxed-wisp-154a7c.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"relaxed-wisp-154a7c.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005628; classtype:social-engineering; sid:6005628; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paketshop.9-160-165-249.cpanel.site/eu/update.php?token=iee4ydyztaszpf7ceoz1)"; flow:established,to_server; http.uri; content:"/eu/update.php?token=iee4ydyztaszpf7ceoz1"; startswith; fast_pattern; http.host; content:"paketshop.9-160-165-249.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005629; classtype:social-engineering; sid:6005629; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (phantianwallet.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"phantianwallet.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005630; classtype:social-engineering; sid:6005630; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ciclodeprosperidade.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"ciclodeprosperidade.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005631; classtype:social-engineering; sid:6005631; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.rebrand.ly/Blox-Fruits-private-Server-Code-101323124173/)"; flow:established,to_server; http.uri; content:"/Blox-Fruits-private-Server-Code-101323124173/"; startswith; fast_pattern; http.host; content:"www.rebrand.ly"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005632; classtype:social-engineering; sid:6005632; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-lliive.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-lliive.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005633; classtype:social-engineering; sid:6005633; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (traveni-gld-felzora-r2t5pk64.pages.dev/thn-yjm-uio-lkh?welcome=104416014675991&stt=104416014675991&name_stt=B&B%20punto%20v%C3%A9lo)"; flow:established,to_server; http.uri; content:"/thn-yjm-uio-lkh?welcome=104416014675991&stt=104416014675991&name_stt=B&B%20punto%20v%C3%A9lo"; startswith; fast_pattern; http.host; content:"traveni-gld-felzora-r2t5pk64.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005634; classtype:social-engineering; sid:6005634; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ingresos-itau.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ingresos-itau.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005635; classtype:social-engineering; sid:6005635; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.staking3portfolio.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.staking3portfolio.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005636; classtype:social-engineering; sid:6005636; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.log-in-facebook.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.log-in-facebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005637; classtype:social-engineering; sid:6005637; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (v34v34v34tv.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"v34v34v34tv.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005638; classtype:social-engineering; sid:6005638; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seulimiteprimeaquii.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"seulimiteprimeaquii.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005639; classtype:social-engineering; sid:6005639; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-shopee48.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"program-shopee48.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005640; classtype:social-engineering; sid:6005640; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (msupdate.co.uk/concluded.php?k=6829f795496b293175b5df131695323d9d7a6a1d)"; flow:established,to_server; http.uri; content:"/concluded.php?k=6829f795496b293175b5df131695323d9d7a6a1d"; startswith; fast_pattern; http.host; content:"msupdate.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005641; classtype:social-engineering; sid:6005641; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-security-notice.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-security-notice.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005642; classtype:social-engineering; sid:6005642; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-ledger-guide.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-ledger-guide.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005643; classtype:social-engineering; sid:6005643; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (greenhouse.com.uy/nycit/)"; flow:established,to_server; http.uri; content:"/nycit/"; startswith; fast_pattern; http.host; content:"greenhouse.com.uy"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005644; classtype:social-engineering; sid:6005644; rev:1; metadata: signature_severity Major, created_et 2026_08_01;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telekom-si.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telekom-si.click"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005645; classtype:social-engineering; sid:6005645; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-kramel-biz-fesnik-lovsar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-kramel-biz-fesnik-lovsar.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005646; classtype:social-engineering; sid:6005646; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-vorsel-biz8-marnik-dolfar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-vorsel-biz8-marnik-dolfar.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005647; classtype:social-engineering; sid:6005647; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-kersok-biz8-vadlor-prenex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-kersok-biz8-vadlor-prenex.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005648; classtype:social-engineering; sid:6005648; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-selvik-biz8-tormex-janlor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-selvik-biz8-tormex-janlor.pages.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005649; classtype:social-engineering; sid:6005649; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thehatfieldhotel-9g5jl.ondigitalocean.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"thehatfieldhotel-9g5jl.ondigitalocean.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005650; classtype:social-engineering; sid:6005650; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-morlan-biz8-dravex-polsik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-morlan-biz8-dravex-polsik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005651; classtype:social-engineering; sid:6005651; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-pronsar-biz-zarmek-holdik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-pronsar-biz-zarmek-holdik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005652; classtype:social-engineering; sid:6005652; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webstlapp-amazonauth.165-154-225-173.cpanel.site/?appmem)"; flow:established,to_server; http.uri; content:"/?appmem"; startswith; fast_pattern; http.host; content:"webstlapp-amazonauth.165-154-225-173.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005653; classtype:social-engineering; sid:6005653; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marlavo-gld-fentora-a8x9hc63.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"marlavo-gld-fentora-a8x9hc63.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005654; classtype:social-engineering; sid:6005654; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mornela-gld-fentora-a6x4fc954.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mornela-gld-fentora-a6x4fc954.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005655; classtype:social-engineering; sid:6005655; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-havsel-biz-kendor-formik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-havsel-biz-kendor-formik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005656; classtype:social-engineering; sid:6005656; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-renvik-biz8-kolmar-zefran.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-renvik-biz8-kolmar-zefran.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005657; classtype:social-engineering; sid:6005657; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mailbox-dpr3yixp1qk1.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mailbox-dpr3yixp1qk1.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005658; classtype:social-engineering; sid:6005658; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-furep-biz8-dovem-karin.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-furep-biz8-dovem-karin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005659; classtype:social-engineering; sid:6005659; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-varnes-biz-prondik-zalmor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-varnes-biz-prondik-zalmor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005660; classtype:social-engineering; sid:6005660; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-zelkor-biz8-tanvik-horsel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-zelkor-biz8-tanvik-horsel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005661; classtype:social-engineering; sid:6005661; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-ravnor-biz8-kelsik-domvek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-ravnor-biz8-kelsik-domvek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005662; classtype:social-engineering; sid:6005662; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-pranor-biz8-helsik-vokmar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-pranor-biz8-helsik-vokmar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005663; classtype:social-engineering; sid:6005663; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-falzen-biz8-korvex-nultra.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-falzen-biz8-korvex-nultra.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005664; classtype:social-engineering; sid:6005664; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-forsel-biz-varnik-keslok.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-forsel-biz-varnik-keslok.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005665; classtype:social-engineering; sid:6005665; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dwsfxjkbhds.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.dwsfxjkbhds.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005666; classtype:social-engineering; sid:6005666; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-horlin-biz8-cravex-norzil.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-horlin-biz8-cravex-norzil.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005667; classtype:social-engineering; sid:6005667; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-quaren-biz8-forel-zimor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-quaren-biz8-forel-zimor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005668; classtype:social-engineering; sid:6005668; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-drexil-biz8-marnex-soltri.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-drexil-biz8-marnex-soltri.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005669; classtype:social-engineering; sid:6005669; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct-jalon-biz8-vurem-fasek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct-jalon-biz8-vurem-fasek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005670; classtype:social-engineering; sid:6005670; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-fornex-biz8-kelzor-madrix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-fornex-biz8-kelzor-madrix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005671; classtype:social-engineering; sid:6005671; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-keltra-biz8-vormex-drasil.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-keltra-biz8-vormex-drasil.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005672; classtype:social-engineering; sid:6005672; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-lorzen-biz8-mexdor-vantri.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-lorzen-biz8-mexdor-vantri.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005673; classtype:social-engineering; sid:6005673; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-kelvik-biz8-horlan-fresik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-kelvik-biz8-horlan-fresik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005674; classtype:social-engineering; sid:6005674; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-prasik-biz-zemnor-lovdek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-prasik-biz-zemnor-lovdek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005675; classtype:social-engineering; sid:6005675; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-fornik-biz8-varsel-modrek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-fornik-biz8-varsel-modrek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005676; classtype:social-engineering; sid:6005676; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-hanvek-biz8-solmer-pranix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-hanvek-biz8-solmer-pranix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005677; classtype:social-engineering; sid:6005677; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-lomvek-biz8-tresan-farnix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-lomvek-biz8-tresan-farnix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005678; classtype:social-engineering; sid:6005678; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (codehub-amber.vercel.app/index1.html/)"; flow:established,to_server; http.uri; content:"/index1.html/"; startswith; fast_pattern; http.host; content:"codehub-amber.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005679; classtype:social-engineering; sid:6005679; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-varex-biz8-luntra-meskor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-varex-biz8-luntra-meskor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005680; classtype:social-engineering; sid:6005680; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-kresor-biz8-felnik-lomdar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-kresor-biz8-felnik-lomdar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005681; classtype:social-engineering; sid:6005681; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-kendik-biz-forsel-pramok.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-kendik-biz-forsel-pramok.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005682; classtype:social-engineering; sid:6005682; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-favlor-biz8-kersan-movrik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-favlor-biz8-kersan-movrik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005683; classtype:social-engineering; sid:6005683; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-polrek-biz8-farnix-lomvek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-polrek-biz8-farnix-lomvek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005684; classtype:social-engineering; sid:6005684; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (validar3e.webcindario.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"validar3e.webcindario.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005685; classtype:social-engineering; sid:6005685; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (belvora-gld-xarmeti-p2t9hc75.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"belvora-gld-xarmeti-p2t9hc75.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005686; classtype:social-engineering; sid:6005686; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.codehub-amber.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.codehub-amber.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005687; classtype:social-engineering; sid:6005687; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-pralok-biz8-kemvar-morsik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-pralok-biz8-kemvar-morsik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005688; classtype:social-engineering; sid:6005688; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-velsok-biz8-karsen-promel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-velsok-biz8-karsen-promel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005689; classtype:social-engineering; sid:6005689; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apps.message-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"apps.message-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005690; classtype:social-engineering; sid:6005690; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox.com.bn/games/125057003284781/1-speed-needoh-escape?game_id=125057003284781&game_name=1-speed-needoh-escape&privateserverlinkcode=49048271974707927539890488411623)"; flow:established,to_server; http.uri; content:"/games/125057003284781/1-speed-needoh-escape?game_id=125057003284781&game_name=1-speed-needoh-escape&privateserverlinkcode=49048271974707927539890488411623"; startswith; fast_pattern; http.host; content:"roblox.com.bn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005691; classtype:social-engineering; sid:6005691; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-vordek-biz8-lamsor-prenik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-vordek-biz8-lamsor-prenik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005692; classtype:social-engineering; sid:6005692; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-varsik-biz8-melzor-tranek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-varsik-biz8-melzor-tranek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005693; classtype:social-engineering; sid:6005693; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imtoke.bar/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"imtoke.bar"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005694; classtype:social-engineering; sid:6005694; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-lomdor-biz-zarnik-pravsel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-lomdor-biz-zarnik-pravsel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005695; classtype:social-engineering; sid:6005695; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-laskor-biz8-norpex-felvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-laskor-biz8-norpex-felvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005696; classtype:social-engineering; sid:6005696; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-kravix-biz8-selnor-morzan.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-kravix-biz8-selnor-morzan.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005697; classtype:social-engineering; sid:6005697; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-zenril-biz8-dorvak-plenor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-zenril-biz8-dorvak-plenor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005698; classtype:social-engineering; sid:6005698; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freeinstagramfollowers1m.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"freeinstagramfollowers1m.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005699; classtype:social-engineering; sid:6005699; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.updatecomcastt.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.updatecomcastt.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005700; classtype:social-engineering; sid:6005700; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mghub.phemayameltahub.site/counter-suspend-federate-vendor-status-lightweight-license")"; flow:established,to_server; http.uri; content:"/counter-suspend-federate-vendor-status-lightweight-license""; startswith; fast_pattern; http.host; content:"mghub.phemayameltahub.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005701; classtype:social-engineering; sid:6005701; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bt-home-107437fvg.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bt-home-107437fvg.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005702; classtype:social-engineering; sid:6005702; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-farnel-biz8-poltra-veskor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-farnel-biz8-poltra-veskor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005703; classtype:social-engineering; sid:6005703; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-lesdor-biz-pravnik-zomrek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-lesdor-biz-pravnik-zomrek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005704; classtype:social-engineering; sid:6005704; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-fardok-biz8-molvik-keslor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-fardok-biz8-molvik-keslor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005705; classtype:social-engineering; sid:6005705; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fancy-panda-773999.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fancy-panda-773999.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005706; classtype:social-engineering; sid:6005706; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-solnix-biz8-venkar-morlek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-solnix-biz8-venkar-morlek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005707; classtype:social-engineering; sid:6005707; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-hersel-biz-lomdor-zafrik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-hersel-biz-lomdor-zafrik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005708; classtype:social-engineering; sid:6005708; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.docusignzweb.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.docusignzweb.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005709; classtype:social-engineering; sid:6005709; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supprtgmni.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"supprtgmni.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005710; classtype:social-engineering; sid:6005710; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-talnex-biz8-vorsik-lemdar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-talnex-biz8-vorsik-lemdar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005711; classtype:social-engineering; sid:6005711; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-movrek-biz8-sarnel-tolvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-movrek-biz8-sarnel-tolvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005712; classtype:social-engineering; sid:6005712; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-raskor-biz8-dolvik-quenar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-raskor-biz8-dolvik-quenar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005713; classtype:social-engineering; sid:6005713; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (teresinasoftwares.com.br/xfinity/xfinity)"; flow:established,to_server; http.uri; content:"/xfinity/xfinity"; startswith; fast_pattern; http.host; content:"teresinasoftwares.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005714; classtype:social-engineering; sid:6005714; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-lendor-biz-karmik-pravsel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-lendor-biz-karmik-pravsel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005715; classtype:social-engineering; sid:6005715; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-corzen-biz8-vemral-koltra.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-corzen-biz8-vemral-koltra.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005716; classtype:social-engineering; sid:6005716; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct-rorem-biz8-kurex-halin.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct-rorem-biz8-kurex-halin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005717; classtype:social-engineering; sid:6005717; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-homvik-biz-zolrek-farsen.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-homvik-biz-zolrek-farsen.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005718; classtype:social-engineering; sid:6005718; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-quenor-biz8-tarsel-vokmir.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-quenor-biz8-tarsel-vokmir.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005719; classtype:social-engineering; sid:6005719; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-sarnix-biz8-kelmor-travik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-sarnix-biz8-kelmor-travik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005720; classtype:social-engineering; sid:6005720; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-korsel-biz8-zemvik-farnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-korsel-biz8-zemvik-farnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005721; classtype:social-engineering; sid:6005721; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-fandor-biz-hesvik-kormel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-fandor-biz-hesvik-kormel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005722; classtype:social-engineering; sid:6005722; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tangerine-chimera-f854a0.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tangerine-chimera-f854a0.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005723; classtype:social-engineering; sid:6005723; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fmello2002.github.io/projeto-dio-tela-login-instagram/)"; flow:established,to_server; http.uri; content:"/projeto-dio-tela-login-instagram/"; startswith; fast_pattern; http.host; content:"fmello2002.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005724; classtype:social-engineering; sid:6005724; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-kersan-biz-holdek-favrik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-kersan-biz-holdek-favrik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005725; classtype:social-engineering; sid:6005725; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-dolvar-biz8-kresik-lunmer.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-dolvar-biz8-kresik-lunmer.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005726; classtype:social-engineering; sid:6005726; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-zoldek-biz-pravik-larsen.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-zoldek-biz-pravik-larsen.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005727; classtype:social-engineering; sid:6005727; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-favsen-biz8-holrik-zardok.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-favsen-biz8-holrik-zardok.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005728; classtype:social-engineering; sid:6005728; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-fesvik-biz-kramor-handel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-fesvik-biz-kramor-handel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005729; classtype:social-engineering; sid:6005729; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-marsik-biz8-holvek-zenlor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-marsik-biz8-holvek-zenlor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005730; classtype:social-engineering; sid:6005730; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-karsen-biz8-zoltra-femvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-karsen-biz8-zoltra-femvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005731; classtype:social-engineering; sid:6005731; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-kamdor-biz-fresik-harnel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-kamdor-biz-fresik-harnel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005732; classtype:social-engineering; sid:6005732; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-holvik-biz-fresel-kandor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-holvik-biz-fresel-kandor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005733; classtype:social-engineering; sid:6005733; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-tresor-biz8-pranik-zemlok.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-tresor-biz8-pranik-zemlok.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005734; classtype:social-engineering; sid:6005734; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-zavdok-biz8-pralor-kesvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-zavdok-biz8-pralor-kesvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005735; classtype:social-engineering; sid:6005735; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-hamrel-biz-pronsik-keldor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-hamrel-biz-pronsik-keldor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005736; classtype:social-engineering; sid:6005736; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.creatormonetizationsupportdeskuse.click/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"app.creatormonetizationsupportdeskuse.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005737; classtype:social-engineering; sid:6005737; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-zersok-biz-polvik-famdor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-zersok-biz-polvik-famdor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005738; classtype:social-engineering; sid:6005738; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mgypt80gpx-xlbdg28ztr-4e0f8b-xlq91k.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mgypt80gpx-xlbdg28ztr-4e0f8b-xlq91k.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005739; classtype:social-engineering; sid:6005739; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (travemi-gld-zorqeta-p3x5dq24.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"travemi-gld-zorqeta-p3x5dq24.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005740; classtype:social-engineering; sid:6005740; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-fremor-biz-prandik-kesrel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-fremor-biz-prandik-kesrel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005741; classtype:social-engineering; sid:6005741; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-tolvik-biz8-zenfar-lorsik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-tolvik-biz8-zenfar-lorsik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005742; classtype:social-engineering; sid:6005742; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.spcetmwemail.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.spcetmwemail.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005743; classtype:social-engineering; sid:6005743; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-nalvek-biz8-sormix-queldor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-nalvek-biz8-sormix-queldor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005744; classtype:social-engineering; sid:6005744; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ambil-hadiah-10juta-anda-sekarang.netlify.app/az.html)"; flow:established,to_server; http.uri; content:"/az.html"; startswith; fast_pattern; http.host; content:"ambil-hadiah-10juta-anda-sekarang.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005745; classtype:social-engineering; sid:6005745; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-vraxtik-biz-slarnok-fronvex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-vraxtik-biz-slarnok-fronvex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005746; classtype:social-engineering; sid:6005746; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (connection-gateway.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"connection-gateway.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005747; classtype:social-engineering; sid:6005747; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m99-r52k-2h94b0-b61ypm-wms.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m99-r52k-2h94b0-b61ypm-wms.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005748; classtype:social-engineering; sid:6005748; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-folzan-biz8-pravik-melkor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-folzan-biz8-pravik-melkor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005749; classtype:social-engineering; sid:6005749; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-jarnix-biz8-korlin-vestra.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-jarnix-biz8-korlin-vestra.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005750; classtype:social-engineering; sid:6005750; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-zolvik-biz-harsor-lendek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-zolvik-biz-harsor-lendek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005751; classtype:social-engineering; sid:6005751; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-zorven-biz8-fralto-menvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-zorven-biz8-fralto-menvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005752; classtype:social-engineering; sid:6005752; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bahaa-mostafa.github.io/Insta-Clone)"; flow:established,to_server; http.uri; content:"/Insta-Clone"; startswith; fast_pattern; http.host; content:"bahaa-mostafa.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005753; classtype:social-engineering; sid:6005753; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-norvek-biz8-pleska-torlin.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-norvek-biz8-pleska-torlin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005754; classtype:social-engineering; sid:6005754; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (demoethicalhacking.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"demoethicalhacking.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005755; classtype:social-engineering; sid:6005755; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qrco.de/bgwq6Y)"; flow:established,to_server; http.uri; content:"/bgwq6Y"; startswith; fast_pattern; http.host; content:"qrco.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005756; classtype:social-engineering; sid:6005756; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rxwf4x4x4.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rxwf4x4x4.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005757; classtype:social-engineering; sid:6005757; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-kramok-biz-prensar-veldik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-kramok-biz-prensar-veldik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005758; classtype:social-engineering; sid:6005758; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-kolvik-biz-harmok-fresan.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-kolvik-biz-harmok-fresan.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005759; classtype:social-engineering; sid:6005759; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-prensar-biz-foldik-zarnel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-prensar-biz-foldik-zarnel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005760; classtype:social-engineering; sid:6005760; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-vardor-biz-helsik-zamnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-vardor-biz-helsik-zamnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005761; classtype:social-engineering; sid:6005761; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-foldor-biz-zarnik-mavsel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-foldor-biz-zarnik-mavsel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005762; classtype:social-engineering; sid:6005762; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-varnik-biz-zomsel-fresdor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-varnik-biz-zomsel-fresdor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005763; classtype:social-engineering; sid:6005763; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-kesrel-biz-farnik-homsar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-kesrel-biz-farnik-homsar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005764; classtype:social-engineering; sid:6005764; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-vadnor-biz8-prenik-folzar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-vadnor-biz8-prenik-folzar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005765; classtype:social-engineering; sid:6005765; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-prelix-biz8-horvek-sumral.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-prelix-biz8-horvek-sumral.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005766; classtype:social-engineering; sid:6005766; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-zavrik-biz8-pralsen-kordex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-zavrik-biz8-pralsen-kordex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005767; classtype:social-engineering; sid:6005767; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-polzar-biz8-harsik-velnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-polzar-biz8-harsik-velnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005768; classtype:social-engineering; sid:6005768; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-holzar-biz8-trevik-lansor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-holzar-biz8-trevik-lansor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005769; classtype:social-engineering; sid:6005769; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-lomnik-biz-zoldar-havsel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-lomnik-biz-zoldar-havsel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005770; classtype:social-engineering; sid:6005770; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-zenko-biz8-fralix-dorven.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-zenko-biz8-fralix-dorven.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005771; classtype:social-engineering; sid:6005771; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-lesvik-biz-zarmok-fendel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-lesvik-biz-zarmok-fendel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005772; classtype:social-engineering; sid:6005772; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-merlok-biz8-zarnex-tolvir.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-merlok-biz8-zarnex-tolvir.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005773; classtype:social-engineering; sid:6005773; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-prasok-biz-karmel-fondik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-prasok-biz-karmel-fondik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005774; classtype:social-engineering; sid:6005774; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (connect-dapp-nine.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"connect-dapp-nine.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005775; classtype:social-engineering; sid:6005775; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.eng650.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.eng650.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005776; classtype:social-engineering; sid:6005776; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-farsel-biz-kormik-holdar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-farsel-biz-kormik-holdar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005777; classtype:social-engineering; sid:6005777; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (berqumi-gld-lentora-c9x2fq57.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"berqumi-gld-lentora-c9x2fq57.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005778; classtype:social-engineering; sid:6005778; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-polnix-biz8-zarsel-havrek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-polnix-biz8-zarsel-havrek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005779; classtype:social-engineering; sid:6005779; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwwmaxisfghjhkmdfhfgh.us.cc/5g/)"; flow:established,to_server; http.uri; content:"/5g/"; startswith; fast_pattern; http.host; content:"wwwmaxisfghjhkmdfhfgh.us.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005780; classtype:social-engineering; sid:6005780; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-zavmor-biz-pransik-holdek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-zavmor-biz-pransik-holdek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005781; classtype:social-engineering; sid:6005781; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-06-25-feat-i18n-new-translations-uniswap.vercel.app/explore/pools)"; flow:established,to_server; http.uri; content:"/explore/pools"; startswith; fast_pattern; http.host; content:"web-06-25-feat-i18n-new-translations-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005782; classtype:social-engineering; sid:6005782; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-prendor-biz-lomvik-hazrel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-prendor-biz-lomvik-hazrel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005783; classtype:social-engineering; sid:6005783; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-liv-deskktop.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-liv-deskktop.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005784; classtype:social-engineering; sid:6005784; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (router-connect-eta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"router-connect-eta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005785; classtype:social-engineering; sid:6005785; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-lorev-biz8-kurek-zamin.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-lorev-biz8-kurek-zamin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005786; classtype:social-engineering; sid:6005786; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ttanpayvirify.s3.us-east-005.backblazeb2.com/MTS_Mail-2.html)"; flow:established,to_server; http.uri; content:"/MTS_Mail-2.html"; startswith; fast_pattern; http.host; content:"ttanpayvirify.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005787; classtype:social-engineering; sid:6005787; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-dolzen-biz8-pralek-vorsan.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-dolzen-biz8-pralek-vorsan.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005788; classtype:social-engineering; sid:6005788; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (serviemprende2026.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"serviemprende2026.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005789; classtype:social-engineering; sid:6005789; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebooklogin18.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebooklogin18.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005790; classtype:social-engineering; sid:6005790; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-zomdel-biz-pranik-lorsik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-zomdel-biz-pranik-lorsik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005791; classtype:social-engineering; sid:6005791; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-lavrek-biz8-korsik-vemdor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-lavrek-biz8-korsik-vemdor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005792; classtype:social-engineering; sid:6005792; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-farsik-biz-zemdor-kolvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-farsik-biz-zemdor-kolvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005793; classtype:social-engineering; sid:6005793; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-velmik-biz8-larnex-povrik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-velmik-biz8-larnex-povrik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005794; classtype:social-engineering; sid:6005794; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (19546.xyz/m/)"; flow:established,to_server; http.uri; content:"/m/"; startswith; fast_pattern; http.host; content:"19546.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005795; classtype:social-engineering; sid:6005795; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.verified-badge-submission-panneloo.surge.sh/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.verified-badge-submission-panneloo.surge.sh"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005796; classtype:social-engineering; sid:6005796; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-horvek-biz8-melnor-prasik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-horvek-biz8-melnor-prasik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005797; classtype:social-engineering; sid:6005797; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-varnik-biz-keldor-fresmik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-varnik-biz-keldor-fresmik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005798; classtype:social-engineering; sid:6005798; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-subscrition-prime.info/app/index.php?view=main&bk=bnp)"; flow:established,to_server; http.uri; content:"/app/index.php?view=main&bk=bnp"; startswith; fast_pattern; http.host; content:"my-subscrition-prime.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005799; classtype:social-engineering; sid:6005799; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-pronex-biz8-delvik-harsor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-pronex-biz8-delvik-harsor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005800; classtype:social-engineering; sid:6005800; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-velsar-biz-kramik-prondel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-velsar-biz-kramik-prondel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005801; classtype:social-engineering; sid:6005801; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-melsar-biz8-ronvek-ladrix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-melsar-biz8-ronvek-ladrix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005802; classtype:social-engineering; sid:6005802; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-farnel-biz8-korsok-zemvar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-farnel-biz8-korsok-zemvar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005803; classtype:social-engineering; sid:6005803; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-lomrek-biz8-zesdor-havnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-lomrek-biz8-zesdor-havnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005804; classtype:social-engineering; sid:6005804; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-kramel-biz-fondor-lesvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-kramel-biz-fondor-lesvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005805; classtype:social-engineering; sid:6005805; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-zemsel-biz-farnik-hovdar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-zemsel-biz-farnik-hovdar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005806; classtype:social-engineering; sid:6005806; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-kovsar-biz8-melrek-pradix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-kovsar-biz8-melrek-pradix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005807; classtype:social-engineering; sid:6005807; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-hormek-biz8-velnix-drasor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-hormek-biz8-velnix-drasor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005808; classtype:social-engineering; sid:6005808; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-lendik-biz-prasor-favmel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-lendik-biz-prasor-favmel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005809; classtype:social-engineering; sid:6005809; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xwoieuowixpqoixpowiexwjoiexj343x-lb62e.ondigitalocean.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xwoieuowixpqoixpowiexwjoiexj343x-lb62e.ondigitalocean.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005810; classtype:social-engineering; sid:6005810; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-vorsik-biz8-telnor-havrek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-vorsik-biz8-telnor-havrek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005811; classtype:social-engineering; sid:6005811; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-velnor-biz8-prasik-lomzer.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-velnor-biz8-prasik-lomzer.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005812; classtype:social-engineering; sid:6005812; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-dorsik-biz8-felnor-vemsar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-dorsik-biz8-felnor-vemsar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005813; classtype:social-engineering; sid:6005813; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-zelvor-biz8-harnik-folsen.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-zelvor-biz8-harnik-folsen.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005814; classtype:social-engineering; sid:6005814; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-velkar-biz8-pronel-dorsik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-velkar-biz8-pronel-dorsik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005815; classtype:social-engineering; sid:6005815; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (berquna-gld-zartemi-p8t6fw15.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"berquna-gld-zartemi-p8t6fw15.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005816; classtype:social-engineering; sid:6005816; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-zarnor-biz-kovdik-holsar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-zarnor-biz-kovdik-holsar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005817; classtype:social-engineering; sid:6005817; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mnbvcxsdfghjkbhgf.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mnbvcxsdfghjkbhgf.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005818; classtype:social-engineering; sid:6005818; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-kovrek-biz8-zelnik-morsan.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-kovrek-biz8-zelnik-morsan.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005819; classtype:social-engineering; sid:6005819; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-lavrik-biz8-kornel-tresan.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-lavrik-biz8-kornel-tresan.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005820; classtype:social-engineering; sid:6005820; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-torzan-biz8-felkor-drunel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-torzan-biz8-felkor-drunel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005821; classtype:social-engineering; sid:6005821; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-pramel-biz-zovrik-lensar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-pramel-biz-zovrik-lensar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005822; classtype:social-engineering; sid:6005822; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (norzeta-gld-fentela-r5t2hp76.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"norzeta-gld-fentela-r5t2hp76.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005823; classtype:social-engineering; sid:6005823; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (live-ledger-acces.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"live-ledger-acces.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005824; classtype:social-engineering; sid:6005824; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-pelnor-biz8-drasik-vomlen.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-pelnor-biz8-drasik-vomlen.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005825; classtype:social-engineering; sid:6005825; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-ronmel-biz8-kastor-velnix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-ronmel-biz8-kastor-velnix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005826; classtype:social-engineering; sid:6005826; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatapp.flows-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatapp.flows-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005827; classtype:social-engineering; sid:6005827; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-vasrel-biz8-cormix-jalven.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-vasrel-biz8-cormix-jalven.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005828; classtype:social-engineering; sid:6005828; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xn--le-registre-societes-franaises-7vc.fr/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xn--le-registre-societes-franaises-7vc.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005829; classtype:social-engineering; sid:6005829; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.freeinstagramfollowers1m.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.freeinstagramfollowers1m.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005830; classtype:social-engineering; sid:6005830; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-janvik-biz8-torsel-venkar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-janvik-biz8-torsel-venkar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005831; classtype:social-engineering; sid:6005831; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-norvik-biz8-feldor-havsar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-norvik-biz8-feldor-havsar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005832; classtype:social-engineering; sid:6005832; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-varsok-biz-feldor-pramik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-varsok-biz-feldor-pramik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005833; classtype:social-engineering; sid:6005833; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-marnix-biz8-lovkar-tresik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-marnix-biz8-lovkar-tresik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005834; classtype:social-engineering; sid:6005834; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ayushshetty355.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"ayushshetty355.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005835; classtype:social-engineering; sid:6005835; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-felnor-biz8-tarsik-velmor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-felnor-biz8-tarsik-velmor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005836; classtype:social-engineering; sid:6005836; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-dravon-biz8-kelsor-mazvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-dravon-biz8-kelsor-mazvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005837; classtype:social-engineering; sid:6005837; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spaw2006.github.io/Expense_Tracker/)"; flow:established,to_server; http.uri; content:"/Expense_Tracker/"; startswith; fast_pattern; http.host; content:"spaw2006.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005838; classtype:social-engineering; sid:6005838; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-zolvik-biz8-marnor-prasel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-zolvik-biz8-marnor-prasel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005839; classtype:social-engineering; sid:6005839; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-holrek-biz-pranik-keldar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-holrek-biz-pranik-keldar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005840; classtype:social-engineering; sid:6005840; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-morvek-biz8-seltra-quenix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-morvek-biz8-seltra-quenix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005841; classtype:social-engineering; sid:6005841; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp1ct6-slortek-biz-plovnix-fraplor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp1ct6-slortek-biz-plovnix-fraplor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005842; classtype:social-engineering; sid:6005842; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-pravsen-biz-zomvik-hardel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-pravsen-biz-zomvik-hardel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005843; classtype:social-engineering; sid:6005843; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-pradel-biz-kesrik-lomsar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-pradel-biz-kesrik-lomsar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005844; classtype:social-engineering; sid:6005844; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-vamdel-biz-fornik-prasel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-vamdel-biz-fornik-prasel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005845; classtype:social-engineering; sid:6005845; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-kolzen-biz8-mavrik-torsel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-kolzen-biz8-mavrik-torsel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005846; classtype:social-engineering; sid:6005846; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-hured-biz8-kolaf-mizen.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-hured-biz8-kolaf-mizen.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005847; classtype:social-engineering; sid:6005847; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-narkel-biz8-dorsan-velrix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-narkel-biz8-dorsan-velrix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005848; classtype:social-engineering; sid:6005848; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatapp.speak-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatapp.speak-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005849; classtype:social-engineering; sid:6005849; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-monzar-biz8-frenok-lavtri.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-monzar-biz8-frenok-lavtri.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005850; classtype:social-engineering; sid:6005850; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-formek-biz-prandel-vesnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-formek-biz-prandel-vesnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005851; classtype:social-engineering; sid:6005851; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-kamvik-biz-zornel-hesdor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-kamvik-biz-zornel-hesdor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005852; classtype:social-engineering; sid:6005852; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qurnela-gld-belmora-a1x5dw94.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qurnela-gld-belmora-a1x5dw94.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005853; classtype:social-engineering; sid:6005853; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-melmorin-biz8-forem-lazok.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-melmorin-biz8-forem-lazok.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005854; classtype:social-engineering; sid:6005854; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (norzeta-gld-zartavi-r9t2pc76.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"norzeta-gld-zartavi-r9t2pc76.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005855; classtype:social-engineering; sid:6005855; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (servermaintenance80008.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"servermaintenance80008.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005856; classtype:social-engineering; sid:6005856; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-darnok-biz8-veltra-kosmir.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-darnok-biz8-veltra-kosmir.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005857; classtype:social-engineering; sid:6005857; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-narvexo-biz8-furem-kolan.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-narvexo-biz8-furem-kolan.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005858; classtype:social-engineering; sid:6005858; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-larsik-biz-kavmor-prondik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-larsik-biz-kavmor-prondik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005859; classtype:social-engineering; sid:6005859; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-ralvek-biz8-kormel-dasvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-ralvek-biz8-kormel-dasvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005860; classtype:social-engineering; sid:6005860; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alizahusman006.github.io/Netflix-clone-/)"; flow:established,to_server; http.uri; content:"/Netflix-clone-/"; startswith; fast_pattern; http.host; content:"alizahusman006.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005861; classtype:social-engineering; sid:6005861; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-renvok-biz8-zelmir-panvek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-renvok-biz8-zelmir-panvek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005862; classtype:social-engineering; sid:6005862; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-lormik-biz8-zenkar-falnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-lormik-biz8-zenkar-falnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005863; classtype:social-engineering; sid:6005863; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xefinity.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xefinity.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005864; classtype:social-engineering; sid:6005864; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-vomsar-biz-zelnik-prandel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-vomsar-biz-zelnik-prandel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005865; classtype:social-engineering; sid:6005865; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-talvor-biz8-prenko-lisvek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-talvor-biz8-prenko-lisvek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005866; classtype:social-engineering; sid:6005866; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-zolsar-biz-havnik-lendor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-zolsar-biz-havnik-lendor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005867; classtype:social-engineering; sid:6005867; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-calls.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-calls.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005868; classtype:social-engineering; sid:6005868; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-vorsik-biz-kramor-halvek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-vorsik-biz-kramor-halvek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005869; classtype:social-engineering; sid:6005869; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (berquna-gld-lartora-p4t1dk98.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"berquna-gld-lartora-p4t1dk98.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005870; classtype:social-engineering; sid:6005870; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-torlek-biz8-harsen-molvex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-torlek-biz8-harsen-molvex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005871; classtype:social-engineering; sid:6005871; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (protocol-validator.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"protocol-validator.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005872; classtype:social-engineering; sid:6005872; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qurnora-gld-varmita-a9x2fc75.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qurnora-gld-varmita-a9x2fc75.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005873; classtype:social-engineering; sid:6005873; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-kersik-biz-fondar-lomvek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-kersik-biz-fondar-lomvek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005874; classtype:social-engineering; sid:6005874; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-melvar-biz8-kreson-dalvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-melvar-biz8-kreson-dalvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005875; classtype:social-engineering; sid:6005875; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.chase.bioplass.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.chase.bioplass.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005876; classtype:social-engineering; sid:6005876; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-darek-biz8-murem-folin.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-darek-biz8-murem-folin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005877; classtype:social-engineering; sid:6005877; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (outstanding-aims-828395.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"outstanding-aims-828395.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005878; classtype:social-engineering; sid:6005878; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (l.ead.me/bgwq6Y)"; flow:established,to_server; http.uri; content:"/bgwq6Y"; startswith; fast_pattern; http.host; content:"l.ead.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005879; classtype:social-engineering; sid:6005879; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mkrjb946nhw-pldwffynt-5d8e7f-vzk49a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mkrjb946nhw-pldwffynt-5d8e7f-vzk49a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005880; classtype:social-engineering; sid:6005880; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xelqumi-gld-zarteni-p6t9kh15.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xelqumi-gld-zarteni-p6t9kh15.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005881; classtype:social-engineering; sid:6005881; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dekrypetedurah.github.io/dekrypetedurah/)"; flow:established,to_server; http.uri; content:"/dekrypetedurah/"; startswith; fast_pattern; http.host; content:"dekrypetedurah.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005882; classtype:social-engineering; sid:6005882; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-zarnok-biz8-felsik-kovlar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-zarnok-biz8-felsik-kovlar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005883; classtype:social-engineering; sid:6005883; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-moldek-biz8-havrik-prasen.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-moldek-biz8-havrik-prasen.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005884; classtype:social-engineering; sid:6005884; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-vexlan-biz8-polmer-drunix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-vexlan-biz8-polmer-drunix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005885; classtype:social-engineering; sid:6005885; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-harsok-biz-kemnor-folvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-harsok-biz-kemnor-folvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005886; classtype:social-engineering; sid:6005886; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-karnor-biz8-holsik-favrel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-karnor-biz8-holsik-favrel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005887; classtype:social-engineering; sid:6005887; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-dravik-biz8-korzen-lunfar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-dravik-biz8-korzen-lunfar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005888; classtype:social-engineering; sid:6005888; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-carnel-biz8-vorsan-kelrik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-carnel-biz8-vorsan-kelrik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005889; classtype:social-engineering; sid:6005889; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-vardek-biz-hesmor-kamril.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-vardek-biz-hesmor-kamril.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005890; classtype:social-engineering; sid:6005890; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-bravik-biz8-lorpex-vansel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-bravik-biz8-lorpex-vansel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005891; classtype:social-engineering; sid:6005891; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5-days.jp//zz/wmailt.html)"; flow:established,to_server; http.uri; content:"//zz/wmailt.html"; startswith; fast_pattern; http.host; content:"5-days.jp"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005892; classtype:social-engineering; sid:6005892; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-lorsik-biz8-venzar-fomrel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-lorsik-biz8-venzar-fomrel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005893; classtype:social-engineering; sid:6005893; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-helnor-biz8-zarsik-folmer.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-helnor-biz8-zarsik-folmer.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005894; classtype:social-engineering; sid:6005894; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (remarkable-tetragon-108690.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"remarkable-tetragon-108690.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005895; classtype:social-engineering; sid:6005895; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-torvex-biz8-halmer-sunvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-torvex-biz8-halmer-sunvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005896; classtype:social-engineering; sid:6005896; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-galek-biz8-lurep-domin.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-galek-biz8-lurep-domin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005897; classtype:social-engineering; sid:6005897; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-demnor-biz8-krasel-vornik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-demnor-biz8-krasel-vornik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005898; classtype:social-engineering; sid:6005898; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-hesdok-biz8-pravor-lamvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-hesdok-biz8-pravor-lamvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005899; classtype:social-engineering; sid:6005899; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-polvik-biz8-derlon-frasik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-polvik-biz8-derlon-frasik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005900; classtype:social-engineering; sid:6005900; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cwngs51lkwg-pxqzvpli-9ce26c-cwn77c-cku.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cwngs51lkwg-pxqzvpli-9ce26c-cwn77c-cku.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005901; classtype:social-engineering; sid:6005901; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kulsoomamjad-12.github.io/projects/)"; flow:established,to_server; http.uri; content:"/projects/"; startswith; fast_pattern; http.host; content:"kulsoomamjad-12.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005902; classtype:social-engineering; sid:6005902; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rupanshi07.github.io/ledger/)"; flow:established,to_server; http.uri; content:"/ledger/"; startswith; fast_pattern; http.host; content:"rupanshi07.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005903; classtype:social-engineering; sid:6005903; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-live-app-us-web.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-live-app-us-web.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005904; classtype:social-engineering; sid:6005904; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-dravsen-biz8-polvik-farnor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-dravsen-biz8-polvik-farnor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005905; classtype:social-engineering; sid:6005905; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (credipichincha--creditpichinch.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"credipichincha--creditpichinch.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005906; classtype:social-engineering; sid:6005906; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adityakumar763.github.io/movies_hub/)"; flow:established,to_server; http.uri; content:"/movies_hub/"; startswith; fast_pattern; http.host; content:"adityakumar763.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005907; classtype:social-engineering; sid:6005907; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mm.cdm0utjyqo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mm.cdm0utjyqo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005908; classtype:social-engineering; sid:6005908; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-darnel-biz8-somvik-pralor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-darnel-biz8-somvik-pralor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005909; classtype:social-engineering; sid:6005909; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-quarsik-biz8-drelon-maxvir.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-quarsik-biz8-drelon-maxvir.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005910; classtype:social-engineering; sid:6005910; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hbgpk41kzp-wxlng84mvr-9d2c6f-sjy17p.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hbgpk41kzp-wxlng84mvr-9d2c6f-sjy17p.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005911; classtype:social-engineering; sid:6005911; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-varnok-biz8-melsik-horzan.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-varnok-biz8-melsik-horzan.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005912; classtype:social-engineering; sid:6005912; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-melrek-biz8-kovsar-hazlor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-melrek-biz8-kovsar-hazlor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005913; classtype:social-engineering; sid:6005913; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-velran-biz8-forsik-molzen.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-velran-biz8-forsik-molzen.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005914; classtype:social-engineering; sid:6005914; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-page-builder--r3sb0x.replit.app/?eta)"; flow:established,to_server; http.uri; content:"/?eta"; startswith; fast_pattern; http.host; content:"secure-page-builder--r3sb0x.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005915; classtype:social-engineering; sid:6005915; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (naissess.xjfllxa.cn/eD9490/index)"; flow:established,to_server; http.uri; content:"/eD9490/index"; startswith; fast_pattern; http.host; content:"naissess.xjfllxa.cn"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005916; classtype:social-engineering; sid:6005916; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.ogloszenie8167.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"allegrolokalnie.ogloszenie8167.shop"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005917; classtype:social-engineering; sid:6005917; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (versilink-2025.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"versilink-2025.netlify.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005918; classtype:social-engineering; sid:6005918; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aruba-secure.connessione-sicura.online/ITALIA/index.php)"; flow:established,to_server; http.uri; content:"/ITALIA/index.php"; startswith; fast_pattern; http.host; content:"aruba-secure.connessione-sicura.online"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005919; classtype:social-engineering; sid:6005919; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (heropost.io/blog/)"; flow:established,to_server; http.uri; content:"/blog/"; startswith; fast_pattern; http.host; content:"heropost.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005920; classtype:social-engineering; sid:6005920; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.lokalna-01738.sbs/oferta/basen-intex-ultra-xtr-frame-732x366x132-cm-pe%C5%82ny-zestaw-pompa-piaskowa-akcesoria/962458323?fbclid=iwy2xjawtce5flehrua2flbqixmqbicmlketbyr0hyenm1exn3q3racnbjc3j0ywzhchbfawqbmaabhtvec92u3b3wwsvyybyyj2kbay2h-elv51ultx-9vjnz0czmgzerhf8l9duw_aem_ymw2zhmjyrgz7gmfnxwplg)"; flow:established,to_server; http.uri; content:"/oferta/basen-intex-ultra-xtr-frame-732x366x132-cm-pe%C5%82ny-zestaw-pompa-piaskowa-akcesoria/962458323?fbclid=iwy2xjawtce5flehrua2flbqixmqbicmlketbyr0hyenm1exn3q3racnbjc3j0ywzhchbfawqbmaabhtvec92u3b3wwsvyybyyj2kbay2h-elv51ultx-9vjnz0czmgzerhf8l9duw_aem_ymw2zhmjyrgz7gmfnxwplg"; startswith; fast_pattern; http.host; content:"allegrolokalnie.lokalna-01738.sbs"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005921; classtype:social-engineering; sid:6005921; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trxetr.autos/aUXEBboCE)"; flow:established,to_server; http.uri; content:"/aUXEBboCE"; startswith; fast_pattern; http.host; content:"trxetr.autos"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6005922; classtype:social-engineering; sid:6005922; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danaa-dompett-digitall.ukw.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danaa-dompett-digitall.ukw.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005923; classtype:social-engineering; sid:6005923; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j79w.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j79w.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005924; classtype:social-engineering; sid:6005924; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (swvcnm.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"swvcnm.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005925; classtype:social-engineering; sid:6005925; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.movie-ui-clone-mu.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.movie-ui-clone-mu.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005926; classtype:social-engineering; sid:6005926; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sandagdorx-dpg96yps2wp6.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sandagdorx-dpg96yps2wp6.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005927; classtype:social-engineering; sid:6005927; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alertdeiivery.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"alertdeiivery.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005928; classtype:social-engineering; sid:6005928; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portaltarifa.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portaltarifa.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005929; classtype:social-engineering; sid:6005929; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (performance-door.net/ap/signin)"; flow:established,to_server; http.uri; content:"/ap/signin"; startswith; fast_pattern; http.host; content:"performance-door.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005930; classtype:social-engineering; sid:6005930; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trustwallet-gaufre-7d87ec.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trustwallet-gaufre-7d87ec.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005931; classtype:social-engineering; sid:6005931; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sand1-bnb-bep20.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.sand1-bnb-bep20.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005932; classtype:social-engineering; sid:6005932; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinitymail-signin-begin.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinitymail-signin-begin.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005933; classtype:social-engineering; sid:6005933; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hal3.onlyevent.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hal3.onlyevent.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005934; classtype:social-engineering; sid:6005934; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (georgejones121.serv00.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"georgejones121.serv00.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005935; classtype:social-engineering; sid:6005935; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gemini.baogm.qzz.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gemini.baogm.qzz.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005936; classtype:social-engineering; sid:6005936; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yk1cxm-5nxu5-02b-rpv6-agq.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yk1cxm-5nxu5-02b-rpv6-agq.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005937; classtype:social-engineering; sid:6005937; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gemini-sx-login.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gemini-sx-login.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005938; classtype:social-engineering; sid:6005938; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faceboklogin123.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"faceboklogin123.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005939; classtype:social-engineering; sid:6005939; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paypal.myprocessing.help/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paypal.myprocessing.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005940; classtype:social-engineering; sid:6005940; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-com-start.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-com-start.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005941; classtype:social-engineering; sid:6005941; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.php-eth-back.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.php-eth-back.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005942; classtype:social-engineering; sid:6005942; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mspt.com.fj/ltc/index.php)"; flow:established,to_server; http.uri; content:"/ltc/index.php"; startswith; fast_pattern; http.host; content:"mspt.com.fj"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005943; classtype:social-engineering; sid:6005943; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (broadcastauthbtbusinessintel-loginapp.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"broadcastauthbtbusinessintel-loginapp.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005944; classtype:social-engineering; sid:6005944; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamaksextnsion.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metamaksextnsion.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005945; classtype:social-engineering; sid:6005945; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (membercenter-made-in-chlna-com.cleverapps.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"membercenter-made-in-chlna-com.cleverapps.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005946; classtype:social-engineering; sid:6005946; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j79z.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j79z.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005947; classtype:social-engineering; sid:6005947; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crespay.yecreat.web.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"crespay.yecreat.web.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005948; classtype:social-engineering; sid:6005948; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j80b.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j80b.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005949; classtype:social-engineering; sid:6005949; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spotifyopina-674.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spotifyopina-674.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005950; classtype:social-engineering; sid:6005950; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (start-live--ledger-app.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"start-live--ledger-app.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005951; classtype:social-engineering; sid:6005951; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram1010.blogspot.com/2023/05/blog-post.html?m=1)"; flow:established,to_server; http.uri; content:"/2023/05/blog-post.html?m=1"; startswith; fast_pattern; http.host; content:"instagram1010.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005952; classtype:social-engineering; sid:6005952; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (awsweb3apprunner-east0nsitecom.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"awsweb3apprunner-east0nsitecom.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005953; classtype:social-engineering; sid:6005953; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledzr-startt.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledzr-startt.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005954; classtype:social-engineering; sid:6005954; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct-harik-biz8-vurem-konel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct-harik-biz8-vurem-konel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005955; classtype:social-engineering; sid:6005955; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (online-zahlung-info.de/we/)"; flow:established,to_server; http.uri; content:"/we/"; startswith; fast_pattern; http.host; content:"online-zahlung-info.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005956; classtype:social-engineering; sid:6005956; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (filopotabsopauldi.com/?tag=epsilon)"; flow:established,to_server; http.uri; content:"/?tag=epsilon"; startswith; fast_pattern; http.host; content:"filopotabsopauldi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005957; classtype:social-engineering; sid:6005957; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (welcome-web3-bfnaelmomeimhlpmgjnjophhpkkoljpa.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"welcome-web3-bfnaelmomeimhlpmgjnjophhpkkoljpa.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005958; classtype:social-engineering; sid:6005958; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aomazzz69.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"aomazzz69.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005959; classtype:social-engineering; sid:6005959; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp-line.h5-whatapps.gd.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp-line.h5-whatapps.gd.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005960; classtype:social-engineering; sid:6005960; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (net-trezzor-wallet-data-bandwidth.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"net-trezzor-wallet-data-bandwidth.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005961; classtype:social-engineering; sid:6005961; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezor-wallet.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezor-wallet.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005962; classtype:social-engineering; sid:6005962; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (airbnb-frontend-ashen-three.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"airbnb-frontend-ashen-three.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005963; classtype:social-engineering; sid:6005963; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uixphldlogen.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uixphldlogen.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005964; classtype:social-engineering; sid:6005964; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wldsf42skrp-zbkpthb-0c3f8d-wlq87c.pages.dev/welcome_aboard)"; flow:established,to_server; http.uri; content:"/welcome_aboard"; startswith; fast_pattern; http.host; content:"wldsf42skrp-zbkpthb-0c3f8d-wlq87c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005965; classtype:social-engineering; sid:6005965; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (guileless-croissant-99ed77.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"guileless-croissant-99ed77.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005966; classtype:social-engineering; sid:6005966; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j79x.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j79x.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005967; classtype:social-engineering; sid:6005967; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blissful-pattern-066110.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"blissful-pattern-066110.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005968; classtype:social-engineering; sid:6005968; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mqde-in-china-com.cleverapps.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mqde-in-china-com.cleverapps.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005969; classtype:social-engineering; sid:6005969; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rabiakaneez379.github.io/CSS-Assignment-5)"; flow:established,to_server; http.uri; content:"/CSS-Assignment-5"; startswith; fast_pattern; http.host; content:"rabiakaneez379.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005970; classtype:social-engineering; sid:6005970; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j79y.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j79y.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005971; classtype:social-engineering; sid:6005971; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shimmering-liger-579c02.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shimmering-liger-579c02.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005972; classtype:social-engineering; sid:6005972; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-rho-wheat.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-rho-wheat.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005973; classtype:social-engineering; sid:6005973; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3507941.yj625348.web.hosting-test.net/1%20SFR)"; flow:established,to_server; http.uri; content:"/1%20SFR"; startswith; fast_pattern; http.host; content:"3507941.yj625348.web.hosting-test.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005974; classtype:social-engineering; sid:6005974; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chat.dial-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chat.dial-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005975; classtype:social-engineering; sid:6005975; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.swvcnm.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.swvcnm.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005976; classtype:social-engineering; sid:6005976; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.amazon-com-html-css-project.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-com-html-css-project.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005977; classtype:social-engineering; sid:6005977; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fanciful-babka-7cdc24.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fanciful-babka-7cdc24.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005978; classtype:social-engineering; sid:6005978; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rejectkyc-reviewunder.142-93-2-145.cpanel.site/signin?c_ds_na=iw8IKOGanx0ElXNYv89879gxN8LiX8lzViSywsf9KN&c_ds_no=%2A%2F%2A)"; flow:established,to_server; http.uri; content:"/signin?c_ds_na=iw8IKOGanx0ElXNYv89879gxN8LiX8lzViSywsf9KN&c_ds_no=%2A%2F%2A"; startswith; fast_pattern; http.host; content:"rejectkyc-reviewunder.142-93-2-145.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005979; classtype:social-engineering; sid:6005979; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (emersondasilva.github.io/home_instagram/)"; flow:established,to_server; http.uri; content:"/home_instagram/"; startswith; fast_pattern; http.host; content:"emersondasilva.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005980; classtype:social-engineering; sid:6005980; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amar777.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amar777.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005981; classtype:social-engineering; sid:6005981; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j79v.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j79v.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005982; classtype:social-engineering; sid:6005982; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (awsapprunner-west-0clinedcom.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"awsapprunner-west-0clinedcom.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005983; classtype:social-engineering; sid:6005983; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gfvcd4d93pl-klmqwuhy-4c1d9e-yh701a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gfvcd4d93pl-klmqwuhy-4c1d9e-yh701a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005984; classtype:social-engineering; sid:6005984; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.certsolution.org/uploads/ito/itoo/it/conto/noaccount.php)"; flow:established,to_server; http.uri; content:"/uploads/ito/itoo/it/conto/noaccount.php"; startswith; fast_pattern; http.host; content:"www.certsolution.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005985; classtype:social-engineering; sid:6005985; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (made-in-chlna-com.cleverapps.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"made-in-chlna-com.cleverapps.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005986; classtype:social-engineering; sid:6005986; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.4a365eut6r7tryisk5re6uj5eukajmfnhcsr45y5eia79w7wrezfkt6diwr7.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.4a365eut6r7tryisk5re6uj5eukajmfnhcsr45y5eia79w7wrezfkt6diwr7.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005987; classtype:social-engineering; sid:6005987; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pumpfunwallet.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pumpfunwallet.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005988; classtype:social-engineering; sid:6005988; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (backedbuy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"backedbuy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005989; classtype:social-engineering; sid:6005989; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j80d.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j80d.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005990; classtype:social-engineering; sid:6005990; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reserv-guestsupdtsite.com/477325793)"; flow:established,to_server; http.uri; content:"/477325793"; startswith; fast_pattern; http.host; content:"reserv-guestsupdtsite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005991; classtype:social-engineering; sid:6005991; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e-mairie-rdc.com/zm/2026NEW.html)"; flow:established,to_server; http.uri; content:"/zm/2026NEW.html"; startswith; fast_pattern; http.host; content:"e-mairie-rdc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005992; classtype:social-engineering; sid:6005992; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wizardhhhhhh.github.io/Web-Front-Page/)"; flow:established,to_server; http.uri; content:"/Web-Front-Page/"; startswith; fast_pattern; http.host; content:"wizardhhhhhh.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005993; classtype:social-engineering; sid:6005993; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (delightful-gnome-53def1.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"delightful-gnome-53def1.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005994; classtype:social-engineering; sid:6005994; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uniswap-protocol-dex-relay-v79.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uniswap-protocol-dex-relay-v79.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005995; classtype:social-engineering; sid:6005995; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.amazon-clone-rose-omega.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-clone-rose-omega.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005996; classtype:social-engineering; sid:6005996; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (opsohan58-prog.github.io/Spotify/)"; flow:established,to_server; http.uri; content:"/Spotify/"; startswith; fast_pattern; http.host; content:"opsohan58-prog.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005997; classtype:social-engineering; sid:6005997; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (muhammadahmad50012.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"muhammadahmad50012.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005998; classtype:social-engineering; sid:6005998; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (skm162.github.io/ResiDue)"; flow:established,to_server; http.uri; content:"/ResiDue"; startswith; fast_pattern; http.host; content:"skm162.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6005999; classtype:social-engineering; sid:6005999; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (router-connection.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"router-connection.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006000; classtype:social-engineering; sid:6006000; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qelvora-gld-zormavi-a5x8dp94.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qelvora-gld-zormavi-a5x8dp94.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006001; classtype:social-engineering; sid:6006001; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (primary-future-640426.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"primary-future-640426.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006002; classtype:social-engineering; sid:6006002; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-li-ve-auth.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-li-ve-auth.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006003; classtype:social-engineering; sid:6006003; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cute-moxie-aecee7.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cute-moxie-aecee7.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006004; classtype:social-engineering; sid:6006004; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robnhodlogexim.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"robnhodlogexim.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006005; classtype:social-engineering; sid:6006005; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rnicrosofonline-356service.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rnicrosofonline-356service.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006006; classtype:social-engineering; sid:6006006; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.webservice000auth-xfinity.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.webservice000auth-xfinity.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006007; classtype:social-engineering; sid:6006007; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newbreedlifearts.org/.well-known/acme-challenge/content/korea.html)"; flow:established,to_server; http.uri; content:"/.well-known/acme-challenge/content/korea.html"; startswith; fast_pattern; http.host; content:"newbreedlifearts.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006008; classtype:social-engineering; sid:6006008; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tzr-oemdj.destiny72.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tzr-oemdj.destiny72.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006009; classtype:social-engineering; sid:6006009; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.one.vocal-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.one.vocal-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006010; classtype:social-engineering; sid:6006010; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.x38v.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.x38v.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006011; classtype:social-engineering; sid:6006011; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.georgejones121.serv00.net/index3.php)"; flow:established,to_server; http.uri; content:"/index3.php"; startswith; fast_pattern; http.host; content:"www.georgejones121.serv00.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006012; classtype:social-engineering; sid:6006012; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tradecenter-mqde-in-china-com.cleverapps.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tradecenter-mqde-in-china-com.cleverapps.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006013; classtype:social-engineering; sid:6006013; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agenciatributbbiu.eu.cc/es)"; flow:established,to_server; http.uri; content:"/es"; startswith; fast_pattern; http.host; content:"agenciatributbbiu.eu.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006014; classtype:social-engineering; sid:6006014; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (priyankababu05.github.io/movie-stream-app)"; flow:established,to_server; http.uri; content:"/movie-stream-app"; startswith; fast_pattern; http.host; content:"priyankababu05.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006015; classtype:social-engineering; sid:6006015; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tradecenter-mqde-in-chlna-com.cleverapps.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tradecenter-mqde-in-chlna-com.cleverapps.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006016; classtype:social-engineering; sid:6006016; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-khaki-beta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-khaki-beta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006017; classtype:social-engineering; sid:6006017; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (javariakhalid425.github.io/Islamic-Audio-Platform/)"; flow:established,to_server; http.uri; content:"/Islamic-Audio-Platform/"; startswith; fast_pattern; http.host; content:"javariakhalid425.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006018; classtype:social-engineering; sid:6006018; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j79u.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j79u.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006019; classtype:social-engineering; sid:6006019; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct-lorek-biz8-hurem-savix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct-lorek-biz8-hurem-savix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006020; classtype:social-engineering; sid:6006020; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (consulta-pedagio.site/placa/debitos/ver-debitos1/)"; flow:established,to_server; http.uri; content:"/placa/debitos/ver-debitos1/"; startswith; fast_pattern; http.host; content:"consulta-pedagio.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006021; classtype:social-engineering; sid:6006021; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.rblxdopx.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.rblxdopx.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006022; classtype:social-engineering; sid:6006022; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mmrtyre23.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mmrtyre23.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006023; classtype:social-engineering; sid:6006023; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp-desk.h5-whatapps.gd.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp-desk.h5-whatapps.gd.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006024; classtype:social-engineering; sid:6006024; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhl-delivery-com.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dhl-delivery-com.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006025; classtype:social-engineering; sid:6006025; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (khanabdullah18555-source.github.io/Amazon-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-Clone"; startswith; fast_pattern; http.host; content:"khanabdullah18555-source.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006026; classtype:social-engineering; sid:6006026; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (terraza4sup.spahotel.guru/nl)"; flow:established,to_server; http.uri; content:"/nl"; startswith; fast_pattern; http.host; content:"terraza4sup.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006027; classtype:social-engineering; sid:6006027; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mobashop.topup-diamonds.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mobashop.topup-diamonds.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006028; classtype:social-engineering; sid:6006028; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (php-eth-back.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"php-eth-back.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006029; classtype:social-engineering; sid:6006029; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafybeihxp3cmskdb4nr76bocjhdgq32ykbfquxwakbdx33iehf44jxwuim.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafybeihxp3cmskdb4nr76bocjhdgq32ykbfquxwakbdx33iehf44jxwuim.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006030; classtype:social-engineering; sid:6006030; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freefireapk.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"freefireapk.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006031; classtype:social-engineering; sid:6006031; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4a365eut6r7tryisk5re6uj5eukajmfnhcsr45y5eia79w7wrezfkt6diwr7.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4a365eut6r7tryisk5re6uj5eukajmfnhcsr45y5eia79w7wrezfkt6diwr7.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006032; classtype:social-engineering; sid:6006032; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netclone08.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netclone08.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006033; classtype:social-engineering; sid:6006033; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (finessa-com.eu.cc/es)"; flow:established,to_server; http.uri; content:"/es"; startswith; fast_pattern; http.host; content:"finessa-com.eu.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006034; classtype:social-engineering; sid:6006034; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ar24-sigma.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ar24-sigma.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006035; classtype:social-engineering; sid:6006035; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cn850486.tw1.ru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cn850486.tw1.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006036; classtype:social-engineering; sid:6006036; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prolance.navybor.com/d150wp/qcftozjy/)"; flow:established,to_server; http.uri; content:"/d150wp/qcftozjy/"; startswith; fast_pattern; http.host; content:"prolance.navybor.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006037; classtype:social-engineering; sid:6006037; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.amazon-clone-mauve-beta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-clone-mauve-beta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006038; classtype:social-engineering; sid:6006038; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (protocol-node-mu.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"protocol-node-mu.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006039; classtype:social-engineering; sid:6006039; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.airbnb-frontend-ashen-three.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.airbnb-frontend-ashen-three.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006040; classtype:social-engineering; sid:6006040; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.amazon-clone-khaki-beta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazon-clone-khaki-beta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006041; classtype:social-engineering; sid:6006041; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ujjaldolui1234-debug.github.io/Amazone-Clone-3)"; flow:established,to_server; http.uri; content:"/Amazone-Clone-3"; startswith; fast_pattern; http.host; content:"ujjaldolui1234-debug.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006042; classtype:social-engineering; sid:6006042; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moodwellnesslounge.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moodwellnesslounge.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006043; classtype:social-engineering; sid:6006043; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-mauve-beta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-mauve-beta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006044; classtype:social-engineering; sid:6006044; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (glelcbd.com/move)"; flow:established,to_server; http.uri; content:"/move"; startswith; fast_pattern; http.host; content:"glelcbd.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006045; classtype:social-engineering; sid:6006045; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (one.vocal-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"one.vocal-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006046; classtype:social-engineering; sid:6006046; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thelightrays.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"thelightrays.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006047; classtype:social-engineering; sid:6006047; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qx9nd-2i89w1-0978b4-s6o-mzhq8.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qx9nd-2i89w1-0978b4-s6o-mzhq8.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006048; classtype:social-engineering; sid:6006048; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (avanteshipping.com/wp-content/themes/eb/)"; flow:established,to_server; http.uri; content:"/wp-content/themes/eb/"; startswith; fast_pattern; http.host; content:"avanteshipping.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006049; classtype:social-engineering; sid:6006049; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (animated-biscochitos-d09876.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"animated-biscochitos-d09876.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006050; classtype:social-engineering; sid:6006050; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (u33h.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"u33h.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006051; classtype:social-engineering; sid:6006051; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gleeful-florentine-0a05ec.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gleeful-florentine-0a05ec.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006052; classtype:social-engineering; sid:6006052; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klmqw882lk-yhnujplx-8a1d9e-klm51c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"klmqw882lk-yhnujplx-8a1d9e-klm51c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006053; classtype:social-engineering; sid:6006053; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kuaocainloin.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kuaocainloin.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006054; classtype:social-engineering; sid:6006054; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (famous-khapse-ed9951.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"famous-khapse-ed9951.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006055; classtype:social-engineering; sid:6006055; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mip-sunrise-ch.jimdofree.com/?preview_sid=896194)"; flow:established,to_server; http.uri; content:"/?preview_sid=896194"; startswith; fast_pattern; http.host; content:"mip-sunrise-ch.jimdofree.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006056; classtype:social-engineering; sid:6006056; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wa.dial-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wa.dial-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006057; classtype:social-engineering; sid:6006057; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (genuine-dessert-577396.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"genuine-dessert-577396.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006058; classtype:social-engineering; sid:6006058; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j80a.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"j80a.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006059; classtype:social-engineering; sid:6006059; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (proxy-router-eight.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"proxy-router-eight.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006060; classtype:social-engineering; sid:6006060; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth0-ms-doc.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auth0-ms-doc.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006061; classtype:social-engineering; sid:6006061; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-1ft2ad0jn.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-1ft2ad0jn.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006062; classtype:social-engineering; sid:6006062; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kynetra.info/Y2gtZmVkZXgtMjAyNg/?u=83C1655&e=zenan2@d6ec2104a27c68a48d1cdea053dc14bf2152.com&s3=&s4=&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/Y2gtZmVkZXgtMjAyNg/?u=83C1655&e=zenan2@d6ec2104a27c68a48d1cdea053dc14bf2152.com&s3=&s4=&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"kynetra.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006063; classtype:social-engineering; sid:6006063; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-rose-omega.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-rose-omega.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006064; classtype:social-engineering; sid:6006064; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (proxy-rpc.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"proxy-rpc.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006065; classtype:social-engineering; sid:6006065; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cpanel204.turbify.biz/~rmj13givf32a0k5f/wp-content/uploads/2026/02/)"; flow:established,to_server; http.uri; content:"/~rmj13givf32a0k5f/wp-content/uploads/2026/02/"; startswith; fast_pattern; http.host; content:"cpanel204.turbify.biz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006066; classtype:social-engineering; sid:6006066; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (statuesque-swan-4e547a.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"statuesque-swan-4e547a.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006067; classtype:social-engineering; sid:6006067; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (movie-ui-clone-mu.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"movie-ui-clone-mu.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006068; classtype:social-engineering; sid:6006068; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (exactlypradip.github.io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"exactlypradip.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006069; classtype:social-engineering; sid:6006069; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (snhgj63lowi-xvtly103nhb-3a7c8f-ltp91p.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"snhgj63lowi-xvtly103nhb-3a7c8f-ltp91p.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006070; classtype:social-engineering; sid:6006070; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robl0x-1.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"robl0x-1.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006071; classtype:social-engineering; sid:6006071; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mycharterupdatelink.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mycharterupdatelink.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006072; classtype:social-engineering; sid:6006072; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ar24-sigma.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ar24-sigma.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006073; classtype:social-engineering; sid:6006073; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinitywebnotification.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinitywebnotification.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006074; classtype:social-engineering; sid:6006074; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ansh965-code.github.io/Netflix--clone/)"; flow:established,to_server; http.uri; content:"/Netflix--clone/"; startswith; fast_pattern; http.host; content:"ansh965-code.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006075; classtype:social-engineering; sid:6006075; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zeexpress-deliverys.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zeexpress-deliverys.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006076; classtype:social-engineering; sid:6006076; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (altanewvistalkunden.de/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"altanewvistalkunden.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006077; classtype:social-engineering; sid:6006077; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-ze24hbebidas.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-ze24hbebidas.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006078; classtype:social-engineering; sid:6006078; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (truckilasoudt.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"truckilasoudt.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006079; classtype:social-engineering; sid:6006079; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.wa.one-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.wa.one-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006080; classtype:social-engineering; sid:6006080; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stationnement-antai-gouv-infractiion.pumpa.sk/fr/redirect)"; flow:established,to_server; http.uri; content:"/fr/redirect"; startswith; fast_pattern; http.host; content:"stationnement-antai-gouv-infractiion.pumpa.sk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006081; classtype:social-engineering; sid:6006081; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylaterr.pklc.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylaterr.pklc.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006082; classtype:social-engineering; sid:6006082; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (glory.ring-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"glory.ring-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006083; classtype:social-engineering; sid:6006083; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bundleadmin.azurewebsites.net/commission/planlist)"; flow:established,to_server; http.uri; content:"/commission/planlist"; startswith; fast_pattern; http.host; content:"bundleadmin.azurewebsites.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006084; classtype:social-engineering; sid:6006084; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-site-105081-102507.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"my-site-105081-102507.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006085; classtype:social-engineering; sid:6006085; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (interface-dapp.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"interface-dapp.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006086; classtype:social-engineering; sid:6006086; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myareaplans.com/providers/att)"; flow:established,to_server; http.uri; content:"/providers/att"; startswith; fast_pattern; http.host; content:"myareaplans.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006087; classtype:social-engineering; sid:6006087; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (demo2.jasinfotech.co.in/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"demo2.jasinfotech.co.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006088; classtype:social-engineering; sid:6006088; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reprog-mr-prive.bolt.host/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"reprog-mr-prive.bolt.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006089; classtype:social-engineering; sid:6006089; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trueagleeful8z-bwgvhcfadmgfa6hz.z03.azurefd.net/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"trueagleeful8z-bwgvhcfadmgfa6hz.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006090; classtype:social-engineering; sid:6006090; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chandan9911.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"chandan9911.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006091; classtype:social-engineering; sid:6006091; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xiaoyistore.rumahsakit.de/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xiaoyistore.rumahsakit.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006092; classtype:social-engineering; sid:6006092; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ldv13fylcpe12907fdg2d0g9mrwluny11cecstc6pd06n5tjrpvw.vercel.app/ldZzj2vp-VU3IJso5-3pDocW5j.html)"; flow:established,to_server; http.uri; content:"/ldZzj2vp-VU3IJso5-3pDocW5j.html"; startswith; fast_pattern; http.host; content:"ldv13fylcpe12907fdg2d0g9mrwluny11cecstc6pd06n5tjrpvw.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006093; classtype:social-engineering; sid:6006093; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (finitymail.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"finitymail.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006094; classtype:social-engineering; sid:6006094; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (palm.one-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"palm.one-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006095; classtype:social-engineering; sid:6006095; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sonamsinha0404-dev.github.io/Spotify-Clone/)"; flow:established,to_server; http.uri; content:"/Spotify-Clone/"; startswith; fast_pattern; http.host; content:"sonamsinha0404-dev.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006096; classtype:social-engineering; sid:6006096; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ubsourcecoltd.aptien.com/upload/home/)"; flow:established,to_server; http.uri; content:"/upload/home/"; startswith; fast_pattern; http.host; content:"ubsourcecoltd.aptien.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006097; classtype:social-engineering; sid:6006097; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fraoufruitspoukdhn.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fraoufruitspoukdhn.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006098; classtype:social-engineering; sid:6006098; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ldgre-lives-wlt.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ldgre-lives-wlt.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006099; classtype:social-engineering; sid:6006099; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robhnhodlognx.gitbook.io/account)"; flow:established,to_server; http.uri; content:"/account"; startswith; fast_pattern; http.host; content:"robhnhodlognx.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006100; classtype:social-engineering; sid:6006100; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ldv16s0zdgcg29077qw9ksgf4qww74mgmgecsdf4kcs007zzkdvw.vercel.app/ldZzj2vp-VU3IJso5-3pDocW5j.html)"; flow:established,to_server; http.uri; content:"/ldZzj2vp-VU3IJso5-3pDocW5j.html"; startswith; fast_pattern; http.host; content:"ldv16s0zdgcg29077qw9ksgf4qww74mgmgecsdf4kcs007zzkdvw.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006101; classtype:social-engineering; sid:6006101; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docs-ledgerr-us-oo.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"docs-ledgerr-us-oo.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006102; classtype:social-engineering; sid:6006102; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (walletapp.skin/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"walletapp.skin"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006103; classtype:social-engineering; sid:6006103; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spring-bush-e4e9.sfersjgd.workers.dev/device-info.html?chatId=7104373475)"; flow:established,to_server; http.uri; content:"/device-info.html?chatId=7104373475"; startswith; fast_pattern; http.host; content:"spring-bush-e4e9.sfersjgd.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006104; classtype:social-engineering; sid:6006104; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.breeze.one-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.breeze.one-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006105; classtype:social-engineering; sid:6006105; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mydpd.at/meine-pakete)"; flow:established,to_server; http.uri; content:"/meine-pakete"; startswith; fast_pattern; http.host; content:"www.mydpd.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006106; classtype:social-engineering; sid:6006106; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (muktoprohacked-del.github.io/Top-news-bd-02/)"; flow:established,to_server; http.uri; content:"/Top-news-bd-02/"; startswith; fast_pattern; http.host; content:"muktoprohacked-del.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006107; classtype:social-engineering; sid:6006107; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (carib-airsol.com/pas1.php)"; flow:established,to_server; http.uri; content:"/pas1.php"; startswith; fast_pattern; http.host; content:"carib-airsol.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006108; classtype:social-engineering; sid:6006108; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.danaa-paaylaateer.axza.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mail.danaa-paaylaateer.axza.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006109; classtype:social-engineering; sid:6006109; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-bebidas-delivery.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-bebidas-delivery.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006110; classtype:social-engineering; sid:6006110; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crystal.text-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"crystal.text-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006111; classtype:social-engineering; sid:6006111; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help.valverestore.com/id/76561198219634441)"; flow:established,to_server; http.uri; content:"/id/76561198219634441"; startswith; fast_pattern; http.host; content:"help.valverestore.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006112; classtype:social-engineering; sid:6006112; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arihant2606.github.io/netflix-homepage-clone/)"; flow:established,to_server; http.uri; content:"/netflix-homepage-clone/"; startswith; fast_pattern; http.host; content:"arihant2606.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006113; classtype:social-engineering; sid:6006113; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rd1new-access.altanewvistalkunden.de/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rd1new-access.altanewvistalkunden.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006114; classtype:social-engineering; sid:6006114; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marycar.com.br/Adobe/Acrobat_Reader/)"; flow:established,to_server; http.uri; content:"/Adobe/Acrobat_Reader/"; startswith; fast_pattern; http.host; content:"marycar.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006115; classtype:social-engineering; sid:6006115; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wa.one-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wa.one-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006116; classtype:social-engineering; sid:6006116; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (muddy-dew-a377.cclopllqusqsfdr.workers.dev/facebook.com-1027275509)"; flow:established,to_server; http.uri; content:"/facebook.com-1027275509"; startswith; fast_pattern; http.host; content:"muddy-dew-a377.cclopllqusqsfdr.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006117; classtype:social-engineering; sid:6006117; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.trk.sc/zgA00PA9)"; flow:established,to_server; http.uri; content:"/zgA00PA9"; startswith; fast_pattern; http.host; content:"s.trk.sc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006118; classtype:social-engineering; sid:6006118; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prajwalbutte.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"prajwalbutte.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006119; classtype:social-engineering; sid:6006119; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (user.mxmaple.com/6a5fa47c8d790ef57be01b08/l/sJi1tCD2O3g4jY5Nu?rn=)"; flow:established,to_server; http.uri; content:"/6a5fa47c8d790ef57be01b08/l/sJi1tCD2O3g4jY5Nu?rn="; startswith; fast_pattern; http.host; content:"user.mxmaple.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006120; classtype:social-engineering; sid:6006120; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (breeze.one-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"breeze.one-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006121; classtype:social-engineering; sid:6006121; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brilliant-dragon-98a015.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"brilliant-dragon-98a015.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006122; classtype:social-engineering; sid:6006122; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct-rurel-biz8-kamex-folin.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct-rurel-biz8-kamex-folin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006123; classtype:social-engineering; sid:6006123; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.inicieagora2026.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.inicieagora2026.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006124; classtype:social-engineering; sid:6006124; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (checkpageadsdie2026.netlify.app/live/)"; flow:established,to_server; http.uri; content:"/live/"; startswith; fast_pattern; http.host; content:"checkpageadsdie2026.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006125; classtype:social-engineering; sid:6006125; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clubedoprogresso.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"clubedoprogresso.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006126; classtype:social-engineering; sid:6006126; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (semhexasim-maissemroxinhojamais2027.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"semhexasim-maissemroxinhojamais2027.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006127; classtype:social-engineering; sid:6006127; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acme-hml-limits-nubank-rate-limits.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"acme-hml-limits-nubank-rate-limits.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006128; classtype:social-engineering; sid:6006128; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sucursallvirtual.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sucursallvirtual.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006129; classtype:social-engineering; sid:6006129; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.login-access.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.login-access.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006130; classtype:social-engineering; sid:6006130; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blpqr2e71kq-wjnhfplos-0c7d9a-lxp53w.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"blpqr2e71kq-wjnhfplos-0c7d9a-lxp53w.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006131; classtype:social-engineering; sid:6006131; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newspeciallshopp.topup-diamonds.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"newspeciallshopp.topup-diamonds.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006132; classtype:social-engineering; sid:6006132; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3rc32cr3.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3rc32cr3.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006133; classtype:social-engineering; sid:6006133; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (landing-0100.brighttide.info/Y2gtZmVkZXgtMjAyNg/?u=161C1666&e=example@domain.invalid&s3=example&s4=domain&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/Y2gtZmVkZXgtMjAyNg/?u=161C1666&e=example@domain.invalid&s3=example&s4=domain&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"landing-0100.brighttide.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006134; classtype:social-engineering; sid:6006134; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unaware-violet-zdvlmj66.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"unaware-violet-zdvlmj66.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006135; classtype:social-engineering; sid:6006135; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (attyahoomail.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"attyahoomail.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006136; classtype:social-engineering; sid:6006136; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zeexpress-drinks.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zeexpress-drinks.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006137; classtype:social-engineering; sid:6006137; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-kamvik-biz-prondor-hazsel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-kamvik-biz-prondor-hazsel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006138; classtype:social-engineering; sid:6006138; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rupesh2507-eng.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"rupesh2507-eng.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006139; classtype:social-engineering; sid:6006139; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atrutgh.com/Djdfhb2DH7udjf/help/?id=vMvEeKyS)"; flow:established,to_server; http.uri; content:"/Djdfhb2DH7udjf/help/?id=vMvEeKyS"; startswith; fast_pattern; http.host; content:"atrutgh.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006140; classtype:social-engineering; sid:6006140; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login-access.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login-access.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006141; classtype:social-engineering; sid:6006141; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.19981.buzz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.19981.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006142; classtype:social-engineering; sid:6006142; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.060827.com/wp-admin/.wp-languages/)"; flow:established,to_server; http.uri; content:"/wp-admin/.wp-languages/"; startswith; fast_pattern; http.host; content:"m.060827.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006143; classtype:social-engineering; sid:6006143; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aux-adobeacrobat466547783doc.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aux-adobeacrobat466547783doc.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006144; classtype:social-engineering; sid:6006144; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bobv3.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bobv3.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006145; classtype:social-engineering; sid:6006145; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.global-mail.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.global-mail.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006146; classtype:social-engineering; sid:6006146; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinity222036.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinity222036.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006147; classtype:social-engineering; sid:6006147; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ldv1w5re9rca2907w67tqhgufn9m47ingeecsurj6r496aonbtvw.vercel.app/ldZzj2vp-VU3IJso5-3pDocW5j.html)"; flow:established,to_server; http.uri; content:"/ldZzj2vp-VU3IJso5-3pDocW5j.html"; startswith; fast_pattern; http.host; content:"ldv1w5re9rca2907w67tqhgufn9m47ingeecsurj6r496aonbtvw.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006148; classtype:social-engineering; sid:6006148; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (track-sp05.ecoexplorir.info/ga/click/2-17812221-39-12771-24914-13823-549c4a8f27-a292529ebd)"; flow:established,to_server; http.uri; content:"/ga/click/2-17812221-39-12771-24914-13823-549c4a8f27-a292529ebd"; startswith; fast_pattern; http.host; content:"track-sp05.ecoexplorir.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006149; classtype:social-engineering; sid:6006149; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myshoip-7-11-com-tw.eknyvgt9.xyz/ht/kefu.php?ClickID=56&amount=0.00)"; flow:established,to_server; http.uri; content:"/ht/kefu.php?ClickID=56&amount=0.00"; startswith; fast_pattern; http.host; content:"myshoip-7-11-com-tw.eknyvgt9.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006150; classtype:social-engineering; sid:6006150; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zeexpresss-24horas.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zeexpresss-24horas.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006151; classtype:social-engineering; sid:6006151; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dravor-qunix-a17db5-thjj-z2406adv.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dravor-qunix-a17db5-thjj-z2406adv.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006152; classtype:social-engineering; sid:6006152; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (doc-mkvelinb.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"doc-mkvelinb.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006153; classtype:social-engineering; sid:6006153; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mikka-style.ro/event/aDobe.html)"; flow:established,to_server; http.uri; content:"/event/aDobe.html"; startswith; fast_pattern; http.host; content:"mikka-style.ro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006154; classtype:social-engineering; sid:6006154; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h5.waves-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"h5.waves-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006155; classtype:social-engineering; sid:6006155; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metasecurity3.github.io/secure84384/)"; flow:established,to_server; http.uri; content:"/secure84384/"; startswith; fast_pattern; http.host; content:"metasecurity3.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006156; classtype:social-engineering; sid:6006156; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (evoluasemfronteiras.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"evoluasemfronteiras.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006157; classtype:social-engineering; sid:6006157; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (txmkn81mjwy-pjbrqren-8b1e4f-zb833a.pages.dev/welcome_aboard)"; flow:established,to_server; http.uri; content:"/welcome_aboard"; startswith; fast_pattern; http.host; content:"txmkn81mjwy-pjbrqren-8b1e4f-zb833a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006158; classtype:social-engineering; sid:6006158; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (umaima8920.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"umaima8920.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006159; classtype:social-engineering; sid:6006159; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (authentication.ms/E.HDdbknRu1pRr-_8?/domain=rwe.com?teams=Collaborative-Teams)"; flow:established,to_server; http.uri; content:"/E.HDdbknRu1pRr-_8?/domain=rwe.com?teams=Collaborative-Teams"; startswith; fast_pattern; http.host; content:"authentication.ms"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006160; classtype:social-engineering; sid:6006160; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhamaansh76-code.github.io/Spotify-Clone/)"; flow:established,to_server; http.uri; content:"/Spotify-Clone/"; startswith; fast_pattern; http.host; content:"dhamaansh76-code.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006161; classtype:social-engineering; sid:6006161; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (v0-instagram-accounts.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"v0-instagram-accounts.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006162; classtype:social-engineering; sid:6006162; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (61ben.proxer.cc/bs/info/)"; flow:established,to_server; http.uri; content:"/bs/info/"; startswith; fast_pattern; http.host; content:"61ben.proxer.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006163; classtype:social-engineering; sid:6006163; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (avvaaa0988auggss.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"avvaaa0988auggss.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006164; classtype:social-engineering; sid:6006164; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.doc-mkvelinb.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.doc-mkvelinb.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006165; classtype:social-engineering; sid:6006165; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (peco.digick.jp/loginit/)"; flow:established,to_server; http.uri; content:"/loginit/"; startswith; fast_pattern; http.host; content:"peco.digick.jp"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006166; classtype:social-engineering; sid:6006166; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp.prosulequipamentos.com.br/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp.prosulequipamentos.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006167; classtype:social-engineering; sid:6006167; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (geminzilogin.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"geminzilogin.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006168; classtype:social-engineering; sid:6006168; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abhinav962173.github.io/Spotify-clone/)"; flow:established,to_server; http.uri; content:"/Spotify-clone/"; startswith; fast_pattern; http.host; content:"abhinav962173.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006169; classtype:social-engineering; sid:6006169; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhl8466478o.s3.us-east-2.amazonaws.com/dhl%20(2)%20(2).html)"; flow:established,to_server; http.uri; content:"/dhl%20(2)%20(2).html"; startswith; fast_pattern; http.host; content:"dhl8466478o.s3.us-east-2.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006170; classtype:social-engineering; sid:6006170; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9000-firebase-deet-1771247947918.cluster-lu4mup47g5gm4rtyvhzpwbfadi.cloudworkstations.dev/?monospaceUid=329496)"; flow:established,to_server; http.uri; content:"/?monospaceUid=329496"; startswith; fast_pattern; http.host; content:"9000-firebase-deet-1771247947918.cluster-lu4mup47g5gm4rtyvhzpwbfadi.cloudworkstations.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006171; classtype:social-engineering; sid:6006171; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (node-layer.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"node-layer.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006172; classtype:social-engineering; sid:6006172; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.team-p.my/p/hlsf-hlpb/gtaidlqn)"; flow:established,to_server; http.uri; content:"/p/hlsf-hlpb/gtaidlqn"; startswith; fast_pattern; http.host; content:"s.team-p.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006173; classtype:social-engineering; sid:6006173; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (185.99.134.13.sslip.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"185.99.134.13.sslip.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006174; classtype:social-engineering; sid:6006174; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whatsapp.prosulequipamentos.com.br/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsapp.prosulequipamentos.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006175; classtype:social-engineering; sid:6006175; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct-furel-biz8-zamek-roniv.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct-furel-biz8-zamek-roniv.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006176; classtype:social-engineering; sid:6006176; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h5.ring-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"h5.ring-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006177; classtype:social-engineering; sid:6006177; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (urlz.li/ea1ff161)"; flow:established,to_server; http.uri; content:"/ea1ff161"; startswith; fast_pattern; http.host; content:"urlz.li"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006178; classtype:social-engineering; sid:6006178; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zeexpress-online.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zeexpress-online.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006179; classtype:social-engineering; sid:6006179; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mailbox-dp8ra6c793ra.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mailbox-dp8ra6c793ra.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006180; classtype:social-engineering; sid:6006180; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aruty.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aruty.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006181; classtype:social-engineering; sid:6006181; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zeexpress-deliverys.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zeexpress-deliverys.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006182; classtype:social-engineering; sid:6006182; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sign-in-2047e4.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sign-in-2047e4.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006183; classtype:social-engineering; sid:6006183; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (land07.smartguidetech.info/MTQyNWdmZm4/?u=162C1604&e=qwqe%40nhtuan.com&s3=&s4=&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/MTQyNWdmZm4/?u=162C1604&e=qwqe%40nhtuan.com&s3=&s4=&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"land07.smartguidetech.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006184; classtype:social-engineering; sid:6006184; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (siddhipatel29.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"siddhipatel29.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006185; classtype:social-engineering; sid:6006185; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (global-mail.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"global-mail.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006186; classtype:social-engineering; sid:6006186; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fundof-10assinaturacloudupgrade2026.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"fundof-10assinaturacloudupgrade2026.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006187; classtype:social-engineering; sid:6006187; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zeexpress-bebidas24h.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zeexpress-bebidas24h.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006188; classtype:social-engineering; sid:6006188; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danaa-iindonesiaa.sqq.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danaa-iindonesiaa.sqq.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006189; classtype:social-engineering; sid:6006189; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (garantibbvafirsatlri.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"garantibbvafirsatlri.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006190; classtype:social-engineering; sid:6006190; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (13aw2r55bh.dual3231-1.workers.dev/l/QEWvWrkI-z0)"; flow:established,to_server; http.uri; content:"/l/QEWvWrkI-z0"; startswith; fast_pattern; http.host; content:"13aw2r55bh.dual3231-1.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006191; classtype:social-engineering; sid:6006191; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vklcklckkfk.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vklcklckkfk.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006192; classtype:social-engineering; sid:6006192; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cadreservice.co.uk/cgi/)"; flow:established,to_server; http.uri; content:"/cgi/"; startswith; fast_pattern; http.host; content:"cadreservice.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006193; classtype:social-engineering; sid:6006193; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rockstargamesloja.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rockstargamesloja.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006194; classtype:social-engineering; sid:6006194; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xiaoyistore.rumahsakit.de/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xiaoyistore.rumahsakit.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006195; classtype:social-engineering; sid:6006195; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wvwintermatico.persona.ingreso.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wvwintermatico.persona.ingreso.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006196; classtype:social-engineering; sid:6006196; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zeexpress-48h.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zeexpress-48h.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006197; classtype:social-engineering; sid:6006197; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (priteshdataengineer.github.io/netflix1--clone/)"; flow:established,to_server; http.uri; content:"/netflix1--clone/"; startswith; fast_pattern; http.host; content:"priteshdataengineer.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006198; classtype:social-engineering; sid:6006198; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newsmidasbuy.game-en.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"newsmidasbuy.game-en.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006199; classtype:social-engineering; sid:6006199; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.logcoder-fawn.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.logcoder-fawn.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006200; classtype:social-engineering; sid:6006200; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gemini-login-8.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gemini-login-8.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006201; classtype:social-engineering; sid:6006201; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brohihafsa57-hash.github.io/Netflix-Clone)"; flow:established,to_server; http.uri; content:"/Netflix-Clone"; startswith; fast_pattern; http.host; content:"brohihafsa57-hash.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006202; classtype:social-engineering; sid:6006202; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amna341.github.io/E-commerce-store)"; flow:established,to_server; http.uri; content:"/E-commerce-store"; startswith; fast_pattern; http.host; content:"amna341.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006203; classtype:social-engineering; sid:6006203; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-att-com-17bd1d.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"account-att-com-17bd1d.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006204; classtype:social-engineering; sid:6006204; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faccebook.com.vn/timbannaygap03082026us?a)"; flow:established,to_server; http.uri; content:"/timbannaygap03082026us?a"; startswith; fast_pattern; http.host; content:"faccebook.com.vn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006205; classtype:social-engineering; sid:6006205; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (viraj-9.github.io/Spotify-Clone/)"; flow:established,to_server; http.uri; content:"/Spotify-Clone/"; startswith; fast_pattern; http.host; content:"viraj-9.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006206; classtype:social-engineering; sid:6006206; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.factiliate.de/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.factiliate.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006207; classtype:social-engineering; sid:6006207; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-tip.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-tip.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006208; classtype:social-engineering; sid:6006208; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitywebmailpagesecurityalert.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitywebmailpagesecurityalert.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006209; classtype:social-engineering; sid:6006209; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (convertmytub.com/cateringworks/download.html)"; flow:established,to_server; http.uri; content:"/cateringworks/download.html"; startswith; fast_pattern; http.host; content:"convertmytub.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006210; classtype:social-engineering; sid:6006210; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gregdsd.s3.us-west-1.amazonaws.com/yr.html)"; flow:established,to_server; http.uri; content:"/yr.html"; startswith; fast_pattern; http.host; content:"gregdsd.s3.us-west-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006211; classtype:social-engineering; sid:6006211; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gpcconcrete.co.nz/tendd/two/login.php)"; flow:established,to_server; http.uri; content:"/tendd/two/login.php"; startswith; fast_pattern; http.host; content:"www.gpcconcrete.co.nz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006212; classtype:social-engineering; sid:6006212; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (voicemessage-memo.pages.dev/?error=login_required)"; flow:established,to_server; http.uri; content:"/?error=login_required"; startswith; fast_pattern; http.host; content:"voicemessage-memo.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006213; classtype:social-engineering; sid:6006213; rev:1; metadata: signature_severity Major, created_et 2026_08_03;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-norek-biz8-luzam-firev.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-norek-biz8-luzam-firev.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006214; classtype:social-engineering; sid:6006214; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.surainforseg.com/assets/images_seleccion)"; flow:established,to_server; http.uri; content:"/assets/images_seleccion"; startswith; fast_pattern; http.host; content:"www.surainforseg.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006215; classtype:social-engineering; sid:6006215; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wa.call-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wa.call-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006216; classtype:social-engineering; sid:6006216; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tlkt0kshop.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tlkt0kshop.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006217; classtype:social-engineering; sid:6006217; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mighty.ring-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mighty.ring-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006218; classtype:social-engineering; sid:6006218; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dpkmechanical.com.au/scopes/Server.html?eta=seret@f806b99a3ad3d3f60513b31a81d3141b504a.org)"; flow:established,to_server; http.uri; content:"/scopes/Server.html?eta=seret@f806b99a3ad3d3f60513b31a81d3141b504a.org"; startswith; fast_pattern; http.host; content:"www.dpkmechanical.com.au"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006219; classtype:social-engineering; sid:6006219; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.97ee6.catex.at/cnbcard/web_sms_activate.php)"; flow:established,to_server; http.uri; content:"/cnbcard/web_sms_activate.php"; startswith; fast_pattern; http.host; content:"www.97ee6.catex.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006220; classtype:social-engineering; sid:6006220; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebooksetup.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebooksetup.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006221; classtype:social-engineering; sid:6006221; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-lafor-biz8-durem-zikel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-lafor-biz8-durem-zikel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006222; classtype:social-engineering; sid:6006222; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vmi3479190.contaboserver.net/Cs/COR/COR/corr.php)"; flow:established,to_server; http.uri; content:"/Cs/COR/COR/corr.php"; startswith; fast_pattern; http.host; content:"vmi3479190.contaboserver.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006223; classtype:social-engineering; sid:6006223; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-gurev-biz8-mafor-kidel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-gurev-biz8-mafor-kidel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006224; classtype:social-engineering; sid:6006224; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creditoseguronu.online/presell/index.html)"; flow:established,to_server; http.uri; content:"/presell/index.html"; startswith; fast_pattern; http.host; content:"creditoseguronu.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006225; classtype:social-engineering; sid:6006225; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-dsktop.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-dsktop.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006226; classtype:social-engineering; sid:6006226; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-dorvurin-biz8-sorel-fanum.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-dorvurin-biz8-sorel-fanum.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006227; classtype:social-engineering; sid:6006227; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-lurek-biz8-dafik-zovel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-lurek-biz8-dafik-zovel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006228; classtype:social-engineering; sid:6006228; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-five-gamma.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-five-gamma.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006229; classtype:social-engineering; sid:6006229; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-rurem-biz8-kalom-fiden.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-rurem-biz8-kalom-fiden.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006230; classtype:social-engineering; sid:6006230; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ejjeex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ejjeex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006231; classtype:social-engineering; sid:6006231; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ewxwexew.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ewxwexew.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006232; classtype:social-engineering; sid:6006232; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alawifamily-event.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"alawifamily-event.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006233; classtype:social-engineering; sid:6006233; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-turek-biz8-dovem-zafil.pages.dev/appeals/submit-appeal-)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-"; startswith; fast_pattern; http.host; content:"sp10ct-turek-biz8-dovem-zafil.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006234; classtype:social-engineering; sid:6006234; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (344v34v5453.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"344v34v5453.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006235; classtype:social-engineering; sid:6006235; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-urelax-biz8-jorim-falven.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-urelax-biz8-jorim-falven.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006236; classtype:social-engineering; sid:6006236; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sapporo-chugokugo.club/draft/docusmnt/)"; flow:established,to_server; http.uri; content:"/draft/docusmnt/"; startswith; fast_pattern; http.host; content:"www.sapporo-chugokugo.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006237; classtype:social-engineering; sid:6006237; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-gurek-biz8-morel-zafid.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-gurek-biz8-morel-zafid.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006238; classtype:social-engineering; sid:6006238; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bgrnd68jnhwus-twxpl87olpw-4b6a1d-zwu3c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bgrnd68jnhwus-twxpl87olpw-4b6a1d-zwu3c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006239; classtype:social-engineering; sid:6006239; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopifyts.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopifyts.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006240; classtype:social-engineering; sid:6006240; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ncynf88lkwg-jzkvmplx-3a4d8e-ncy17w.pages.dev/welcome_aboard)"; flow:established,to_server; http.uri; content:"/welcome_aboard"; startswith; fast_pattern; http.host; content:"ncynf88lkwg-jzkvmplx-3a4d8e-ncy17w.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006241; classtype:social-engineering; sid:6006241; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (buildofficial.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"buildofficial.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006242; classtype:social-engineering; sid:6006242; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bitunixdocusign.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bitunixdocusign.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006243; classtype:social-engineering; sid:6006243; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acessofinanceirovip.online/presell/index.html)"; flow:established,to_server; http.uri; content:"/presell/index.html"; startswith; fast_pattern; http.host; content:"acessofinanceirovip.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006244; classtype:social-engineering; sid:6006244; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopifylk.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopifylk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006245; classtype:social-engineering; sid:6006245; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uujiu.com/xuenvtzx/)"; flow:established,to_server; http.uri; content:"/xuenvtzx/"; startswith; fast_pattern; http.host; content:"uujiu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006246; classtype:social-engineering; sid:6006246; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (luggages.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"luggages.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006247; classtype:social-engineering; sid:6006247; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cheapchampion.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cheapchampion.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006248; classtype:social-engineering; sid:6006248; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityrefunds.com/MyWallet)"; flow:established,to_server; http.uri; content:"/MyWallet"; startswith; fast_pattern; http.host; content:"xfinityrefunds.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006249; classtype:social-engineering; sid:6006249; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (buildcampoff.vercel.app/front/)"; flow:established,to_server; http.uri; content:"/front/"; startswith; fast_pattern; http.host; content:"buildcampoff.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006250; classtype:social-engineering; sid:6006250; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (log-in-facebook.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"log-in-facebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006251; classtype:social-engineering; sid:6006251; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (express24h-ze.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"express24h-ze.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006252; classtype:social-engineering; sid:6006252; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whts.co/muda-vendas-6888/)"; flow:established,to_server; http.uri; content:"/muda-vendas-6888/"; startswith; fast_pattern; http.host; content:"www.whts.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006253; classtype:social-engineering; sid:6006253; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gamerrm18.github.io/instagram-verification/)"; flow:established,to_server; http.uri; content:"/instagram-verification/"; startswith; fast_pattern; http.host; content:"gamerrm18.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006254; classtype:social-engineering; sid:6006254; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.97ee4.catex.at/cnbcard/web_sms_activate.php)"; flow:established,to_server; http.uri; content:"/cnbcard/web_sms_activate.php"; startswith; fast_pattern; http.host; content:"www.97ee4.catex.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006255; classtype:social-engineering; sid:6006255; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinityupdates.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinityupdates.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006256; classtype:social-engineering; sid:6006256; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.edocumens.icu/efile/)"; flow:established,to_server; http.uri; content:"/efile/"; startswith; fast_pattern; http.host; content:"www.edocumens.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006257; classtype:social-engineering; sid:6006257; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-curem-biz8-lafik-zovem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-curem-biz8-lafik-zovem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006258; classtype:social-engineering; sid:6006258; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ww.helpcenter-checkpoint-057353435646.fwh.is/2026/)"; flow:established,to_server; http.uri; content:"/2026/"; startswith; fast_pattern; http.host; content:"ww.helpcenter-checkpoint-057353435646.fwh.is"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006259; classtype:social-engineering; sid:6006259; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h5.pulse-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"h5.pulse-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006260; classtype:social-engineering; sid:6006260; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (phvjn3dqtwilw-twxpl208nnx-2b3c7d-gre1a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"phvjn3dqtwilw-twxpl208nnx-2b3c7d-gre1a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006261; classtype:social-engineering; sid:6006261; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.site-033rddg5e.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.site-033rddg5e.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006262; classtype:social-engineering; sid:6006262; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityupdates.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinityupdates.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006263; classtype:social-engineering; sid:6006263; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bancoltau.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bancoltau.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006264; classtype:social-engineering; sid:6006264; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (campofficial.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"campofficial.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006265; classtype:social-engineering; sid:6006265; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-gurep-biz8-larev-zodin.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-gurep-biz8-larev-zodin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006266; classtype:social-engineering; sid:6006266; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creditoliberadonuvip.online/presell/index.html)"; flow:established,to_server; http.uri; content:"/presell/index.html"; startswith; fast_pattern; http.host; content:"creditoliberadonuvip.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006267; classtype:social-engineering; sid:6006267; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mashood-git.github.io/amazon-homepage-clone/)"; flow:established,to_server; http.uri; content:"/amazon-homepage-clone/"; startswith; fast_pattern; http.host; content:"mashood-git.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006268; classtype:social-engineering; sid:6006268; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sliconsltas.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.sliconsltas.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006269; classtype:social-engineering; sid:6006269; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mkrjb0c82qt-qtzxvnnx-5b8c3d-vzk91a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mkrjb0c82qt-qtzxvnnx-5b8c3d-vzk91a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006270; classtype:social-engineering; sid:6006270; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alokkumar573.github.io/instagram-login-/)"; flow:established,to_server; http.uri; content:"/instagram-login-/"; startswith; fast_pattern; http.host; content:"alokkumar573.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006271; classtype:social-engineering; sid:6006271; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oauthcomcast.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"oauthcomcast.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006272; classtype:social-engineering; sid:6006272; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nugoldvip.online/presell/index.html)"; flow:established,to_server; http.uri; content:"/presell/index.html"; startswith; fast_pattern; http.host; content:"nugoldvip.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006273; classtype:social-engineering; sid:6006273; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-talrex-biz8-kovin-marel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-talrex-biz8-kovin-marel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006274; classtype:social-engineering; sid:6006274; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp.ih.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp.ih.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006275; classtype:social-engineering; sid:6006275; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (upendra9642.github.io/E-Commerce-Website/)"; flow:established,to_server; http.uri; content:"/E-Commerce-Website/"; startswith; fast_pattern; http.host; content:"upendra9642.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006276; classtype:social-engineering; sid:6006276; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.campofficial.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.campofficial.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006277; classtype:social-engineering; sid:6006277; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5zrt3zrrzr.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"5zrt3zrrzr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006278; classtype:social-engineering; sid:6006278; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meu-resgate-pontos.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meu-resgate-pontos.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006279; classtype:social-engineering; sid:6006279; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (simple-security-page--emmadull01.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"simple-security-page--emmadull01.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006280; classtype:social-engineering; sid:6006280; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nimble.dial-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nimble.dial-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006281; classtype:social-engineering; sid:6006281; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.wa.call-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.wa.call-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006282; classtype:social-engineering; sid:6006282; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web.whatsapp.ih.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web.whatsapp.ih.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006283; classtype:social-engineering; sid:6006283; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.whatsapp.ih.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app.whatsapp.ih.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006284; classtype:social-engineering; sid:6006284; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metauslkocxzgimens.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metauslkocxzgimens.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006285; classtype:social-engineering; sid:6006285; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ewxewx3x2.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ewxewx3x2.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006286; classtype:social-engineering; sid:6006286; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steamqowered.store/app/1643430/STALKER_2_Heart_of_Chornobyl/)"; flow:established,to_server; http.uri; content:"/app/1643430/STALKER_2_Heart_of_Chornobyl/"; startswith; fast_pattern; http.host; content:"steamqowered.store"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006287; classtype:social-engineering; sid:6006287; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ishan-real.github.io/Spotify-clone/)"; flow:established,to_server; http.uri; content:"/Spotify-clone/"; startswith; fast_pattern; http.host; content:"ishan-real.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006288; classtype:social-engineering; sid:6006288; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ecozixa.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ecozixa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006289; classtype:social-engineering; sid:6006289; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (berquro-gld-larqumi-a3t5hk78.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"berquro-gld-larqumi-a3t5hk78.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006290; classtype:social-engineering; sid:6006290; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (express-zedeliverys.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"express-zedeliverys.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006291; classtype:social-engineering; sid:6006291; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gemini.tafiny.pp.ua/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gemini.tafiny.pp.ua"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006292; classtype:social-engineering; sid:6006292; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-xurep-biz8-kolam-fazen.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-xurep-biz8-kolam-fazen.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006293; classtype:social-engineering; sid:6006293; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-netflix.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-netflix.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006294; classtype:social-engineering; sid:6006294; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (campaingofficial.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"campaingofficial.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006295; classtype:social-engineering; sid:6006295; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (97ee3.catex.at/cnbcard/web_sms_activate.php)"; flow:established,to_server; http.uri; content:"/cnbcard/web_sms_activate.php"; startswith; fast_pattern; http.host; content:"97ee3.catex.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006296; classtype:social-engineering; sid:6006296; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tvcmnuiot.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tvcmnuiot.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006297; classtype:social-engineering; sid:6006297; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dravemi-gld-belxita-r4t5dw60.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dravemi-gld-belxita-r4t5dw60.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006298; classtype:social-engineering; sid:6006298; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (j-tomlinson.com/hello/)"; flow:established,to_server; http.uri; content:"/hello/"; startswith; fast_pattern; http.host; content:"j-tomlinson.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006299; classtype:social-engineering; sid:6006299; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (97ee6.catex.at/cnbcard/web_sms_activate.php)"; flow:established,to_server; http.uri; content:"/cnbcard/web_sms_activate.php"; startswith; fast_pattern; http.host; content:"97ee6.catex.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006300; classtype:social-engineering; sid:6006300; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-corek-biz8-murev-ladik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-corek-biz8-murev-ladik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006301; classtype:social-engineering; sid:6006301; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (btrzp332sk-xjnshhb-2c7f9d-btq61a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"btrzp332sk-xjnshhb-2c7f9d-btq61a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006302; classtype:social-engineering; sid:6006302; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (koonfirmasi-pemulihan.tdc.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"koonfirmasi-pemulihan.tdc.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006303; classtype:social-engineering; sid:6006303; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-durev-biz8-korem-fazil.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-durev-biz8-korem-fazil.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006304; classtype:social-engineering; sid:6006304; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-nurek-biz8-farem-zovil.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-nurek-biz8-farem-zovil.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006305; classtype:social-engineering; sid:6006305; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-binance.github.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app-binance.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006306; classtype:social-engineering; sid:6006306; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xewuxhkjwerhxwoiurpwejxkweh44kj-jy4so.ondigitalocean.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xewuxhkjwerhxwoiurpwejxkweh44kj-jy4so.ondigitalocean.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006307; classtype:social-engineering; sid:6006307; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thetechnofy.in/securefile/pdfdocument.html)"; flow:established,to_server; http.uri; content:"/securefile/pdfdocument.html"; startswith; fast_pattern; http.host; content:"thetechnofy.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006308; classtype:social-engineering; sid:6006308; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (express-zedelivery.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"express-zedelivery.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006309; classtype:social-engineering; sid:6006309; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santanderweb.dothome.co.kr/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"santanderweb.dothome.co.kr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006310; classtype:social-engineering; sid:6006310; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rachy011.github.io/Netflix-Clone-Test/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone-Test/"; startswith; fast_pattern; http.host; content:"rachy011.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006311; classtype:social-engineering; sid:6006311; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcast2.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcast2.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006312; classtype:social-engineering; sid:6006312; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hubcert.com.br/owa.auth.logs.aspx/)"; flow:established,to_server; http.uri; content:"/owa.auth.logs.aspx/"; startswith; fast_pattern; http.host; content:"hubcert.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006313; classtype:social-engineering; sid:6006313; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitysupportdesk.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitysupportdesk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006314; classtype:social-engineering; sid:6006314; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebooksetup.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebooksetup.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006315; classtype:social-engineering; sid:6006315; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-purex-biz8-mafik-zorel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-purex-biz8-mafik-zorel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006316; classtype:social-engineering; sid:6006316; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.h5.pulse-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.h5.pulse-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006317; classtype:social-engineering; sid:6006317; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.aivrcmx.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.aivrcmx.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006318; classtype:social-engineering; sid:6006318; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kzpl-46rfa-z0w-ztt-4fv-2m32.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kzpl-46rfa-z0w-ztt-4fv-2m32.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006319; classtype:social-engineering; sid:6006319; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wa.audios-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wa.audios-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006320; classtype:social-engineering; sid:6006320; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.alwafacarreg.com/uploaded/getURL_542.php)"; flow:established,to_server; http.uri; content:"/uploaded/getURL_542.php"; startswith; fast_pattern; http.host; content:"www.alwafacarreg.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006321; classtype:social-engineering; sid:6006321; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (beehive.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"beehive.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006322; classtype:social-engineering; sid:6006322; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp6ct-vensor-biz8-pralek-jundor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp6ct-vensor-biz8-pralek-jundor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006323; classtype:social-engineering; sid:6006323; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qernavi-gld-fentela-a4x5hp29.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qernavi-gld-fentela-a4x5hp29.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006324; classtype:social-engineering; sid:6006324; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mavulca.com.ve/Duluth_Fall_Festival)"; flow:established,to_server; http.uri; content:"/Duluth_Fall_Festival"; startswith; fast_pattern; http.host; content:"mavulca.com.ve"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006325; classtype:social-engineering; sid:6006325; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-purek-biz8-lofam-dazer.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-purek-biz8-lofam-dazer.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006326; classtype:social-engineering; sid:6006326; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (one.connect-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"one.connect-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006327; classtype:social-engineering; sid:6006327; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (querulous-peach-4dtaevfs.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"querulous-peach-4dtaevfs.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006328; classtype:social-engineering; sid:6006328; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b48m.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b48m.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006329; classtype:social-engineering; sid:6006329; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-corev-biz8-murem-kafel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-corev-biz8-murem-kafel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006330; classtype:social-engineering; sid:6006330; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatapp.chats-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatapp.chats-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006331; classtype:social-engineering; sid:6006331; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (att.b2cdemostore.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"att.b2cdemostore.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006332; classtype:social-engineering; sid:6006332; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagramsupport25.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"instagramsupport25.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006333; classtype:social-engineering; sid:6006333; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pldwf00lkwg-qtzxv54plx-9a4d1e-ltp28w.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pldwf00lkwg-qtzxv54plx-9a4d1e-ltp28w.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006334; classtype:social-engineering; sid:6006334; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (42cr2c32.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"42cr2c32.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006335; classtype:social-engineering; sid:6006335; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maisxc.us.cc/5g/home.html)"; flow:established,to_server; http.uri; content:"/5g/home.html"; startswith; fast_pattern; http.host; content:"maisxc.us.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006336; classtype:social-engineering; sid:6006336; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vanshika-gupta-1.github.io/Amazone-Clone/)"; flow:established,to_server; http.uri; content:"/Amazone-Clone/"; startswith; fast_pattern; http.host; content:"vanshika-gupta-1.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006337; classtype:social-engineering; sid:6006337; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (09aieh-zyd-j90-ba8-r2jh-insll.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"09aieh-zyd-j90-ba8-r2jh-insll.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006338; classtype:social-engineering; sid:6006338; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www-aruba-it.castmex.com/it/it/login.php)"; flow:established,to_server; http.uri; content:"/it/it/login.php"; startswith; fast_pattern; http.host; content:"www-aruba-it.castmex.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006339; classtype:social-engineering; sid:6006339; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.balwanjadi.com/sucursal/)"; flow:established,to_server; http.uri; content:"/sucursal/"; startswith; fast_pattern; http.host; content:"www.balwanjadi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006340; classtype:social-engineering; sid:6006340; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (menu-aktivasipaycc.gradfety.hair/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"menu-aktivasipaycc.gradfety.hair"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006341; classtype:social-engineering; sid:6006341; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inquisitive-teal-omezr4ob.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"inquisitive-teal-omezr4ob.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006342; classtype:social-engineering; sid:6006342; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bbb343.edgeone.cool/?eo_time=1785845192&eo_token=74a719ea5c384215cbfa629aabc8495b)"; flow:established,to_server; http.uri; content:"/?eo_time=1785845192&eo_token=74a719ea5c384215cbfa629aabc8495b"; startswith; fast_pattern; http.host; content:"bbb343.edgeone.cool"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006343; classtype:social-engineering; sid:6006343; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.epic-launch.com/wp-includes/assets/Email.account.html?=)"; flow:established,to_server; http.uri; content:"/wp-includes/assets/Email.account.html?="; startswith; fast_pattern; http.host; content:"www.epic-launch.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006344; classtype:social-engineering; sid:6006344; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rinki9772.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"rinki9772.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006345; classtype:social-engineering; sid:6006345; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cosmxx.rumahsakit.de/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cosmxx.rumahsakit.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006346; classtype:social-engineering; sid:6006346; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinity2.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinity2.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006347; classtype:social-engineering; sid:6006347; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acessocreditovip.online/presell/index.html)"; flow:established,to_server; http.uri; content:"/presell/index.html"; startswith; fast_pattern; http.host; content:"acessocreditovip.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006348; classtype:social-engineering; sid:6006348; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info.cloudinfolibrary.com/c/1fU9LYYZhPQYn4b93NfoDIWRYuG)"; flow:established,to_server; http.uri; content:"/c/1fU9LYYZhPQYn4b93NfoDIWRYuG"; startswith; fast_pattern; http.host; content:"info.cloudinfolibrary.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006349; classtype:social-engineering; sid:6006349; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.the365notify.com/AccountSelectionPage/c?c=00000000-0000-0000-0000-000000000000-cfdc50c4-be5b-4c2e-92f7-38bfefda13b5)"; flow:established,to_server; http.uri; content:"/AccountSelectionPage/c?c=00000000-0000-0000-0000-000000000000-cfdc50c4-be5b-4c2e-92f7-38bfefda13b5"; startswith; fast_pattern; http.host; content:"www.the365notify.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006350; classtype:social-engineering; sid:6006350; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (financiamentovipnuvip.online/presell/index.html)"; flow:established,to_server; http.uri; content:"/presell/index.html"; startswith; fast_pattern; http.host; content:"financiamentovipnuvip.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006351; classtype:social-engineering; sid:6006351; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinmasterspins2200.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"coinmasterspins2200.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006352; classtype:social-engineering; sid:6006352; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-jurev-biz8-korem-lafik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-jurev-biz8-korem-lafik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006353; classtype:social-engineering; sid:6006353; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (application-limitsnubank-withdrawal-limits.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"application-limitsnubank-withdrawal-limits.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006354; classtype:social-engineering; sid:6006354; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (express48h-ze.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"express48h-ze.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006355; classtype:social-engineering; sid:6006355; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tvcmnuiot.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tvcmnuiot.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006356; classtype:social-engineering; sid:6006356; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lai2-g7fuaxdedchvfhdu.z02.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lai2-g7fuaxdedchvfhdu.z02.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006357; classtype:social-engineering; sid:6006357; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aivrcmx.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aivrcmx.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006358; classtype:social-engineering; sid:6006358; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (square-art-eb45.pcqayteudelrlyi.workers.dev/facebook.com-1027275509)"; flow:established,to_server; http.uri; content:"/facebook.com-1027275509"; startswith; fast_pattern; http.host; content:"square-art-eb45.pcqayteudelrlyi.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006359; classtype:social-engineering; sid:6006359; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-xurek-biz8-morem-lafid.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-xurek-biz8-morem-lafid.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006360; classtype:social-engineering; sid:6006360; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oeprecious.github.io/Facebook-Login-Clone/)"; flow:established,to_server; http.uri; content:"/Facebook-Login-Clone/"; startswith; fast_pattern; http.host; content:"oeprecious.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006361; classtype:social-engineering; sid:6006361; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cioxnbasxeprologo.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cioxnbasxeprologo.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006362; classtype:social-engineering; sid:6006362; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.imtouken.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.imtouken.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006363; classtype:social-engineering; sid:6006363; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (percedentrixconsultingllc.com/project/)"; flow:established,to_server; http.uri; content:"/project/"; startswith; fast_pattern; http.host; content:"percedentrixconsultingllc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006364; classtype:social-engineering; sid:6006364; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yhinesl.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yhinesl.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006365; classtype:social-engineering; sid:6006365; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (banque-online.com/?r=6fdeb8a7-7e4e-4407-8ee4-1c8adffe0ec3)"; flow:established,to_server; http.uri; content:"/?r=6fdeb8a7-7e4e-4407-8ee4-1c8adffe0ec3"; startswith; fast_pattern; http.host; content:"banque-online.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006366; classtype:social-engineering; sid:6006366; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paywalletsecure.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paywalletsecure.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006367; classtype:social-engineering; sid:6006367; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-fremik-biz-zansel-kordav.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-fremik-biz-zansel-kordav.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006368; classtype:social-engineering; sid:6006368; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-rurev-biz8-zomel-kafin.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-rurev-biz8-zomel-kafin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006369; classtype:social-engineering; sid:6006369; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qtzxv9bskra-mkrjb87zwur-1e2f9c-xv400a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qtzxv9bskra-mkrjb87zwur-1e2f9c-xv400a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006370; classtype:social-engineering; sid:6006370; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-surev-biz8-lofem-zarik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-surev-biz8-lofem-zarik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006371; classtype:social-engineering; sid:6006371; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cn-netflix.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cn-netflix.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006372; classtype:social-engineering; sid:6006372; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-xurep-biz8-mafel-zokir.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-xurep-biz8-mafel-zokir.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006373; classtype:social-engineering; sid:6006373; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-five-gamma.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-five-gamma.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006374; classtype:social-engineering; sid:6006374; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xelzora-gld-belquro-c9x7dw68.pages.dev/thn-yjm-uio-lkh)"; flow:established,to_server; http.uri; content:"/thn-yjm-uio-lkh"; startswith; fast_pattern; http.host; content:"xelzora-gld-belquro-c9x7dw68.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006375; classtype:social-engineering; sid:6006375; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metsamskwallet.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metsamskwallet.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006376; classtype:social-engineering; sid:6006376; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nikamsai738-sys.github.io/Amazon-Clone_Page/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone_Page/"; startswith; fast_pattern; http.host; content:"nikamsai738-sys.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006377; classtype:social-engineering; sid:6006377; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nakedraincreative.com/verify/)"; flow:established,to_server; http.uri; content:"/verify/"; startswith; fast_pattern; http.host; content:"nakedraincreative.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006378; classtype:social-engineering; sid:6006378; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.seguroalz.com/ingresa-tus-datos)"; flow:established,to_server; http.uri; content:"/ingresa-tus-datos"; startswith; fast_pattern; http.host; content:"www.seguroalz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006379; classtype:social-engineering; sid:6006379; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gateareis.vu/don/mnx/)"; flow:established,to_server; http.uri; content:"/don/mnx/"; startswith; fast_pattern; http.host; content:"gateareis.vu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006380; classtype:social-engineering; sid:6006380; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-att-com-6fee3b.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"account-att-com-6fee3b.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006381; classtype:social-engineering; sid:6006381; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xjnsh8agpxo-btrzpmja-6e5f7b-xjn96c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xjnsh8agpxo-btrzpmja-6e5f7b-xjn96c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006382; classtype:social-engineering; sid:6006382; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp29ct-lamtor-biz-qersik-zonvel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp29ct-lamtor-biz-qersik-zonvel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006383; classtype:social-engineering; sid:6006383; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.borderclick.com/BC/media/Borderclick/Files/rob.html)"; flow:established,to_server; http.uri; content:"/BC/media/Borderclick/Files/rob.html"; startswith; fast_pattern; http.host; content:"www.borderclick.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006384; classtype:social-engineering; sid:6006384; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-gorek-biz8-lurem-fovik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-gorek-biz8-lurem-fovik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006385; classtype:social-engineering; sid:6006385; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imtk.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"imtk.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006386; classtype:social-engineering; sid:6006386; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-surep-biz8-kafol-direm.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-surep-biz8-kafol-direm.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006387; classtype:social-engineering; sid:6006387; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.rbcode.net/v/b80246a89abeb4a3738e5b9640668b33/)"; flow:established,to_server; http.uri; content:"/v/b80246a89abeb4a3738e5b9640668b33/"; startswith; fast_pattern; http.host; content:"www.rbcode.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006388; classtype:social-engineering; sid:6006388; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-nurep-biz8-dafem-kozil.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-nurep-biz8-dafem-kozil.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006389; classtype:social-engineering; sid:6006389; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcast2.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcast2.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006390; classtype:social-engineering; sid:6006390; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylaterz.xeac.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylaterz.xeac.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006391; classtype:social-engineering; sid:6006391; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yhnuj7f16dr-xjnshlpw-0a9b6c-xj088a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yhnuj7f16dr-xjnshlpw-0a9b6c-xj088a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006392; classtype:social-engineering; sid:6006392; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (afrs-4c203-r02g-ft32-jz6.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"afrs-4c203-r02g-ft32-jz6.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006393; classtype:social-engineering; sid:6006393; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sandbox.333.name/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.sandbox.333.name"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006394; classtype:social-engineering; sid:6006394; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zh-netflix.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zh-netflix.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006395; classtype:social-engineering; sid:6006395; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-norem-biz8-lurep-zafik-er0.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-norem-biz8-lurep-zafik-er0.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006396; classtype:social-engineering; sid:6006396; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vishaljangra01.github.io/contect-form/)"; flow:established,to_server; http.uri; content:"/contect-form/"; startswith; fast_pattern; http.host; content:"vishaljangra01.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006397; classtype:social-engineering; sid:6006397; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lasmejoresoportunidadesmxfall.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lasmejoresoportunidadesmxfall.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006398; classtype:social-engineering; sid:6006398; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (helpcenter-checkpoint-0943564645.vercel.app/live)"; flow:established,to_server; http.uri; content:"/live"; startswith; fast_pattern; http.host; content:"helpcenter-checkpoint-0943564645.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006399; classtype:social-engineering; sid:6006399; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-rurem-biz8-lovak-fized.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-rurem-biz8-lovak-fized.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006400; classtype:social-engineering; sid:6006400; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (girisguncel3.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"girisguncel3.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006401; classtype:social-engineering; sid:6006401; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prospectivehabitat.org/dhoksat/bibi/auth/login.php)"; flow:established,to_server; http.uri; content:"/dhoksat/bibi/auth/login.php"; startswith; fast_pattern; http.host; content:"prospectivehabitat.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006402; classtype:social-engineering; sid:6006402; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aok.dls.mybluehost.me/wp-includes/blocks/block/support/account/index.asp.php)"; flow:established,to_server; http.uri; content:"/wp-includes/blocks/block/support/account/index.asp.php"; startswith; fast_pattern; http.host; content:"aok.dls.mybluehost.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006403; classtype:social-engineering; sid:6006403; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.myflix-clone-devasik.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.myflix-clone-devasik.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006404; classtype:social-engineering; sid:6006404; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onbit.pro/negger.html)"; flow:established,to_server; http.uri; content:"/negger.html"; startswith; fast_pattern; http.host; content:"onbit.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006405; classtype:social-engineering; sid:6006405; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-lurev-biz8-zafem-doril.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-lurev-biz8-zafem-doril.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006406; classtype:social-engineering; sid:6006406; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-web-inspired.vercel.app/orders.html)"; flow:established,to_server; http.uri; content:"/orders.html"; startswith; fast_pattern; http.host; content:"amazon-web-inspired.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006407; classtype:social-engineering; sid:6006407; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3.rewardinglocker.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3.rewardinglocker.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006408; classtype:social-engineering; sid:6006408; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail-owa-auth-task-logon-congenial-fortnight-production.up.railway.app/#kelis2@1582d81294967f2bcd68b440ea879020a952.org)"; flow:established,to_server; http.uri; content:"/#kelis2@1582d81294967f2bcd68b440ea879020a952.org"; startswith; fast_pattern; http.host; content:"mail-owa-auth-task-logon-congenial-fortnight-production.up.railway.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006409; classtype:social-engineering; sid:6006409; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gestionsegalz.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.gestionsegalz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006410; classtype:social-engineering; sid:6006410; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (naranjodulceradio.com/qR8uN9xT1rU/help/?id=0rpacCQM)"; flow:established,to_server; http.uri; content:"/qR8uN9xT1rU/help/?id=0rpacCQM"; startswith; fast_pattern; http.host; content:"naranjodulceradio.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006411; classtype:social-engineering; sid:6006411; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.apps.streams-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.apps.streams-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006412; classtype:social-engineering; sid:6006412; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acessonuespecial.online/presell/index.html)"; flow:established,to_server; http.uri; content:"/presell/index.html"; startswith; fast_pattern; http.host; content:"acessonuespecial.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006413; classtype:social-engineering; sid:6006413; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (66fdku-xrmnc-rlom-l2x-1rt4k.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"66fdku-xrmnc-rlom-l2x-1rt4k.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006414; classtype:social-engineering; sid:6006414; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apps.streams-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"apps.streams-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006415; classtype:social-engineering; sid:6006415; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (server-docs--emmamarshall910.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"server-docs--emmamarshall910.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006416; classtype:social-engineering; sid:6006416; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webu.asia/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webu.asia"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006417; classtype:social-engineering; sid:6006417; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (valor.pulse-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"valor.pulse-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006418; classtype:social-engineering; sid:6006418; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qianaqian.com/qR8uN9xT1rU/help/?id=TkmoI0mm)"; flow:established,to_server; http.uri; content:"/qR8uN9xT1rU/help/?id=TkmoI0mm"; startswith; fast_pattern; http.host; content:"qianaqian.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006419; classtype:social-engineering; sid:6006419; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (true.pulse-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"true.pulse-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006420; classtype:social-engineering; sid:6006420; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-corek-biz8-lurem-mafin.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-corek-biz8-lurem-mafin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006421; classtype:social-engineering; sid:6006421; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagramsupport25.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagramsupport25.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006422; classtype:social-engineering; sid:6006422; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-yafor-biz8-murel-dokem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-yafor-biz8-murel-dokem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006423; classtype:social-engineering; sid:6006423; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p1w3-4h0-rq3a3d-e3sf-epxil.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p1w3-4h0-rq3a3d-e3sf-epxil.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006424; classtype:social-engineering; sid:6006424; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (access-form-82h6.p-srkphq9l.workers.dev/l/F5Q29EcNdOo)"; flow:established,to_server; http.uri; content:"/l/F5Q29EcNdOo"; startswith; fast_pattern; http.host; content:"access-form-82h6.p-srkphq9l.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006425; classtype:social-engineering; sid:6006425; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lai3-a8aqdfd8g9ezaah4.z02.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lai3-a8aqdfd8g9ezaah4.z02.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006426; classtype:social-engineering; sid:6006426; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aditya-kr-007.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"aditya-kr-007.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006427; classtype:social-engineering; sid:6006427; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp10ct-nafor-biz8-murem-dokel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp10ct-nafor-biz8-murem-dokel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006428; classtype:social-engineering; sid:6006428; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qrcodedynamic.com/dtitiyazed/)"; flow:established,to_server; http.uri; content:"/dtitiyazed/"; startswith; fast_pattern; http.host; content:"qrcodedynamic.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006429; classtype:social-engineering; sid:6006429; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4.rewardinglocker.com/index-form.php)"; flow:established,to_server; http.uri; content:"/index-form.php"; startswith; fast_pattern; http.host; content:"4.rewardinglocker.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006430; classtype:social-engineering; sid:6006430; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pldwf4ekqlo-mkrjbplos-9c2d1a-ltp44w.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pldwf4ekqlo-mkrjbplos-9c2d1a-ltp44w.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006431; classtype:social-engineering; sid:6006431; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mmtsjj.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mmtsjj.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006432; classtype:social-engineering; sid:6006432; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acessorapidonugoldvip.online/presell/index.html)"; flow:established,to_server; http.uri; content:"/presell/index.html"; startswith; fast_pattern; http.host; content:"acessorapidonugoldvip.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006433; classtype:social-engineering; sid:6006433; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (97ee9.catex.at/cnbcard/web_sms_activate.php)"; flow:established,to_server; http.uri; content:"/cnbcard/web_sms_activate.php"; startswith; fast_pattern; http.host; content:"97ee9.catex.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006434; classtype:social-engineering; sid:6006434; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (express-ze.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"express-ze.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006435; classtype:social-engineering; sid:6006435; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mailbox-dpkjr4w7vaw1.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mailbox-dpkjr4w7vaw1.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006436; classtype:social-engineering; sid:6006436; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vormela-gld-fentora-c1m5dw87.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vormela-gld-fentora-c1m5dw87.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006437; classtype:social-engineering; sid:6006437; rev:1; metadata: signature_severity Major, created_et 2026_08_04;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sign-in-to-xfinity-log.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sign-in-to-xfinity-log.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006438; classtype:social-engineering; sid:6006438; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maanyakp-ops.github.io/expense-tracker)"; flow:established,to_server; http.uri; content:"/expense-tracker"; startswith; fast_pattern; http.host; content:"maanyakp-ops.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006439; classtype:social-engineering; sid:6006439; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ankita-babar.github.io/Netflix-Clone-master)"; flow:established,to_server; http.uri; content:"/Netflix-Clone-master"; startswith; fast_pattern; http.host; content:"ankita-babar.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006440; classtype:social-engineering; sid:6006440; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tzr-oeknj.destiny72.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tzr-oeknj.destiny72.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006441; classtype:social-engineering; sid:6006441; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marbrerie-buisan.fr/ch/)"; flow:established,to_server; http.uri; content:"/ch/"; startswith; fast_pattern; http.host; content:"marbrerie-buisan.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006442; classtype:social-engineering; sid:6006442; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c0mcasttyibubnjl.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c0mcasttyibubnjl.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006443; classtype:social-engineering; sid:6006443; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bashful-functions-697167.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bashful-functions-697167.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006444; classtype:social-engineering; sid:6006444; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (map-location.com/TYt)"; flow:established,to_server; http.uri; content:"/TYt"; startswith; fast_pattern; http.host; content:"map-location.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006445; classtype:social-engineering; sid:6006445; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (azxe-btewaeahgkf7e4ad.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"azxe-btewaeahgkf7e4ad.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006446; classtype:social-engineering; sid:6006446; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (peee-dash-zim-six.vercel.app/zimba.html)"; flow:established,to_server; http.uri; content:"/zimba.html"; startswith; fast_pattern; http.host; content:"peee-dash-zim-six.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006447; classtype:social-engineering; sid:6006447; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jedi-crypyo.github.io/ig/)"; flow:established,to_server; http.uri; content:"/ig/"; startswith; fast_pattern; http.host; content:"jedi-crypyo.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006448; classtype:social-engineering; sid:6006448; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xwioeoiwpexiwpexipweqazm-cbbx8.ondigitalocean.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xwioeoiwpexiwpexipweqazm-cbbx8.ondigitalocean.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006449; classtype:social-engineering; sid:6006449; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (revniko.info/Y2gtZmVkZXgtMjAyNg/?u=81C1655&e=0111mh%40hanmail.net&s3=&s4=&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/Y2gtZmVkZXgtMjAyNg/?u=81C1655&e=0111mh%40hanmail.net&s3=&s4=&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"revniko.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006450; classtype:social-engineering; sid:6006450; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledg-1785872093919975748.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledg-1785872093919975748.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006451; classtype:social-engineering; sid:6006451; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nazruluxd.github.io/Lead-Tracker)"; flow:established,to_server; http.uri; content:"/Lead-Tracker"; startswith; fast_pattern; http.host; content:"nazruluxd.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006452; classtype:social-engineering; sid:6006452; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (purolator.com-kems.shop/a)"; flow:established,to_server; http.uri; content:"/a"; startswith; fast_pattern; http.host; content:"purolator.com-kems.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006453; classtype:social-engineering; sid:6006453; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pldwf553jnh-qtzxvolpw-9b7a1d-ltp30c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pldwf553jnh-qtzxvolpw-9b7a1d-ltp30c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006454; classtype:social-engineering; sid:6006454; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (librinvfal.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"librinvfal.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006455; classtype:social-engineering; sid:6006455; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (exact-hiring-783230.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"exact-hiring-783230.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006456; classtype:social-engineering; sid:6006456; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledg-1785870833918739958.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledg-1785870833918739958.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006457; classtype:social-engineering; sid:6006457; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (voypacuba.com/spec)"; flow:established,to_server; http.uri; content:"/spec"; startswith; fast_pattern; http.host; content:"voypacuba.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006458; classtype:social-engineering; sid:6006458; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (localisation-direct.support/app/webroot/script/bG9naW5fMjAyNg88)"; flow:established,to_server; http.uri; content:"/app/webroot/script/bG9naW5fMjAyNg88"; startswith; fast_pattern; http.host; content:"localisation-direct.support"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006459; classtype:social-engineering; sid:6006459; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinity2.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinity2.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006460; classtype:social-engineering; sid:6006460; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tk.digitalonlinenews.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tk.digitalonlinenews.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006461; classtype:social-engineering; sid:6006461; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (betlink44.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"betlink44.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006462; classtype:social-engineering; sid:6006462; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bnl-it.mydomain.zone/index.php)"; flow:established,to_server; http.uri; content:"/index.php"; startswith; fast_pattern; http.host; content:"bnl-it.mydomain.zone"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006463; classtype:social-engineering; sid:6006463; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (srishtisingh789.github.io/employee-management-system)"; flow:established,to_server; http.uri; content:"/employee-management-system"; startswith; fast_pattern; http.host; content:"srishtisingh789.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006464; classtype:social-engineering; sid:6006464; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mediacentersform.com/8703042988/5193415454/index.php)"; flow:established,to_server; http.uri; content:"/8703042988/5193415454/index.php"; startswith; fast_pattern; http.host; content:"mediacentersform.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006465; classtype:social-engineering; sid:6006465; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.teams-di.com/p/fjbd-cbcr/jcbqhvlx)"; flow:established,to_server; http.uri; content:"/p/fjbd-cbcr/jcbqhvlx"; startswith; fast_pattern; http.host; content:"s.teams-di.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006466; classtype:social-engineering; sid:6006466; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (purolator.com-snsc.shop/a)"; flow:established,to_server; http.uri; content:"/a"; startswith; fast_pattern; http.host; content:"purolator.com-snsc.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006467; classtype:social-engineering; sid:6006467; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.oauthcomcast.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.oauthcomcast.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006468; classtype:social-engineering; sid:6006468; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.navjivanexporters.in/system/helpers/amr/few.html)"; flow:established,to_server; http.uri; content:"/system/helpers/amr/few.html"; startswith; fast_pattern; http.host; content:"www.navjivanexporters.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006469; classtype:social-engineering; sid:6006469; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (linedesign.click/script/bG9naW5fMjAyNg88/index.php)"; flow:established,to_server; http.uri; content:"/script/bG9naW5fMjAyNg88/index.php"; startswith; fast_pattern; http.host; content:"linedesign.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006470; classtype:social-engineering; sid:6006470; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.marbrerie-buisan.fr/nos-realisations/realisations-particuliers/chapelles-funeraires/)"; flow:established,to_server; http.uri; content:"/nos-realisations/realisations-particuliers/chapelles-funeraires/"; startswith; fast_pattern; http.host; content:"www.marbrerie-buisan.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006471; classtype:social-engineering; sid:6006471; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-r829wci3x-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-r829wci3x-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006472; classtype:social-engineering; sid:6006472; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gojojd.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.gojojd.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006473; classtype:social-engineering; sid:6006473; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (260615469.sbs/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"260615469.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006474; classtype:social-engineering; sid:6006474; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info.t.mydomain.zone/mycss/step3.php)"; flow:established,to_server; http.uri; content:"/mycss/step3.php"; startswith; fast_pattern; http.host; content:"info.t.mydomain.zone"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006475; classtype:social-engineering; sid:6006475; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (purolator.com-zlok.shop/a)"; flow:established,to_server; http.uri; content:"/a"; startswith; fast_pattern; http.host; content:"purolator.com-zlok.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006476; classtype:social-engineering; sid:6006476; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gdnw.miltoncattery4u.com/jameson/danpan/code.html)"; flow:established,to_server; http.uri; content:"/jameson/danpan/code.html"; startswith; fast_pattern; http.host; content:"gdnw.miltoncattery4u.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006477; classtype:social-engineering; sid:6006477; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-7lhik3ohd.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-7lhik3ohd.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006478; classtype:social-engineering; sid:6006478; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp6ct-kavren-biz8-polvik-lurten.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp6ct-kavren-biz8-polvik-lurten.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006479; classtype:social-engineering; sid:6006479; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (debojitkhastagir.github.io/Facebook-interface-design/)"; flow:established,to_server; http.uri; content:"/Facebook-interface-design/"; startswith; fast_pattern; http.host; content:"debojitkhastagir.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006480; classtype:social-engineering; sid:6006480; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (discreet-united-045656.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"discreet-united-045656.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006481; classtype:social-engineering; sid:6006481; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee987.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee987.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006482; classtype:social-engineering; sid:6006482; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-4dregfabm.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-4dregfabm.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006483; classtype:social-engineering; sid:6006483; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-qarnero-biz8-varex-folim.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-qarnero-biz8-varex-folim.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006484; classtype:social-engineering; sid:6006484; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (applinkzzz.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"applinkzzz.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006485; classtype:social-engineering; sid:6006485; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ledg-1785870833918739958.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ledg-1785870833918739958.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006486; classtype:social-engineering; sid:6006486; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinbases-wallets.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coinbases-wallets.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006487; classtype:social-engineering; sid:6006487; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-mbr3iglgp-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-mbr3iglgp-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006488; classtype:social-engineering; sid:6006488; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sprl.me/roblox-com-users-160874581-profile)"; flow:established,to_server; http.uri; content:"/roblox-com-users-160874581-profile"; startswith; fast_pattern; http.host; content:"sprl.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006489; classtype:social-engineering; sid:6006489; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.buildcampoff.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.buildcampoff.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006490; classtype:social-engineering; sid:6006490; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.yuixszc.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.yuixszc.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006491; classtype:social-engineering; sid:6006491; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cpark.in/about-us/ai/hinet/hinet/webmail.hinet.net/)"; flow:established,to_server; http.uri; content:"/about-us/ai/hinet/hinet/webmail.hinet.net/"; startswith; fast_pattern; http.host; content:"www.cpark.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006492; classtype:social-engineering; sid:6006492; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitymaills110.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitymaills110.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006493; classtype:social-engineering; sid:6006493; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (posta-bm-serv-service-posta.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"posta-bm-serv-service-posta.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006494; classtype:social-engineering; sid:6006494; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-git-feat-com2-2122-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-git-feat-com2-2122-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006495; classtype:social-engineering; sid:6006495; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (88849.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"88849.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006496; classtype:social-engineering; sid:6006496; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paidopinion.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paidopinion.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006497; classtype:social-engineering; sid:6006497; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (es4dr56tyuikdf6g-dp9xyf4hhc53.edgeone.dev/english.html)"; flow:established,to_server; http.uri; content:"/english.html"; startswith; fast_pattern; http.host; content:"es4dr56tyuikdf6g-dp9xyf4hhc53.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006498; classtype:social-engineering; sid:6006498; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eu2.contabostorage.com/d0b90afc72f747e49120771469773d9a:abc/indexx.html)"; flow:established,to_server; http.uri; content:"/d0b90afc72f747e49120771469773d9a:abc/indexx.html"; startswith; fast_pattern; http.host; content:"eu2.contabostorage.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006499; classtype:social-engineering; sid:6006499; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.teams-iy.com/p/fjbd-cbcr/skqnecet)"; flow:established,to_server; http.uri; content:"/p/fjbd-cbcr/skqnecet"; startswith; fast_pattern; http.host; content:"s.teams-iy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006500; classtype:social-engineering; sid:6006500; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-svztm8qsm.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-svztm8qsm.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006501; classtype:social-engineering; sid:6006501; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.librinvfal.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.librinvfal.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006502; classtype:social-engineering; sid:6006502; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maps-ios.help/app/webroot/script/bG9naW5fMjAyNg88)"; flow:established,to_server; http.uri; content:"/app/webroot/script/bG9naW5fMjAyNg88"; startswith; fast_pattern; http.host; content:"maps-ios.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006503; classtype:social-engineering; sid:6006503; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (staging.d1jfc2cts0zds2.amplifyapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"staging.d1jfc2cts0zds2.amplifyapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006504; classtype:social-engineering; sid:6006504; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tetes-air.pages.dev/dp/B076JKHDQT?ref=MarsFS_VICC_Ring+Rechargeable+Battery+Pack)"; flow:established,to_server; http.uri; content:"/dp/B076JKHDQT?ref=MarsFS_VICC_Ring+Rechargeable+Battery+Pack"; startswith; fast_pattern; http.host; content:"tetes-air.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006505; classtype:social-engineering; sid:6006505; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (akoolboy331-commits.github.io/2604.html.Login-page/)"; flow:established,to_server; http.uri; content:"/2604.html.Login-page/"; startswith; fast_pattern; http.host; content:"akoolboy331-commits.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006506; classtype:social-engineering; sid:6006506; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.campaingofficial.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.campaingofficial.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006507; classtype:social-engineering; sid:6006507; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yezi.garden/pt)"; flow:established,to_server; http.uri; content:"/pt"; startswith; fast_pattern; http.host; content:"yezi.garden"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006508; classtype:social-engineering; sid:6006508; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (findmy-uk.click/app/webroot/script/bG9naW5fMjAyNg88/)"; flow:established,to_server; http.uri; content:"/app/webroot/script/bG9naW5fMjAyNg88/"; startswith; fast_pattern; http.host; content:"findmy-uk.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006509; classtype:social-engineering; sid:6006509; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bbiwbsiw-tech.github.io/Bima/)"; flow:established,to_server; http.uri; content:"/Bima/"; startswith; fast_pattern; http.host; content:"bbiwbsiw-tech.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006510; classtype:social-engineering; sid:6006510; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rplyyinfo.duckdns.org/DocuSign77%20(4).html)"; flow:established,to_server; http.uri; content:"/DocuSign77%20(4).html"; startswith; fast_pattern; http.host; content:"rplyyinfo.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006511; classtype:social-engineering; sid:6006511; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.g65t.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.g65t.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006512; classtype:social-engineering; sid:6006512; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (asdap.com.br/.well-known/acme-challenge/adsa/dmlkorea.html)"; flow:established,to_server; http.uri; content:"/.well-known/acme-challenge/adsa/dmlkorea.html"; startswith; fast_pattern; http.host; content:"asdap.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006513; classtype:social-engineering; sid:6006513; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (booklng-prearrlivalrewiedate.com/983797037)"; flow:established,to_server; http.uri; content:"/983797037"; startswith; fast_pattern; http.host; content:"booklng-prearrlivalrewiedate.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006514; classtype:social-engineering; sid:6006514; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (proteccion-outlook2026.iceiy.com/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"proteccion-outlook2026.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006515; classtype:social-engineering; sid:6006515; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.applinkzzz.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.applinkzzz.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006516; classtype:social-engineering; sid:6006516; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f3b9c545.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"f3b9c545.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006517; classtype:social-engineering; sid:6006517; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sucursal-virtuall.vercel.app/bancolombia/persona)"; flow:established,to_server; http.uri; content:"/bancolombia/persona"; startswith; fast_pattern; http.host; content:"sucursal-virtuall.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006518; classtype:social-engineering; sid:6006518; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledg-1785875873920859454.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledg-1785875873920859454.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006519; classtype:social-engineering; sid:6006519; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (devicelocate.network/app/webroot/script/bG9naW5fMjAyNg88/)"; flow:established,to_server; http.uri; content:"/app/webroot/script/bG9naW5fMjAyNg88/"; startswith; fast_pattern; http.host; content:"devicelocate.network"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006520; classtype:social-engineering; sid:6006520; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xjnsh6a45gp-btrzpmja-6e1f4b-xjn83c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xjnsh6a45gp-btrzpmja-6e1f4b-xjn83c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006521; classtype:social-engineering; sid:6006521; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (purolator.com-utoa.shop/a)"; flow:established,to_server; http.uri; content:"/a"; startswith; fast_pattern; http.host; content:"purolator.com-utoa.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006522; classtype:social-engineering; sid:6006522; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (teams-nx.com/p/fjbd-cbcr/xlxwgqxa)"; flow:established,to_server; http.uri; content:"/p/fjbd-cbcr/xlxwgqxa"; startswith; fast_pattern; http.host; content:"teams-nx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006523; classtype:social-engineering; sid:6006523; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paperorbit.cloud/Docusign/sign/c.html)"; flow:established,to_server; http.uri; content:"/Docusign/sign/c.html"; startswith; fast_pattern; http.host; content:"paperorbit.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006524; classtype:social-engineering; sid:6006524; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (incredible-culture-543388.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"incredible-culture-543388.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006525; classtype:social-engineering; sid:6006525; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.nuevoacceso.oportunidadesenlinea.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.nuevoacceso.oportunidadesenlinea.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006526; classtype:social-engineering; sid:6006526; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gemiinilugennn.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.gemiinilugennn.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006527; classtype:social-engineering; sid:6006527; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-project-theta.vercel.app/orders.html)"; flow:established,to_server; http.uri; content:"/orders.html"; startswith; fast_pattern; http.host; content:"amazon-project-theta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006528; classtype:social-engineering; sid:6006528; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (651561565.lat/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"651561565.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006529; classtype:social-engineering; sid:6006529; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qomculture.ir/light/post/en.php?email=ZXdtcy5rdnRjQHNhaWdvbm5ld3BvcnQuY29tLnZu&fid=1&fid=4&rand=13InboxLightaspxn.1774256418)"; flow:established,to_server; http.uri; content:"/light/post/en.php?email=ZXdtcy5rdnRjQHNhaWdvbm5ld3BvcnQuY29tLnZu&fid=1&fid=4&rand=13InboxLightaspxn.1774256418"; startswith; fast_pattern; http.host; content:"qomculture.ir"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006530; classtype:social-engineering; sid:6006530; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (geckotristate.com/wed)"; flow:established,to_server; http.uri; content:"/wed"; startswith; fast_pattern; http.host; content:"geckotristate.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006531; classtype:social-engineering; sid:6006531; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shoutout.wix.com/so/9cP-DFPnz/c?w=NxvNQG2InezB_Ur1TOwn2oVVNuBqsjXHHhskcYGIz44.eyJ1IjoiaHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS91cmw_cT1odHRwcyUzQSUyRiUyRnMzLmV1LW5vcnRoLTEuYW1hem9uYXdzLmNvbSUyRmxhbmRpbmctc3dhcmFqZ2FybWVudHMuY29tJTJGaW5kZXguaHRtbCZzYT1EJnNudHo9MSZ1c2c9QU92VmF3MUM0Z0drdUhHbEJ1TzUzYU80M213TCIsInIiOiI4ZjcxODQ1ZS05OGEwLTRmNzUtOGI4Ny1jYTJhZjg0YmFkZjYiLCJtIjoibHAifQ)"; flow:established,to_server; http.uri; content:"/so/9cP-DFPnz/c?w=NxvNQG2InezB_Ur1TOwn2oVVNuBqsjXHHhskcYGIz44.eyJ1IjoiaHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS91cmw_cT1odHRwcyUzQSUyRiUyRnMzLmV1LW5vcnRoLTEuYW1hem9uYXdzLmNvbSUyRmxhbmRpbmctc3dhcmFqZ2FybWVudHMuY29tJTJGaW5kZXguaHRtbCZzYT1EJnNudHo9MSZ1c2c9QU92VmF3MUM0Z0drdUhHbEJ1TzUzYU80M213TCIsInIiOiI4ZjcxODQ1ZS05OGEwLTRmNzUtOGI4Ny1jYTJhZjg0YmFkZjYiLCJtIjoibHAifQ"; startswith; fast_pattern; http.host; content:"shoutout.wix.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006532; classtype:social-engineering; sid:6006532; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.buildofficial.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.buildofficial.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006533; classtype:social-engineering; sid:6006533; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (545564655.lat/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"545564655.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006534; classtype:social-engineering; sid:6006534; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zu7pl.pro/script/bG9naW5fMjAyNg88/index.php)"; flow:established,to_server; http.uri; content:"/script/bG9naW5fMjAyNg88/index.php"; startswith; fast_pattern; http.host; content:"zu7pl.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006535; classtype:social-engineering; sid:6006535; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.moonpay-commerce-git-henryharris-com2-2779-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.moonpay-commerce-git-henryharris-com2-2779-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006536; classtype:social-engineering; sid:6006536; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.vnd.suu.temporary.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.vnd.suu.temporary.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006537; classtype:social-engineering; sid:6006537; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.zappitellicpasinc.com/conversation/PDF%20NEW.Html)"; flow:established,to_server; http.uri; content:"/conversation/PDF%20NEW.Html"; startswith; fast_pattern; http.host; content:"www.zappitellicpasinc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006538; classtype:social-engineering; sid:6006538; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (salmon-jupiter-110089.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"salmon-jupiter-110089.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006539; classtype:social-engineering; sid:6006539; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-sorvix-biz8-kalem-duron.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-sorvix-biz8-kalem-duron.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006540; classtype:social-engineering; sid:6006540; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klmqw35kq-gfvcd91los-8c4d6a-yh428w.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"klmqw35kq-gfvcd91los-8c4d6a-yh428w.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006541; classtype:social-engineering; sid:6006541; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (checkerfort.skin/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"checkerfort.skin"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006542; classtype:social-engineering; sid:6006542; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.alerte-noreply.fr/login?id=8a269042-cd6f-4102-8837-401fbf344072&sid=77826d96-79e7-4fa2-a449-73bafbe3f360&s=1&clientdata=66a36b20f0d9c46a421921f4)"; flow:established,to_server; http.uri; content:"/login?id=8a269042-cd6f-4102-8837-401fbf344072&sid=77826d96-79e7-4fa2-a449-73bafbe3f360&s=1&clientdata=66a36b20f0d9c46a421921f4"; startswith; fast_pattern; http.host; content:"login.alerte-noreply.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006543; classtype:social-engineering; sid:6006543; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-i8ziskj0g-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-i8ziskj0g-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006544; classtype:social-engineering; sid:6006544; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.moonpay-commerce-git-remove-withdraw-feature-flag-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.moonpay-commerce-git-remove-withdraw-feature-flag-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006545; classtype:social-engineering; sid:6006545; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newmail21.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"newmail21.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006546; classtype:social-engineering; sid:6006546; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (105611333.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"105611333.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006547; classtype:social-engineering; sid:6006547; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (erf-0e1zh-6icr8-wy5k-w4h0p.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"erf-0e1zh-6icr8-wy5k-w4h0p.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006548; classtype:social-engineering; sid:6006548; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (phrasing0870.github.io/ledger)"; flow:established,to_server; http.uri; content:"/ledger"; startswith; fast_pattern; http.host; content:"phrasing0870.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006549; classtype:social-engineering; sid:6006549; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-lk7s2vg21-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-lk7s2vg21-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006550; classtype:social-engineering; sid:6006550; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sapporo-chugokugo.club/es1ng/docusmnt/)"; flow:established,to_server; http.uri; content:"/es1ng/docusmnt/"; startswith; fast_pattern; http.host; content:"sapporo-chugokugo.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006551; classtype:social-engineering; sid:6006551; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (denver.candy-dev.com/gjwzk1l/zkqgdli/fygvhkx/gbizkrea/NwKorea.html)"; flow:established,to_server; http.uri; content:"/gjwzk1l/zkqgdli/fygvhkx/gbizkrea/NwKorea.html"; startswith; fast_pattern; http.host; content:"denver.candy-dev.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006552; classtype:social-engineering; sid:6006552; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bermita-nqx-zormela-p7t8dw13.pages.dev/thn-yjm-uio-lkh/)"; flow:established,to_server; http.uri; content:"/thn-yjm-uio-lkh/"; startswith; fast_pattern; http.host; content:"bermita-nqx-zormela-p7t8dw13.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006553; classtype:social-engineering; sid:6006553; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.vnd.suu.temporary.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mail.vnd.suu.temporary.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006554; classtype:social-engineering; sid:6006554; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vasquomw21.github.io/ledger)"; flow:established,to_server; http.uri; content:"/ledger"; startswith; fast_pattern; http.host; content:"vasquomw21.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006555; classtype:social-engineering; sid:6006555; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp6ct-lurvak-biz8-gresol-nemkar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp6ct-lurvak-biz8-gresol-nemkar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006556; classtype:social-engineering; sid:6006556; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct-gonex-biz8-vurem-haliv.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct-gonex-biz8-vurem-haliv.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006557; classtype:social-engineering; sid:6006557; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-mrp3ng0a5.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-mrp3ng0a5.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006558; classtype:social-engineering; sid:6006558; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cnca-g0eranh2gtdpcpac.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cnca-g0eranh2gtdpcpac.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006559; classtype:social-engineering; sid:6006559; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledze-liv-dsktop.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledze-liv-dsktop.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006560; classtype:social-engineering; sid:6006560; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (exaudiaslogin.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"exaudiaslogin.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006561; classtype:social-engineering; sid:6006561; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.moonpay-commerce-git-feat-com2-2122-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.moonpay-commerce-git-feat-com2-2122-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006562; classtype:social-engineering; sid:6006562; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xvtly64bfrn-snhgjskru-7d6c1f-jmr22c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xvtly64bfrn-snhgjskru-7d6c1f-jmr22c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006563; classtype:social-engineering; sid:6006563; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreihfzdipod26ligjr2hfyrtjt3bnvc6fyqtgoo3tegaunavw3uhxhy.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreihfzdipod26ligjr2hfyrtjt3bnvc6fyqtgoo3tegaunavw3uhxhy.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006564; classtype:social-engineering; sid:6006564; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledg-1785883433923714291.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledg-1785883433923714291.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006565; classtype:social-engineering; sid:6006565; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blockcedeagin.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"blockcedeagin.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006566; classtype:social-engineering; sid:6006566; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qcfzk5b91dru-zjstrspli-7a3b0f-kro8c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qcfzk5b91dru-zjstrspli-7a3b0f-kro8c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006567; classtype:social-engineering; sid:6006567; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yuixszc.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yuixszc.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006568; classtype:social-engineering; sid:6006568; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp6ct-fremok-biz8-zentor-kalvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp6ct-fremok-biz8-zentor-kalvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006569; classtype:social-engineering; sid:6006569; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wesharefilezipkwwdn.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wesharefilezipkwwdn.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006570; classtype:social-engineering; sid:6006570; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hachiko.ajace.info/ga/click/2-17207680-21-14048-27506-15136-e173570ab6-b70925fa76)"; flow:established,to_server; http.uri; content:"/ga/click/2-17207680-21-14048-27506-15136-e173570ab6-b70925fa76"; startswith; fast_pattern; http.host; content:"hachiko.ajace.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006571; classtype:social-engineering; sid:6006571; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.g65k.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.g65k.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006572; classtype:social-engineering; sid:6006572; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mtoken.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mtoken.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006573; classtype:social-engineering; sid:6006573; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sadiksezgin.github.io/Ledger)"; flow:established,to_server; http.uri; content:"/Ledger"; startswith; fast_pattern; http.host; content:"sadiksezgin.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006574; classtype:social-engineering; sid:6006574; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.moonpay-commerce-git-fix-com2-2711-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.moonpay-commerce-git-fix-com2-2711-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006575; classtype:social-engineering; sid:6006575; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.uniswap-protocol-dex-relay-v451.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.uniswap-protocol-dex-relay-v451.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006576; classtype:social-engineering; sid:6006576; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newxfsync.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"newxfsync.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006577; classtype:social-engineering; sid:6006577; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tpoj8-dc7cfb-9ijzm2-7kzax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tpoj8-dc7cfb-9ijzm2-7kzax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006578; classtype:social-engineering; sid:6006578; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.vkorg.webservis.ru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.vkorg.webservis.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006579; classtype:social-engineering; sid:6006579; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sweet-cucurucho-77bdde.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sweet-cucurucho-77bdde.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006580; classtype:social-engineering; sid:6006580; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (educator-10805187654567899087656.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"educator-10805187654567899087656.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006581; classtype:social-engineering; sid:6006581; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-git-fix-com2-2711-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-git-fix-com2-2711-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006582; classtype:social-engineering; sid:6006582; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-felsik-biz-kavsel-vondor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-felsik-biz-kavsel-vondor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006583; classtype:social-engineering; sid:6006583; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hk.mizuhoscfglobal.com/scf/login/oauth2/code/fusionauth)"; flow:established,to_server; http.uri; content:"/scf/login/oauth2/code/fusionauth"; startswith; fast_pattern; http.host; content:"hk.mizuhoscfglobal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006584; classtype:social-engineering; sid:6006584; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-git-fix-com2-2691-dialog-phanto-f001a8-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-git-fix-com2-2691-dialog-phanto-f001a8-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006585; classtype:social-engineering; sid:6006585; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ledg-1785875873920859454.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ledg-1785875873920859454.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006586; classtype:social-engineering; sid:6006586; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-9secgu53s-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-9secgu53s-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006587; classtype:social-engineering; sid:6006587; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marnavi-gld-belxita-p1p3dk84.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"marnavi-gld-belxita-p1p3dk84.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006588; classtype:social-engineering; sid:6006588; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-mlth0cc82.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-mlth0cc82.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006589; classtype:social-engineering; sid:6006589; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hklogin.mizuhoscfglobal.com/oauth2/authorize?response_type=code&client_id=3dd7d8eb-520a-4617-aaae-ff6bd4f1b21b&scope=openid%20email%20profile&state=q-3G6c2X4wi550VHMG7bNwO0BCVr6ynvvemTqGGPhy0%3D&redirect_uri=https://hk.mizuhoscfglobal.com/scf/login/oauth2/code/fusionauth&nonce=HKnYqogjMF7eIULjPc2U4mXMIhuZm9Ob23E0Gx9gYD8)"; flow:established,to_server; http.uri; content:"/oauth2/authorize?response_type=code&client_id=3dd7d8eb-520a-4617-aaae-ff6bd4f1b21b&scope=openid%20email%20profile&state=q-3G6c2X4wi550VHMG7bNwO0BCVr6ynvvemTqGGPhy0%3D&redirect_uri=https://hk.mizuhoscfglobal.com/scf/login/oauth2/code/fusionauth&nonce=HKnYqogjMF7eIULjPc2U4mXMIhuZm9Ob23E0Gx9gYD8"; startswith; fast_pattern; http.host; content:"hklogin.mizuhoscfglobal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006590; classtype:social-engineering; sid:6006590; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deschnitzer-spec.github.io/LEDGER-app)"; flow:established,to_server; http.uri; content:"/LEDGER-app"; startswith; fast_pattern; http.host; content:"deschnitzer-spec.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006591; classtype:social-engineering; sid:6006591; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loveleadsfed-xlcbug2t-petermurphyprivate7-hub.ipfs.4everland.app/postmasredhg.html)"; flow:established,to_server; http.uri; content:"/postmasredhg.html"; startswith; fast_pattern; http.host; content:"loveleadsfed-xlcbug2t-petermurphyprivate7-hub.ipfs.4everland.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006592; classtype:social-engineering; sid:6006592; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-mavrex-biz8-kolven-farin.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-mavrex-biz8-kolven-farin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006593; classtype:social-engineering; sid:6006593; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (snhgj4a38vs-pldwfkmja-3d2e9f-snq65c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"snhgj4a38vs-pldwfkmja-3d2e9f-snq65c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006594; classtype:social-engineering; sid:6006594; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mkrjb7dplix-pldwf104uhy-5c0d3e-vzk28a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mkrjb7dplix-pldwf104uhy-5c0d3e-vzk28a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006595; classtype:social-engineering; sid:6006595; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gojojd.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gojojd.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006596; classtype:social-engineering; sid:6006596; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shabirhussain276-cpu.github.io/InstagramFreeThreads-)"; flow:established,to_server; http.uri; content:"/InstagramFreeThreads-"; startswith; fast_pattern; http.host; content:"shabirhussain276-cpu.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006597; classtype:social-engineering; sid:6006597; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (heysuzzz.github.io/cb_loc_opp_analysis)"; flow:established,to_server; http.uri; content:"/cb_loc_opp_analysis"; startswith; fast_pattern; http.host; content:"heysuzzz.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006598; classtype:social-engineering; sid:6006598; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (com-find.support/script/bG9naW5fMjAyNg88/index.php)"; flow:established,to_server; http.uri; content:"/script/bG9naW5fMjAyNg88/index.php"; startswith; fast_pattern; http.host; content:"com-find.support"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006599; classtype:social-engineering; sid:6006599; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (conwedd.com/msa/hinet.net/login/)"; flow:established,to_server; http.uri; content:"/msa/hinet.net/login/"; startswith; fast_pattern; http.host; content:"conwedd.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006600; classtype:social-engineering; sid:6006600; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp6ct-mavrek-biz8-tolven-gresik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp6ct-mavrek-biz8-tolven-gresik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006601; classtype:social-engineering; sid:6006601; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-elvurin-biz8-kurem-dazok.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-elvurin-biz8-kurem-dazok.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006602; classtype:social-engineering; sid:6006602; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-walvion-biz8-korem-fazik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-walvion-biz8-korem-fazik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006603; classtype:social-engineering; sid:6006603; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinvasxtension.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coinvasxtension.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006604; classtype:social-engineering; sid:6006604; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uniswap-protocol-dex-relay-v451.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uniswap-protocol-dex-relay-v451.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006605; classtype:social-engineering; sid:6006605; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.supesmeta.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.supesmeta.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006606; classtype:social-engineering; sid:6006606; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sardineext.vercel.app/user/index_facebook.html)"; flow:established,to_server; http.uri; content:"/user/index_facebook.html"; startswith; fast_pattern; http.host; content:"sardineext.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006607; classtype:social-engineering; sid:6006607; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct-vonar-biz8-surel-jamek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct-vonar-biz8-surel-jamek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006608; classtype:social-engineering; sid:6006608; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortcheck.club/id/login)"; flow:established,to_server; http.uri; content:"/id/login"; startswith; fast_pattern; http.host; content:"fortcheck.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006609; classtype:social-engineering; sid:6006609; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-fv5d1zirm-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-fv5d1zirm-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006610; classtype:social-engineering; sid:6006610; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.moonpay-commerce-git-fix-com2-2691-dialog-phanto-f001a8-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.moonpay-commerce-git-fix-com2-2691-dialog-phanto-f001a8-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006611; classtype:social-engineering; sid:6006611; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon.biowikiweb.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon.biowikiweb.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006612; classtype:social-engineering; sid:6006612; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-git-henryharris-com2-2779-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-git-henryharris-com2-2779-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006613; classtype:social-engineering; sid:6006613; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stuartcope92-cell.github.io/ledger)"; flow:established,to_server; http.uri; content:"/ledger"; startswith; fast_pattern; http.host; content:"stuartcope92-cell.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006614; classtype:social-engineering; sid:6006614; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seocompanyjapan.com/wp-includes/cdf/diff.html)"; flow:established,to_server; http.uri; content:"/wp-includes/cdf/diff.html"; startswith; fast_pattern; http.host; content:"seocompanyjapan.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006615; classtype:social-engineering; sid:6006615; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (welcoming-pink-bear.31-22-7-7.cpanel.site/july/)"; flow:established,to_server; http.uri; content:"/july/"; startswith; fast_pattern; http.host; content:"welcoming-pink-bear.31-22-7-7.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006616; classtype:social-engineering; sid:6006616; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (device-ios.help/app/webroot/script/bG9naW5fMjAyNg88)"; flow:established,to_server; http.uri; content:"/app/webroot/script/bG9naW5fMjAyNg88"; startswith; fast_pattern; http.host; content:"device-ios.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006617; classtype:social-engineering; sid:6006617; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (start-ledgr-walet.pages.dev/appeals/submit-appeal-form/return)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-form/return"; startswith; fast_pattern; http.host; content:"start-ledgr-walet.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006618; classtype:social-engineering; sid:6006618; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ledg-1785872093919975748.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ledg-1785872093919975748.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006619; classtype:social-engineering; sid:6006619; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adobeonlinepdfviewer.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"adobeonlinepdfviewer.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006620; classtype:social-engineering; sid:6006620; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-git-remove-withdraw-feature-flag-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-git-remove-withdraw-feature-flag-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006621; classtype:social-engineering; sid:6006621; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h25b.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"h25b.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006622; classtype:social-engineering; sid:6006622; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sadatteck.com/test/)"; flow:established,to_server; http.uri; content:"/test/"; startswith; fast_pattern; http.host; content:"www.sadatteck.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006623; classtype:social-engineering; sid:6006623; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ledg-1785883433923714291.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ledg-1785883433923714291.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006624; classtype:social-engineering; sid:6006624; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.creatormonetizationsupportprouse.click/index.php)"; flow:established,to_server; http.uri; content:"/index.php"; startswith; fast_pattern; http.host; content:"app.creatormonetizationsupportprouse.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006625; classtype:social-engineering; sid:6006625; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (new-land4.scalarium.info/Q0g0MS1OMTUxNS1EMDkwNjA2/?u=161C1515&e=thedomainnameserver.net@domainservice.com&s3=&s4=&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/Q0g0MS1OMTUxNS1EMDkwNjA2/?u=161C1515&e=thedomainnameserver.net@domainservice.com&s3=&s4=&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"new-land4.scalarium.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006626; classtype:social-engineering; sid:6006626; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rithiksuman.github.io/habit)"; flow:established,to_server; http.uri; content:"/habit"; startswith; fast_pattern; http.host; content:"rithiksuman.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006627; classtype:social-engineering; sid:6006627; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vnd.suu.temporary.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vnd.suu.temporary.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006628; classtype:social-engineering; sid:6006628; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tiktokstudio.github.io/form)"; flow:established,to_server; http.uri; content:"/form"; startswith; fast_pattern; http.host; content:"tiktokstudio.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006629; classtype:social-engineering; sid:6006629; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yourupdatenow.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yourupdatenow.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006630; classtype:social-engineering; sid:6006630; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (caixa-unb.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"caixa-unb.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006631; classtype:social-engineering; sid:6006631; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vormora-gld-belxita-c3x4hp74.pages.dev/thn-yjm-uio-lkh?welcome=117265865039590&stt=117265865039590&name_stt=Adam%20Wolfe%20-%20State%20Farm%20Agent%20-%20Edwardsville)"; flow:established,to_server; http.uri; content:"/thn-yjm-uio-lkh?welcome=117265865039590&stt=117265865039590&name_stt=Adam%20Wolfe%20-%20State%20Farm%20Agent%20-%20Edwardsville"; startswith; fast_pattern; http.host; content:"vormora-gld-belxita-c3x4hp74.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006632; classtype:social-engineering; sid:6006632; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fundodesalvaguarda.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"fundodesalvaguarda.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006633; classtype:social-engineering; sid:6006633; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-helphub.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-helphub.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006634; classtype:social-engineering; sid:6006634; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (msprq72kfly-ycgfnpdr-0e5a1b-vn555c124.pages.dev/welcome_aboard?welcome=1000068689063090)"; flow:established,to_server; http.uri; content:"/welcome_aboard?welcome=1000068689063090"; startswith; fast_pattern; http.host; content:"msprq72kfly-ycgfnpdr-0e5a1b-vn555c124.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006635; classtype:social-engineering; sid:6006635; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mfacebook.vn/vh624uatnz?a&l)"; flow:established,to_server; http.uri; content:"/vh624uatnz?a&l"; startswith; fast_pattern; http.host; content:"mfacebook.vn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006636; classtype:social-engineering; sid:6006636; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aurora.co.zw/krrr/lc/koreee.html)"; flow:established,to_server; http.uri; content:"/krrr/lc/koreee.html"; startswith; fast_pattern; http.host; content:"aurora.co.zw"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006637; classtype:social-engineering; sid:6006637; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (one.message-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"one.message-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006638; classtype:social-engineering; sid:6006638; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acessogoldnu.online/presell/index.html)"; flow:established,to_server; http.uri; content:"/presell/index.html"; startswith; fast_pattern; http.host; content:"acessogoldnu.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006639; classtype:social-engineering; sid:6006639; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (activarcuentabhd-avisousuarios.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"activarcuentabhd-avisousuarios.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006640; classtype:social-engineering; sid:6006640; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (proxy-max.xyz/?clckid=557cc027)"; flow:established,to_server; http.uri; content:"/?clckid=557cc027"; startswith; fast_pattern; http.host; content:"proxy-max.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006641; classtype:social-engineering; sid:6006641; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zjstr6bpzgobk-qcfzk98plsi-4e5f8a-fyn8c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zjstr6bpzgobk-qcfzk98plsi-4e5f8a-fyn8c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006642; classtype:social-engineering; sid:6006642; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f005.backblazeb2.com/b2api/v1/b2_download_file_by_id?fileId=4_za1e1c3219b22cac692f00811_f101cd76d393ee210_d20260804_m115805_c005_v0501047_t0040_u01785844685624)"; flow:established,to_server; http.uri; content:"/b2api/v1/b2_download_file_by_id?fileId=4_za1e1c3219b22cac692f00811_f101cd76d393ee210_d20260804_m115805_c005_v0501047_t0040_u01785844685624"; startswith; fast_pattern; http.host; content:"f005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006643; classtype:social-engineering; sid:6006643; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (floral-truth-5bc6.mekjsvrerecryjm.workers.dev/help)"; flow:established,to_server; http.uri; content:"/help"; startswith; fast_pattern; http.host; content:"floral-truth-5bc6.mekjsvrerecryjm.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006644; classtype:social-engineering; sid:6006644; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamazkaxtn.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metamazkaxtn.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006645; classtype:social-engineering; sid:6006645; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cpcontacts.20-244-0-63.cprapid.com/signin)"; flow:established,to_server; http.uri; content:"/signin"; startswith; fast_pattern; http.host; content:"cpcontacts.20-244-0-63.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006646; classtype:social-engineering; sid:6006646; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cashappnexapay.bn1i2.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cashappnexapay.bn1i2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006647; classtype:social-engineering; sid:6006647; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopingee.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopingee.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006648; classtype:social-engineering; sid:6006648; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tkshop.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tkshop.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006649; classtype:social-engineering; sid:6006649; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (260615503.sbs/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"260615503.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006650; classtype:social-engineering; sid:6006650; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.porestemesdeagostosolicitaaumento.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.porestemesdeagostosolicitaaumento.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006651; classtype:social-engineering; sid:6006651; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xvtly34lkww-snhgj54zwur-7b8f1a-snq03x.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xvtly34lkww-snhgj54zwur-7b8f1a-snq03x.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006652; classtype:social-engineering; sid:6006652; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (api.checkoutpagseguro.online/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"api.checkoutpagseguro.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006653; classtype:social-engineering; sid:6006653; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (php-web-server--padroncita.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"php-web-server--padroncita.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006654; classtype:social-engineering; sid:6006654; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xlbdw521low-hbkpthb-8a5c0f-xlq42c.pages.dev/welcome_aboard?welcome=1000068689063090&token248=1000068689063090&name_token136=Oh%20yes%20it%20is)"; flow:established,to_server; http.uri; content:"/welcome_aboard?welcome=1000068689063090&token248=1000068689063090&name_token136=Oh%20yes%20it%20is"; startswith; fast_pattern; http.host; content:"xlbdw521low-hbkpthb-8a5c0f-xlq42c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006655; classtype:social-engineering; sid:6006655; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (g-ze24hbebidas.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"g-ze24hbebidas.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006656; classtype:social-engineering; sid:6006656; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp3ct-zavqik-biz8-fornel-pudem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp3ct-zavqik-biz8-fornel-pudem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006657; classtype:social-engineering; sid:6006657; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.guestdataupds.com/369340457/)"; flow:established,to_server; http.uri; content:"/369340457/"; startswith; fast_pattern; http.host; content:"www.guestdataupds.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006658; classtype:social-engineering; sid:6006658; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lakshya-vardhan.github.io/Netflix-UI-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-UI-Clone/"; startswith; fast_pattern; http.host; content:"lakshya-vardhan.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006659; classtype:social-engineering; sid:6006659; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moinulit265736.github.io/Batch-CH-FDL-2604-Home-Work-03--Project-Sign-up-form-)"; flow:established,to_server; http.uri; content:"/Batch-CH-FDL-2604-Home-Work-03--Project-Sign-up-form-"; startswith; fast_pattern; http.host; content:"moinulit265736.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006660; classtype:social-engineering; sid:6006660; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.accounts-location.us/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.accounts-location.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006661; classtype:social-engineering; sid:6006661; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clik-402.travelesguide.info/ga/click/2-17096250-21-11300-22106-12271-42f0496ed1-e4baa1f492)"; flow:established,to_server; http.uri; content:"/ga/click/2-17096250-21-11300-22106-12271-42f0496ed1-e4baa1f492"; startswith; fast_pattern; http.host; content:"clik-402.travelesguide.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006662; classtype:social-engineering; sid:6006662; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wap.message-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wap.message-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006663; classtype:social-engineering; sid:6006663; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agteirbuatrisa-god.top/es)"; flow:established,to_server; http.uri; content:"/es"; startswith; fast_pattern; http.host; content:"agteirbuatrisa-god.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006664; classtype:social-engineering; sid:6006664; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smc67a5d8e.cityabovetheclouds.us.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"smc67a5d8e.cityabovetheclouds.us.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006665; classtype:social-engineering; sid:6006665; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-corvax-biz8-nurem-falix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-corvax-biz8-nurem-falix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006666; classtype:social-engineering; sid:6006666; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp6ct-dervik-biz8-plorsen-vamrik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp6ct-dervik-biz8-plorsen-vamrik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006667; classtype:social-engineering; sid:6006667; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (express48h-deliverys.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"express48h-deliverys.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006668; classtype:social-engineering; sid:6006668; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atualizacaodecadastro.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"atualizacaodecadastro.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006669; classtype:social-engineering; sid:6006669; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (todosobreinstagram.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"todosobreinstagram.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006670; classtype:social-engineering; sid:6006670; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (billyhood321.github.io/xfinity-login/)"; flow:established,to_server; http.uri; content:"/xfinity-login/"; startswith; fast_pattern; http.host; content:"billyhood321.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006671; classtype:social-engineering; sid:6006671; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct-lasek-biz8-hurem-foriv.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct-lasek-biz8-hurem-foriv.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006672; classtype:social-engineering; sid:6006672; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ufaqawan.github.io/netflix-website/)"; flow:established,to_server; http.uri; content:"/netflix-website/"; startswith; fast_pattern; http.host; content:"ufaqawan.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006673; classtype:social-engineering; sid:6006673; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-trezoorhlp.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"help-trezoorhlp.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006674; classtype:social-engineering; sid:6006674; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.site-7lhik3ohd.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.site-7lhik3ohd.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006675; classtype:social-engineering; sid:6006675; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (byblyteho.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"byblyteho.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006676; classtype:social-engineering; sid:6006676; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shivanshsrivastavax.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"shivanshsrivastavax.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006677; classtype:social-engineering; sid:6006677; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9o2k-hxw5-pnnh.shimon-eldrotec-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9o2k-hxw5-pnnh.shimon-eldrotec-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006678; classtype:social-engineering; sid:6006678; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (express-zedelivery.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"express-zedelivery.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006679; classtype:social-engineering; sid:6006679; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (quintessential-turquoise-qifxbber.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"quintessential-turquoise-qifxbber.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006680; classtype:social-engineering; sid:6006680; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nuviipcentral.online/presell/index.html)"; flow:established,to_server; http.uri; content:"/presell/index.html"; startswith; fast_pattern; http.host; content:"nuviipcentral.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006681; classtype:social-engineering; sid:6006681; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.distribuidoracdp.com/promo24h/)"; flow:established,to_server; http.uri; content:"/promo24h/"; startswith; fast_pattern; http.host; content:"www.distribuidoracdp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006682; classtype:social-engineering; sid:6006682; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (other-potential-743980.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"other-potential-743980.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006683; classtype:social-engineering; sid:6006683; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (face-book-book.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"face-book-book.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006684; classtype:social-engineering; sid:6006684; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (projetoajusteupgrade.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"projetoajusteupgrade.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006685; classtype:social-engineering; sid:6006685; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.localizar-lphone-maps.click/FL26)"; flow:established,to_server; http.uri; content:"/FL26"; startswith; fast_pattern; http.host; content:"mail.localizar-lphone-maps.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006686; classtype:social-engineering; sid:6006686; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pacotededadosassinaturapremium.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"pacotededadosassinaturapremium.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006687; classtype:social-engineering; sid:6006687; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (programlimpeza.online/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"programlimpeza.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006688; classtype:social-engineering; sid:6006688; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (g-zeexpress24h.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"g-zeexpress24h.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006689; classtype:social-engineering; sid:6006689; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail-editor--webmail-in.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webmail-editor--webmail-in.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006690; classtype:social-engineering; sid:6006690; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (localizar-lphone-maps.click/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"localizar-lphone-maps.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006691; classtype:social-engineering; sid:6006691; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook.jmpost.cz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook.jmpost.cz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006692; classtype:social-engineering; sid:6006692; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabet1.org/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"galabet1.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006693; classtype:social-engineering; sid:6006693; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prabhatbhainsora9-blip.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"prabhatbhainsora9-blip.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006694; classtype:social-engineering; sid:6006694; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (q.swnuyc.com/SHope13/)"; flow:established,to_server; http.uri; content:"/SHope13/"; startswith; fast_pattern; http.host; content:"q.swnuyc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006695; classtype:social-engineering; sid:6006695; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortcheck.one/id/login)"; flow:established,to_server; http.uri; content:"/id/login"; startswith; fast_pattern; http.host; content:"fortcheck.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006696; classtype:social-engineering; sid:6006696; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portalrapidonuvip.online/presell/index.html)"; flow:established,to_server; http.uri; content:"/presell/index.html"; startswith; fast_pattern; http.host; content:"portalrapidonuvip.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006697; classtype:social-engineering; sid:6006697; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accounts-location.us/FL26)"; flow:established,to_server; http.uri; content:"/FL26"; startswith; fast_pattern; http.host; content:"accounts-location.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006698; classtype:social-engineering; sid:6006698; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (micuposolidario-credito.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"micuposolidario-credito.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006699; classtype:social-engineering; sid:6006699; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (invitation.waqasinteriors.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"invitation.waqasinteriors.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006700; classtype:social-engineering; sid:6006700; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabet.kesingirisadresi.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabet.kesingirisadresi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006701; classtype:social-engineering; sid:6006701; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (calendarbooking-team-ffd221d1eef9da6a.portal-01783827.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"calendarbooking-team-ffd221d1eef9da6a.portal-01783827.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006702; classtype:social-engineering; sid:6006702; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (678666.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"678666.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006703; classtype:social-engineering; sid:6006703; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wa.buzz-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wa.buzz-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006704; classtype:social-engineering; sid:6006704; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-nardevon-biz8-zurem-kasol.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-nardevon-biz8-zurem-kasol.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006705; classtype:social-engineering; sid:6006705; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sdffht3.pages.dev/gp/yourstore?ref_=nav_AccountFlyout_recs)"; flow:established,to_server; http.uri; content:"/gp/yourstore?ref_=nav_AccountFlyout_recs"; startswith; fast_pattern; http.host; content:"sdffht3.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006706; classtype:social-engineering; sid:6006706; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (actua-bhdlogisecur23.yzz.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"actua-bhdlogisecur23.yzz.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006707; classtype:social-engineering; sid:6006707; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store.communitydevstudion.shop/workshop/AWP-AncientHeritage/)"; flow:established,to_server; http.uri; content:"/workshop/AWP-AncientHeritage/"; startswith; fast_pattern; http.host; content:"store.communitydevstudion.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006708; classtype:social-engineering; sid:6006708; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-page-builder--lifestylepaid0.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-page-builder--lifestylepaid0.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006709; classtype:social-engineering; sid:6006709; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kesingirisadresi.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kesingirisadresi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006710; classtype:social-engineering; sid:6006710; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newmidashop.gamerstored.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"newmidashop.gamerstored.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006711; classtype:social-engineering; sid:6006711; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (materialdeapoioplanejamentofuturo.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"materialdeapoioplanejamentofuturo.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006712; classtype:social-engineering; sid:6006712; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-extensn-coin-wallet.typedream.app/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"secure-extensn-coin-wallet.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006713; classtype:social-engineering; sid:6006713; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xvtly54bfrn-snhgj54skru-7d4c0f-jmr76c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xvtly54bfrn-snhgj54skru-7d4c0f-jmr76c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006714; classtype:social-engineering; sid:6006714; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iniciactua.freepage.cc/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"iniciactua.freepage.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006715; classtype:social-engineering; sid:6006715; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (opulentbagjournal-e5d0c5555fae.herokuapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"opulentbagjournal-e5d0c5555fae.herokuapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006716; classtype:social-engineering; sid:6006716; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (document-sign-online--xfinityweb.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"document-sign-online--xfinityweb.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006717; classtype:social-engineering; sid:6006717; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sfahad-developer.github.io/Microsoft-Website-Clone/)"; flow:established,to_server; http.uri; content:"/Microsoft-Website-Clone/"; startswith; fast_pattern; http.host; content:"sfahad-developer.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006718; classtype:social-engineering; sid:6006718; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortprice.life/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortprice.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006719; classtype:social-engineering; sid:6006719; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (scalarium.info/Q0g0MS1OMTUxNS1EMDkwNjA2/)"; flow:established,to_server; http.uri; content:"/Q0g0MS1OMTUxNS1EMDkwNjA2/"; startswith; fast_pattern; http.host; content:"scalarium.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006720; classtype:social-engineering; sid:6006720; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (garminilgeen.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"garminilgeen.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006721; classtype:social-engineering; sid:6006721; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appviewtechs.info/p7ac92531z0b1f447fn8ff65a77s2f69c13b.html/)"; flow:established,to_server; http.uri; content:"/p7ac92531z0b1f447fn8ff65a77s2f69c13b.html/"; startswith; fast_pattern; http.host; content:"appviewtechs.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006722; classtype:social-engineering; sid:6006722; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fin-yhrzqz-1tj-innnr-arjxed.pages.dev/qaz-wsx-edc-rfv?welcome)"; flow:established,to_server; http.uri; content:"/qaz-wsx-edc-rfv?welcome"; startswith; fast_pattern; http.host; content:"fin-yhrzqz-1tj-innnr-arjxed.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006723; classtype:social-engineering; sid:6006723; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.actu32log-bhdcon.yzz.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.actu32log-bhdcon.yzz.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006724; classtype:social-engineering; sid:6006724; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (goo.su/LtzCyjN)"; flow:established,to_server; http.uri; content:"/LtzCyjN"; startswith; fast_pattern; http.host; content:"goo.su"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006725; classtype:social-engineering; sid:6006725; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.legers-live.us.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app.legers-live.us.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006726; classtype:social-engineering; sid:6006726; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hbkpt0b58pz-xlbdwlsi-2e9f4a-hbk20c.pages.dev/welcome_aboard?welcome=1000068689063090&token248=1000068689063090&name_token136=Rational%20Aquatic%20Solutions)"; flow:established,to_server; http.uri; content:"/welcome_aboard?welcome=1000068689063090&token248=1000068689063090&name_token136=Rational%20Aquatic%20Solutions"; startswith; fast_pattern; http.host; content:"hbkpt0b58pz-xlbdwlsi-2e9f4a-hbk20c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006727; classtype:social-engineering; sid:6006727; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (divine-disk-d5ba.sqskirlesovtqil.workers.dev/blue-tick-management-center/)"; flow:established,to_server; http.uri; content:"/blue-tick-management-center/"; startswith; fast_pattern; http.host; content:"divine-disk-d5ba.sqskirlesovtqil.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006728; classtype:social-engineering; sid:6006728; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (65.jj38638.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"65.jj38638.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006729; classtype:social-engineering; sid:6006729; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamazkixtn.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metamazkixtn.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006730; classtype:social-engineering; sid:6006730; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mkrjb04nhwu-pldwffynt-5d2e8f-vzk96a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mkrjb04nhwu-pldwffynt-5d2e8f-vzk96a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006731; classtype:social-engineering; sid:6006731; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nybr.ignorelist.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nybr.ignorelist.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006732; classtype:social-engineering; sid:6006732; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (one.audios-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"one.audios-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006733; classtype:social-engineering; sid:6006733; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.todosobreinstagram.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.todosobreinstagram.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006734; classtype:social-engineering; sid:6006734; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (expressdelivery-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"expressdelivery-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006735; classtype:social-engineering; sid:6006735; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (validacaodedados.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"validacaodedados.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006736; classtype:social-engineering; sid:6006736; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app81-facebook.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app81-facebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006737; classtype:social-engineering; sid:6006737; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamask-login-11.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metamask-login-11.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006738; classtype:social-engineering; sid:6006738; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seuacessonuvip.online/presell/index.html)"; flow:established,to_server; http.uri; content:"/presell/index.html"; startswith; fast_pattern; http.host; content:"seuacessonuvip.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006739; classtype:social-engineering; sid:6006739; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhd660bf367144d4ac0b5e290f.xo.je/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bhd660bf367144d4ac0b5e290f.xo.je"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006740; classtype:social-engineering; sid:6006740; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (financiamentovip.online/presell/index.html)"; flow:established,to_server; http.uri; content:"/presell/index.html"; startswith; fast_pattern; http.host; content:"financiamentovip.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006741; classtype:social-engineering; sid:6006741; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-ordelon-biz8-forem-ladix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-ordelon-biz8-forem-ladix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006742; classtype:social-engineering; sid:6006742; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mailupdatecomcast.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mailupdatecomcast.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006743; classtype:social-engineering; sid:6006743; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qcfzk952low-zjstrnhb-8a2c5f-kro9c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qcfzk952low-zjstrnhb-8a2c5f-kro9c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006744; classtype:social-engineering; sid:6006744; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (convivial-lynx-418603.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"convivial-lynx-418603.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006745; classtype:social-engineering; sid:6006745; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ithelpdeskweb.co.uk/?r=49e7cc3b-3fee-4498-a45c-17ec8694b6a1)"; flow:established,to_server; http.uri; content:"/?r=49e7cc3b-3fee-4498-a45c-17ec8694b6a1"; startswith; fast_pattern; http.host; content:"ithelpdeskweb.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006746; classtype:social-engineering; sid:6006746; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (doc-sign-online--microsoftlogs.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"doc-sign-online--microsoftlogs.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006747; classtype:social-engineering; sid:6006747; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.activar-bhd.zya.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.activar-bhd.zya.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006748; classtype:social-engineering; sid:6006748; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m10l-udzm-njt3.shimon-eldrotec-com-s-account.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m10l-udzm-njt3.shimon-eldrotec-com-s-account.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006749; classtype:social-engineering; sid:6006749; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bnb-verify.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bnb-verify.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006750; classtype:social-engineering; sid:6006750; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastupdatelogin.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastupdatelogin.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006751; classtype:social-engineering; sid:6006751; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portal.motiva-rodoviadigital.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portal.motiva-rodoviadigital.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006752; classtype:social-engineering; sid:6006752; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.corpfundraising.com/?rid=tQNQEuc)"; flow:established,to_server; http.uri; content:"/?rid=tQNQEuc"; startswith; fast_pattern; http.host; content:"login.corpfundraising.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006753; classtype:social-engineering; sid:6006753; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (32e3x2x.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"32e3x2x.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006754; classtype:social-engineering; sid:6006754; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-invoices-realworld-fi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-invoices-realworld-fi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006755; classtype:social-engineering; sid:6006755; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (express48h-delivery.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"express48h-delivery.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006756; classtype:social-engineering; sid:6006756; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.icloudsmy-deviced.info/FL26)"; flow:established,to_server; http.uri; content:"/FL26"; startswith; fast_pattern; http.host; content:"mail.icloudsmy-deviced.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006757; classtype:social-engineering; sid:6006757; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (renzostorepe.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"renzostorepe.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006758; classtype:social-engineering; sid:6006758; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ashtondamichotte-create.github.io/lol/)"; flow:established,to_server; http.uri; content:"/lol/"; startswith; fast_pattern; http.host; content:"ashtondamichotte-create.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006759; classtype:social-engineering; sid:6006759; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hongtintuc999-vn.github.io/21-7-2026-Ninh-Binh)"; flow:established,to_server; http.uri; content:"/21-7-2026-Ninh-Binh"; startswith; fast_pattern; http.host; content:"hongtintuc999-vn.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006760; classtype:social-engineering; sid:6006760; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-suitts-trezar.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en-suitts-trezar.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006761; classtype:social-engineering; sid:6006761; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloudsmy-deviced.info/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"icloudsmy-deviced.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006762; classtype:social-engineering; sid:6006762; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (guide-trzorsuite.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"guide-trzorsuite.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006763; classtype:social-engineering; sid:6006763; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vnj1s6.tokeonpqoket.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vnj1s6.tokeonpqoket.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006764; classtype:social-engineering; sid:6006764; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3ulqj-3qvq-fc61-ahmh7v-6x4b.pages.dev/qaz-wsx-edc-rfv?welcome)"; flow:established,to_server; http.uri; content:"/qaz-wsx-edc-rfv?welcome"; startswith; fast_pattern; http.host; content:"3ulqj-3qvq-fc61-ahmh7v-6x4b.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006765; classtype:social-engineering; sid:6006765; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.trust-ledger-login-patch-cache.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.trust-ledger-login-patch-cache.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006766; classtype:social-engineering; sid:6006766; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (network.draxioncapital.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"network.draxioncapital.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006767; classtype:social-engineering; sid:6006767; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (r43-b1aae8a08168.herokuapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"r43-b1aae8a08168.herokuapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006768; classtype:social-engineering; sid:6006768; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.info-regula2026.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.info-regula2026.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006769; classtype:social-engineering; sid:6006769; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wa.chats-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wa.chats-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006770; classtype:social-engineering; sid:6006770; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (urlto.me/2mt18)"; flow:established,to_server; http.uri; content:"/2mt18"; startswith; fast_pattern; http.host; content:"urlto.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006771; classtype:social-engineering; sid:6006771; rev:1; metadata: signature_severity Major, created_et 2026_08_05;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreicejwrsgoslwjbmbetg5xkj3fecci2n3opquairsjpjldogpdopdu.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreicejwrsgoslwjbmbetg5xkj3fecci2n3opquairsjpjldogpdopdu.ipfs.dweb.link"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006772; classtype:social-engineering; sid:6006772; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreibchf5bdqgzfbf65wghl4hbj5smxw2yirwmssk4tg64oce546u2by.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreibchf5bdqgzfbf65wghl4hbj5smxw2yirwmssk4tg64oce546u2by.ipfs.dweb.link"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006773; classtype:social-engineering; sid:6006773; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (us4.campaign-archive.com/?u=28f81e9682f6576801e976963&id=b517f5e339)"; flow:established,to_server; http.uri; content:"/?u=28f81e9682f6576801e976963&id=b517f5e339"; startswith; fast_pattern; http.host; content:"us4.campaign-archive.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006774; classtype:social-engineering; sid:6006774; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xmr7.com/rm/4809458-11087621-2-1-DE1-A17F/redacted@abuse.ionos.com/HCSF7ED)"; flow:established,to_server; http.uri; content:"/rm/4809458-11087621-2-1-DE1-A17F/redacted@abuse.ionos.com/HCSF7ED"; startswith; fast_pattern; http.host; content:"www.xmr7.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006775; classtype:social-engineering; sid:6006775; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreifbnyciwj444xafffljxoed2uit2wv4se3mnsgcsia2lw6rqglqdu.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreifbnyciwj444xafffljxoed2uit2wv4se3mnsgcsia2lw6rqglqdu.ipfs.dweb.link"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006776; classtype:social-engineering; sid:6006776; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-a13fd8ae9d5b4393b796c986c23416bc.r2.dev/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"pub-a13fd8ae9d5b4393b796c986c23416bc.r2.dev"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006777; classtype:social-engineering; sid:6006777; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreid3hkhchzopyxrbmbjuu4jgpuhleptzg4xjc4jcjde7bilayjdsw4.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreid3hkhchzopyxrbmbjuu4jgpuhleptzg4xjc4jcjde7bilayjdsw4.ipfs.dweb.link"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006778; classtype:social-engineering; sid:6006778; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreidc6sivfcj2zxyx43nxpken4ev3u6rvjthlcjzngdb6asedhslasq.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreidc6sivfcj2zxyx43nxpken4ev3u6rvjthlcjzngdb6asedhslasq.ipfs.dweb.link"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006779; classtype:social-engineering; sid:6006779; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (us1.campaign-archive.com/?e=d68e78f4ea&u=6c46b9dcd46f0164fc506a7a8&id=8d980f067d)"; flow:established,to_server; http.uri; content:"/?e=d68e78f4ea&u=6c46b9dcd46f0164fc506a7a8&id=8d980f067d"; startswith; fast_pattern; http.host; content:"us1.campaign-archive.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006780; classtype:social-engineering; sid:6006780; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (us11.campaign-archive.com/?u=b807c09af03c892d71d09f585&id=1b751e4d30)"; flow:established,to_server; http.uri; content:"/?u=b807c09af03c892d71d09f585&id=1b751e4d30"; startswith; fast_pattern; http.host; content:"us11.campaign-archive.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006781; classtype:social-engineering; sid:6006781; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gdrive-document.com/login_up.php)"; flow:established,to_server; http.uri; content:"/login_up.php"; startswith; fast_pattern; http.host; content:"gdrive-document.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006782; classtype:social-engineering; sid:6006782; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (us3.campaign-archive.com/?u=b8b9e39a2633339cd8dadedd0&id=cc3bffd549)"; flow:established,to_server; http.uri; content:"/?u=b8b9e39a2633339cd8dadedd0&id=cc3bffd549"; startswith; fast_pattern; http.host; content:"us3.campaign-archive.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006783; classtype:social-engineering; sid:6006783; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiez3wxyb4nszf6spq6jrtzk2uy57o3sgyu7527yiwf3vinrotwkgm.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiez3wxyb4nszf6spq6jrtzk2uy57o3sgyu7527yiwf3vinrotwkgm.ipfs.dweb.link"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006784; classtype:social-engineering; sid:6006784; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiehndwfndukbs5rksiaod7gitsazwaxhzyf5ob7riw2b4hklvwazu.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiehndwfndukbs5rksiaod7gitsazwaxhzyf5ob7riw2b4hklvwazu.ipfs.dweb.link"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006785; classtype:social-engineering; sid:6006785; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastcableservice.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastcableservice.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006786; classtype:social-engineering; sid:6006786; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitymail1.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitymail1.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006787; classtype:social-engineering; sid:6006787; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ape-rblx.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ape-rblx.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006788; classtype:social-engineering; sid:6006788; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamzklogzz.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metamzklogzz.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006789; classtype:social-engineering; sid:6006789; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-gilt-phi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-gilt-phi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006790; classtype:social-engineering; sid:6006790; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastmailsignin.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastmailsignin.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006791; classtype:social-engineering; sid:6006791; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.micuposolidario-credito.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.micuposolidario-credito.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006792; classtype:social-engineering; sid:6006792; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (torres-asociados.com/surfowl)"; flow:established,to_server; http.uri; content:"/surfowl"; startswith; fast_pattern; http.host; content:"torres-asociados.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006793; classtype:social-engineering; sid:6006793; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ahsdubai.info/aruba/arb.php)"; flow:established,to_server; http.uri; content:"/aruba/arb.php"; startswith; fast_pattern; http.host; content:"ahsdubai.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006794; classtype:social-engineering; sid:6006794; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (offline-treser.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"offline-treser.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006795; classtype:social-engineering; sid:6006795; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityloginservice.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinityloginservice.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006796; classtype:social-engineering; sid:6006796; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-git-henryharris-com2-2757-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-git-henryharris-com2-2757-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006797; classtype:social-engineering; sid:6006797; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopmidasbuy.officiall-events.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopmidasbuy.officiall-events.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006798; classtype:social-engineering; sid:6006798; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (misty-bronze-40q0z2bk.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"misty-bronze-40q0z2bk.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006799; classtype:social-engineering; sid:6006799; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfintyupgrade.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfintyupgrade.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006800; classtype:social-engineering; sid:6006800; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.authcloudsign.com/verify/ejx9i5bi3ssyi0dlyv)"; flow:established,to_server; http.uri; content:"/verify/ejx9i5bi3ssyi0dlyv"; startswith; fast_pattern; http.host; content:"www.authcloudsign.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006801; classtype:social-engineering; sid:6006801; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loginxfinty.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"loginxfinty.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006802; classtype:social-engineering; sid:6006802; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (technical-engineering-2026.github.io/repair-mechanical/#ZXhhbXBsZUBkb21haW4uaW52YWxpZA==)"; flow:established,to_server; http.uri; content:"/repair-mechanical/#ZXhhbXBsZUBkb21haW4uaW52YWxpZA=="; startswith; fast_pattern; http.host; content:"technical-engineering-2026.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006803; classtype:social-engineering; sid:6006803; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (agents-icloud.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"agents-icloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006804; classtype:social-engineering; sid:6006804; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-git-fix-com2-2803-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-git-fix-com2-2803-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006805; classtype:social-engineering; sid:6006805; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hbkpt42bfrn-xlbdwskr-2d7c4f-hbk11c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hbkpt42bfrn-xlbdwskr-2d7c4f-hbk11c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006806; classtype:social-engineering; sid:6006806; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastvoicemailer.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastvoicemailer.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006807; classtype:social-engineering; sid:6006807; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmailxfi.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webmailxfi.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006808; classtype:social-engineering; sid:6006808; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ape-rblx.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ape-rblx.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006809; classtype:social-engineering; sid:6006809; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aribashakil568-art.github.io/NETFLIX_CLONE/)"; flow:established,to_server; http.uri; content:"/NETFLIX_CLONE/"; startswith; fast_pattern; http.host; content:"aribashakil568-art.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006810; classtype:social-engineering; sid:6006810; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (groupe-online.com/raiffeisench/)"; flow:established,to_server; http.uri; content:"/raiffeisench/"; startswith; fast_pattern; http.host; content:"groupe-online.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006811; classtype:social-engineering; sid:6006811; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (msapps20394.ocbdc.com/?apps)"; flow:established,to_server; http.uri; content:"/?apps"; startswith; fast_pattern; http.host; content:"msapps20394.ocbdc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006812; classtype:social-engineering; sid:6006812; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zappitellicpasinc.com/heheewejhwebddjhwwehqw/PDF%20NEW.Html)"; flow:established,to_server; http.uri; content:"/heheewejhwebddjhwwehqw/PDF%20NEW.Html"; startswith; fast_pattern; http.host; content:"zappitellicpasinc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006813; classtype:social-engineering; sid:6006813; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastupdatemail.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastupdatemail.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006814; classtype:social-engineering; sid:6006814; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastverifylogin.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastverifylogin.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006815; classtype:social-engineering; sid:6006815; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xffiniittyy.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xffiniittyy.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006816; classtype:social-engineering; sid:6006816; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezorlogin-start.pages.dev/.well-known/security.txt)"; flow:established,to_server; http.uri; content:"/.well-known/security.txt"; startswith; fast_pattern; http.host; content:"trezorlogin-start.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006817; classtype:social-engineering; sid:6006817; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (updatemycomcast.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"updatemycomcast.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006818; classtype:social-engineering; sid:6006818; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myisxjas.us.cc/5g/home.html)"; flow:established,to_server; http.uri; content:"/5g/home.html"; startswith; fast_pattern; http.host; content:"myisxjas.us.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006819; classtype:social-engineering; sid:6006819; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (walmart.survey-code.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"walmart.survey-code.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006820; classtype:social-engineering; sid:6006820; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (voicexfinity.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"voicexfinity.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006821; classtype:social-engineering; sid:6006821; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tamcollect.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tamcollect.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006822; classtype:social-engineering; sid:6006822; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (grouponedeals.com/?r=64703153-a2b5-411a-a374-1412eea74a2b)"; flow:established,to_server; http.uri; content:"/?r=64703153-a2b5-411a-a374-1412eea74a2b"; startswith; fast_pattern; http.host; content:"grouponedeals.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006823; classtype:social-engineering; sid:6006823; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (scuderiailbobolino.it/wp-includes/rest-api/1rijsla/csch/ch/capch.php)"; flow:established,to_server; http.uri; content:"/wp-includes/rest-api/1rijsla/csch/ch/capch.php"; startswith; fast_pattern; http.host; content:"scuderiailbobolino.it"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006824; classtype:social-engineering; sid:6006824; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmailxfi.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webmailxfi.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006825; classtype:social-engineering; sid:6006825; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sumansaurabh01.github.io/movie-stream-app/)"; flow:established,to_server; http.uri; content:"/movie-stream-app/"; startswith; fast_pattern; http.host; content:"sumansaurabh01.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006826; classtype:social-engineering; sid:6006826; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcast-voice.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcast-voice.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006827; classtype:social-engineering; sid:6006827; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (heavenly-friday-987120.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"heavenly-friday-987120.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006828; classtype:social-engineering; sid:6006828; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dmv-ca.gnewia.shop/pay/_frame/a_index.html)"; flow:established,to_server; http.uri; content:"/pay/_frame/a_index.html"; startswith; fast_pattern; http.host; content:"dmv-ca.gnewia.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006829; classtype:social-engineering; sid:6006829; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastcommunicationservice.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastcommunicationservice.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006830; classtype:social-engineering; sid:6006830; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mailerxfinity.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mailerxfinity.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006831; classtype:social-engineering; sid:6006831; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cici606.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cici606.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006832; classtype:social-engineering; sid:6006832; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcast-voice.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcast-voice.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006833; classtype:social-engineering; sid:6006833; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfintyupdate.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfintyupdate.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006834; classtype:social-engineering; sid:6006834; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-ledgerlive-desk.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"help-ledgerlive-desk.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006835; classtype:social-engineering; sid:6006835; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityloginserver.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinityloginserver.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006836; classtype:social-engineering; sid:6006836; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (asureindirect.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"asureindirect.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006837; classtype:social-engineering; sid:6006837; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metplast.com.tr/redirect.php)"; flow:established,to_server; http.uri; content:"/redirect.php"; startswith; fast_pattern; http.host; content:"metplast.com.tr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006838; classtype:social-engineering; sid:6006838; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (twxpl826a-phvjn7qmy-5c8e-zgr94p.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"twxpl826a-phvjn7qmy-5c8e-zgr94p.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006839; classtype:social-engineering; sid:6006839; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trzobridg.zapier.app/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"trzobridg.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006840; classtype:social-engineering; sid:6006840; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-v1amz.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"support-v1amz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006841; classtype:social-engineering; sid:6006841; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (website-homepage-ledgerlive.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"website-homepage-ledgerlive.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006842; classtype:social-engineering; sid:6006842; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (falling-band-d4b1.khansamuelyut77345jud75413.workers.dev/support-contact)"; flow:established,to_server; http.uri; content:"/support-contact"; startswith; fast_pattern; http.host; content:"falling-band-d4b1.khansamuelyut77345jud75413.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006843; classtype:social-engineering; sid:6006843; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sancomcomcf.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sancomcomcf.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006844; classtype:social-engineering; sid:6006844; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wefiletransfer0562026.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wefiletransfer0562026.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006845; classtype:social-engineering; sid:6006845; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (exo--dus---web.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"exo--dus---web.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006846; classtype:social-engineering; sid:6006846; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bancodobrasil-parceiros.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bancodobrasil-parceiros.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006847; classtype:social-engineering; sid:6006847; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dvkjdvjdjkldvkkl.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dvkjdvjdjkldvkkl.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006848; classtype:social-engineering; sid:6006848; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xlbdw83-vnzkt104vzk-3c6d7f-msp28.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xlbdw83-vnzkt104vzk-3c6d7f-msp28.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006849; classtype:social-engineering; sid:6006849; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.galabet.fans/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.galabet.fans"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006850; classtype:social-engineering; sid:6006850; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagramaccounthacks.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagramaccounthacks.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006851; classtype:social-engineering; sid:6006851; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastupdate1.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastupdate1.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006852; classtype:social-engineering; sid:6006852; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (journey.companymessagecenter.com/6197094-oH1faBZb-PKS9Q)"; flow:established,to_server; http.uri; content:"/6197094-oH1faBZb-PKS9Q"; startswith; fast_pattern; http.host; content:"journey.companymessagecenter.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006853; classtype:social-engineering; sid:6006853; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastmailupgrade.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastmailupgrade.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006854; classtype:social-engineering; sid:6006854; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marnavi-nqx-felxora-p2t4hk95.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"marnavi-nqx-felxora-p2t4hk95.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006855; classtype:social-engineering; sid:6006855; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-curtidas-gratis.app.ufrj.br/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-curtidas-gratis.app.ufrj.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006856; classtype:social-engineering; sid:6006856; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.yourupdatenow.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.yourupdatenow.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006857; classtype:social-engineering; sid:6006857; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityonlineweb.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinityonlineweb.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006858; classtype:social-engineering; sid:6006858; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mailxfinty.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mailxfinty.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006859; classtype:social-engineering; sid:6006859; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ilmax.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ilmax.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006860; classtype:social-engineering; sid:6006860; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sportbookstop.com/chsr)"; flow:established,to_server; http.uri; content:"/chsr"; startswith; fast_pattern; http.host; content:"www.sportbookstop.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006861; classtype:social-engineering; sid:6006861; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (khuzema24602.github.io/amazon-homepage-clone/)"; flow:established,to_server; http.uri; content:"/amazon-homepage-clone/"; startswith; fast_pattern; http.host; content:"khuzema24602.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006862; classtype:social-engineering; sid:6006862; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.goo.su/malxjis/)"; flow:established,to_server; http.uri; content:"/malxjis/"; startswith; fast_pattern; http.host; content:"www.goo.su"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006863; classtype:social-engineering; sid:6006863; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arubaspidlivellosicurezza.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"arubaspidlivellosicurezza.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006864; classtype:social-engineering; sid:6006864; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apeshraw28-dotcom.github.io/Instgram-login/)"; flow:established,to_server; http.uri; content:"/Instgram-login/"; startswith; fast_pattern; http.host; content:"apeshraw28-dotcom.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006865; classtype:social-engineering; sid:6006865; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityupdatemailbox.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinityupdatemailbox.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006866; classtype:social-engineering; sid:6006866; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (51544511655.lat/agent.html)"; flow:established,to_server; http.uri; content:"/agent.html"; startswith; fast_pattern; http.host; content:"51544511655.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006867; classtype:social-engineering; sid:6006867; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santandermx.github.io/com.mx/)"; flow:established,to_server; http.uri; content:"/com.mx/"; startswith; fast_pattern; http.host; content:"santandermx.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006868; classtype:social-engineering; sid:6006868; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (esl-org-message.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"esl-org-message.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006869; classtype:social-engineering; sid:6006869; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (test1527276253-dotcom.github.io/El/)"; flow:established,to_server; http.uri; content:"/El/"; startswith; fast_pattern; http.host; content:"test1527276253-dotcom.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006870; classtype:social-engineering; sid:6006870; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastcableservice.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastcableservice.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006871; classtype:social-engineering; sid:6006871; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcast-login-page.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcast-login-page.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006872; classtype:social-engineering; sid:6006872; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telvora-nqx-zarqumi-a1x4dp37.pages.dev/thn-yjm-uio-lkh?welcome=2043158912592190&stt=2043158912592190&name_stt=Riverdale%20Ridge%20Ravens%20HS%20Baseball)"; flow:established,to_server; http.uri; content:"/thn-yjm-uio-lkh?welcome=2043158912592190&stt=2043158912592190&name_stt=Riverdale%20Ridge%20Ravens%20HS%20Baseball"; startswith; fast_pattern; http.host; content:"telvora-nqx-zarqumi-a1x4dp37.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006873; classtype:social-engineering; sid:6006873; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mailxfinty.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mailxfinty.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006874; classtype:social-engineering; sid:6006874; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastmailserver.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastmailserver.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006875; classtype:social-engineering; sid:6006875; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastservicemail.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastservicemail.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006876; classtype:social-engineering; sid:6006876; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitymedia.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitymedia.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006877; classtype:social-engineering; sid:6006877; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (service-xoom-be.com/app)"; flow:established,to_server; http.uri; content:"/app"; startswith; fast_pattern; http.host; content:"service-xoom-be.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006878; classtype:social-engineering; sid:6006878; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aaavvveeronsss.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aaavvveeronsss.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006879; classtype:social-engineering; sid:6006879; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (startapps-trezor.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"startapps-trezor.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006880; classtype:social-engineering; sid:6006880; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yhdhgdnnd.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yhdhgdnnd.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006881; classtype:social-engineering; sid:6006881; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gfvcd7dplix-klmqwuhy-4c3d0e-yh633a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gfvcd7dplix-klmqwuhy-4c3d0e-yh633a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006882; classtype:social-engineering; sid:6006882; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfnityaccount.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfnityaccount.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006883; classtype:social-engineering; sid:6006883; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fls-a26e4c11-7b90-4acb-93c5-fedf92a262cc.laravel.cloud/sign.html)"; flow:established,to_server; http.uri; content:"/sign.html"; startswith; fast_pattern; http.host; content:"fls-a26e4c11-7b90-4acb-93c5-fedf92a262cc.laravel.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006884; classtype:social-engineering; sid:6006884; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastwifi.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastwifi.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006885; classtype:social-engineering; sid:6006885; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (andy-weiders.com/updatego1)"; flow:established,to_server; http.uri; content:"/updatego1"; startswith; fast_pattern; http.host; content:"andy-weiders.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006886; classtype:social-engineering; sid:6006886; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfnityupdate.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfnityupdate.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006887; classtype:social-engineering; sid:6006887; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinity-mail-update.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinity-mail-update.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006888; classtype:social-engineering; sid:6006888; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (objectstorage.ap-kulai-2.oraclecloud.com/n/axqwdn9ov3iw/b/bucket-20260730-1024/o/DocuSign.html?cms=test@yahoo.com)"; flow:established,to_server; http.uri; content:"/n/axqwdn9ov3iw/b/bucket-20260730-1024/o/DocuSign.html?cms=test@yahoo.com"; startswith; fast_pattern; http.host; content:"objectstorage.ap-kulai-2.oraclecloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006889; classtype:social-engineering; sid:6006889; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jatony.com/m/index.html)"; flow:established,to_server; http.uri; content:"/m/index.html"; startswith; fast_pattern; http.host; content:"jatony.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006890; classtype:social-engineering; sid:6006890; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-us-desktop-ledgere.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en-us-desktop-ledgere.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006891; classtype:social-engineering; sid:6006891; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcast-mobile.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcast-mobile.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006892; classtype:social-engineering; sid:6006892; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth-secure.me/E.1UTKoGLQv9Dg4CSF3Q?/workitems/3ont208h/WorkItemMention/VGhpcyBtaWdodCBiZSBhIEhveGh1bnQgc2ltdWxhdGlvbi4gT25seSBvbmUgd2F5IHRvIGZpbmQgb3V0Li4u)"; flow:established,to_server; http.uri; content:"/E.1UTKoGLQv9Dg4CSF3Q?/workitems/3ont208h/WorkItemMention/VGhpcyBtaWdodCBiZSBhIEhveGh1bnQgc2ltdWxhdGlvbi4gT25seSBvbmUgd2F5IHRvIGZpbmQgb3V0Li4u"; startswith; fast_pattern; http.host; content:"auth-secure.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006893; classtype:social-engineering; sid:6006893; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.face-book-book.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.face-book-book.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006894; classtype:social-engineering; sid:6006894; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gemini.141010.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gemini.141010.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006895; classtype:social-engineering; sid:6006895; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastpagelogin.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastpagelogin.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006896; classtype:social-engineering; sid:6006896; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (siayeo.com.sg/gonl/billing.getmyparkticket.online/PostNL/index.php)"; flow:established,to_server; http.uri; content:"/gonl/billing.getmyparkticket.online/PostNL/index.php"; startswith; fast_pattern; http.host; content:"siayeo.com.sg"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006897; classtype:social-engineering; sid:6006897; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitmail.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitmail.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006898; classtype:social-engineering; sid:6006898; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastwebmailserver.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastwebmailserver.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006899; classtype:social-engineering; sid:6006899; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dry-thunder-f3f8.guidance-to-users.workers.dev/privacy-information-center/)"; flow:established,to_server; http.uri; content:"/privacy-information-center/"; startswith; fast_pattern; http.host; content:"dry-thunder-f3f8.guidance-to-users.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006900; classtype:social-engineering; sid:6006900; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastupdateservice.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastupdateservice.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006901; classtype:social-engineering; sid:6006901; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (click-hostopoint-ch-redirect5824312.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"click-hostopoint-ch-redirect5824312.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006902; classtype:social-engineering; sid:6006902; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trazurostartiio.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trazurostartiio.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006903; classtype:social-engineering; sid:6006903; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mailupdatecomcast.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mailupdatecomcast.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006904; classtype:social-engineering; sid:6006904; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastwebmailupdate.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastwebmailupdate.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006905; classtype:social-engineering; sid:6006905; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastserverservice.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastserverservice.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006906; classtype:social-engineering; sid:6006906; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bridge-teregor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bridge-teregor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006907; classtype:social-engineering; sid:6006907; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tahmidifty.github.io/hw-2)"; flow:established,to_server; http.uri; content:"/hw-2"; startswith; fast_pattern; http.host; content:"tahmidifty.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006908; classtype:social-engineering; sid:6006908; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (signinxfinity.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"signinxfinity.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006909; classtype:social-engineering; sid:6006909; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.qeju.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.qeju.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006910; classtype:social-engineering; sid:6006910; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (victor9699.github.io/my-second-projects)"; flow:established,to_server; http.uri; content:"/my-second-projects"; startswith; fast_pattern; http.host; content:"victor9699.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006911; classtype:social-engineering; sid:6006911; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (upgradexfinity.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"upgradexfinity.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006912; classtype:social-engineering; sid:6006912; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebokksecurity.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebokksecurity.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006913; classtype:social-engineering; sid:6006913; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcastupdatelogin.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcastupdatelogin.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006914; classtype:social-engineering; sid:6006914; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityupdatemailer.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinityupdatemailer.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006915; classtype:social-engineering; sid:6006915; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastupdatesignin.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastupdatesignin.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006916; classtype:social-engineering; sid:6006916; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastservermail.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastservermail.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006917; classtype:social-engineering; sid:6006917; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityloginconnect.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinityloginconnect.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006918; classtype:social-engineering; sid:6006918; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastconnect.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastconnect.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006919; classtype:social-engineering; sid:6006919; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.anode-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.anode-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006920; classtype:social-engineering; sid:6006920; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sign-in-xfinity.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sign-in-xfinity.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006921; classtype:social-engineering; sid:6006921; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfi-voice.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfi-voice.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006922; classtype:social-engineering; sid:6006922; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (teameitb.com/libraries/body.html?js=true)"; flow:established,to_server; http.uri; content:"/libraries/body.html?js=true"; startswith; fast_pattern; http.host; content:"teameitb.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006923; classtype:social-engineering; sid:6006923; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfntymail.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfntymail.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006924; classtype:social-engineering; sid:6006924; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-page-builder--bigpride007.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-page-builder--bigpride007.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006925; classtype:social-engineering; sid:6006925; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bridge-terzor-io-en.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bridge-terzor-io-en.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006926; classtype:social-engineering; sid:6006926; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kuqoinlognn.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kuqoinlognn.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006927; classtype:social-engineering; sid:6006927; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-comcast.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-comcast.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006928; classtype:social-engineering; sid:6006928; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sign-in-xfinity.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sign-in-xfinity.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006929; classtype:social-engineering; sid:6006929; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcast-webmail-service.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcast-webmail-service.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006930; classtype:social-engineering; sid:6006930; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (karolinanaziemiec.com/images/ke/generalwebmail.html)"; flow:established,to_server; http.uri; content:"/images/ke/generalwebmail.html"; startswith; fast_pattern; http.host; content:"karolinanaziemiec.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006931; classtype:social-engineering; sid:6006931; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastverificationupdate.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastverificationupdate.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006932; classtype:social-engineering; sid:6006932; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login-spectrum-email-for-update-mail.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login-spectrum-email-for-update-mail.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006933; classtype:social-engineering; sid:6006933; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastwifi.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastwifi.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006934; classtype:social-engineering; sid:6006934; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitilogin.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitilogin.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006935; classtype:social-engineering; sid:6006935; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitymail-update.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitymail-update.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006936; classtype:social-engineering; sid:6006936; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-coinbase-pro-cdn.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-coinbase-pro-cdn.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006937; classtype:social-engineering; sid:6006937; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moonpay-commerce-3bex710ga-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moonpay-commerce-3bex710ga-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006938; classtype:social-engineering; sid:6006938; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabet.girisiguncel.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabet.girisiguncel.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006939; classtype:social-engineering; sid:6006939; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qcfzk8avstryz-bgrnd65kmja-0d1e5f-spl4c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qcfzk8avstryz-bgrnd65kmja-0d1e5f-spl4c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006940; classtype:social-engineering; sid:6006940; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.qrsu.io/XQb6b/)"; flow:established,to_server; http.uri; content:"/XQb6b/"; startswith; fast_pattern; http.host; content:"www.qrsu.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006941; classtype:social-engineering; sid:6006941; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prashant-gkv.github.io/amazon-front-end)"; flow:established,to_server; http.uri; content:"/amazon-front-end"; startswith; fast_pattern; http.host; content:"prashant-gkv.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006942; classtype:social-engineering; sid:6006942; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastnetwork.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastnetwork.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006943; classtype:social-engineering; sid:6006943; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.moonpay-commerce-git-henryharris-com2-2757-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.moonpay-commerce-git-henryharris-com2-2757-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006944; classtype:social-engineering; sid:6006944; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-velnor-biz8-carex-dolim.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-velnor-biz8-carex-dolim.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006945; classtype:social-engineering; sid:6006945; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.lokalna-1920088771.lol/oferta/steam-deck-oled-512gb-ssd-stan-bardzo-dobry-komplet/659844061)"; flow:established,to_server; http.uri; content:"/oferta/steam-deck-oled-512gb-ssd-stan-bardzo-dobry-komplet/659844061"; startswith; fast_pattern; http.host; content:"allegrolokalnie.lokalna-1920088771.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006946; classtype:social-engineering; sid:6006946; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookloginfriends.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebookloginfriends.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006947; classtype:social-engineering; sid:6006947; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (beunonasssss-bot.github.io/Hack)"; flow:established,to_server; http.uri; content:"/Hack"; startswith; fast_pattern; http.host; content:"beunonasssss-bot.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006948; classtype:social-engineering; sid:6006948; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galabet.guncel45.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galabet.guncel45.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006949; classtype:social-engineering; sid:6006949; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastservice.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastservice.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006950; classtype:social-engineering; sid:6006950; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (heralds.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"heralds.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006951; classtype:social-engineering; sid:6006951; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp6ct-korlen-biz8-zavrik-folmar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp6ct-korlen-biz8-zavrik-folmar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006952; classtype:social-engineering; sid:6006952; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1cliente-m-limpfeirao.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1cliente-m-limpfeirao.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006953; classtype:social-engineering; sid:6006953; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.moonpay-commerce-git-fix-com2-2803-heliofi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.moonpay-commerce-git-fix-com2-2803-heliofi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006954; classtype:social-engineering; sid:6006954; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastlive.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastlive.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006955; classtype:social-engineering; sid:6006955; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gemini.hrxgxai.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gemini.hrxgxai.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006956; classtype:social-engineering; sid:6006956; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitypageupdate.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitypageupdate.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006957; classtype:social-engineering; sid:6006957; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastmailerupdate.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastmailerupdate.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006958; classtype:social-engineering; sid:6006958; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-fun-checkout-prototype-uniswap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-fun-checkout-prototype-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006959; classtype:social-engineering; sid:6006959; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-documents--files056.replit.app/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"secure-documents--files056.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006960; classtype:social-engineering; sid:6006960; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp5ct-surel-biz8-fonik-karem.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp5ct-surel-biz8-fonik-karem.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006961; classtype:social-engineering; sid:6006961; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcast-webmail-service.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcast-webmail-service.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006962; classtype:social-engineering; sid:6006962; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp6ct-naskel-biz8-vorpex-lintor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp6ct-naskel-biz8-vorpex-lintor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006963; classtype:social-engineering; sid:6006963; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagramcheck.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagramcheck.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006964; classtype:social-engineering; sid:6006964; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ezb.34fsfat.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ezb.34fsfat.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006965; classtype:social-engineering; sid:6006965; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfntymail.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfntymail.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006966; classtype:social-engineering; sid:6006966; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastservice-update.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastservice-update.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006967; classtype:social-engineering; sid:6006967; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zdkpt6agpxo-wjsngmja-5e8f2b-zdk61c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zdkpt6agpxo-wjsngmja-5e8f2b-zdk61c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006968; classtype:social-engineering; sid:6006968; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flutney.com/wp-includes/assets/csn/err.html)"; flow:established,to_server; http.uri; content:"/wp-includes/assets/csn/err.html"; startswith; fast_pattern; http.host; content:"flutney.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006969; classtype:social-engineering; sid:6006969; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityhub.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinityhub.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006970; classtype:social-engineering; sid:6006970; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflixt.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflixt.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006971; classtype:social-engineering; sid:6006971; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (random-chocolate-trkjykfk.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"random-chocolate-trkjykfk.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006972; classtype:social-engineering; sid:6006972; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastconnect.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastconnect.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006973; classtype:social-engineering; sid:6006973; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp13ct-fravvik-biz-pransik-hazdor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp13ct-fravvik-biz-pransik-hazdor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006974; classtype:social-engineering; sid:6006974; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (saabeqoon.com/cssd/leo/)"; flow:established,to_server; http.uri; content:"/cssd/leo/"; startswith; fast_pattern; http.host; content:"saabeqoon.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006975; classtype:social-engineering; sid:6006975; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xvtly74lkww-snhgjzwur-7b6f1a-jmr55p.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xvtly74lkww-snhgjzwur-7b6f1a-jmr55p.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006976; classtype:social-engineering; sid:6006976; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8bn7987b.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8bn7987b.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006977; classtype:social-engineering; sid:6006977; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebooklogini.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebooklogini.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006978; classtype:social-engineering; sid:6006978; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (securityawareness.cc/landing/form/80f25bb5-d42e-4d41-aa93-1ce79589c881)"; flow:established,to_server; http.uri; content:"/landing/form/80f25bb5-d42e-4d41-aa93-1ce79589c881"; startswith; fast_pattern; http.host; content:"securityawareness.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006979; classtype:social-engineering; sid:6006979; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortcheck.org/id/login)"; flow:established,to_server; http.uri; content:"/id/login"; startswith; fast_pattern; http.host; content:"fortcheck.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006980; classtype:social-engineering; sid:6006980; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (msprq62kfly-ycgfnpdr-0e3a6b-vn433c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"msprq62kfly-ycgfnpdr-0e3a6b-vn433c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006981; classtype:social-engineering; sid:6006981; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mailcomcst.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mailcomcst.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006982; classtype:social-engineering; sid:6006982; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mailserverxfinity.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mailserverxfinity.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006983; classtype:social-engineering; sid:6006983; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinty-server.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinty-server.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006984; classtype:social-engineering; sid:6006984; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ishakdjouadi2008-cyber.github.io/netflix)"; flow:established,to_server; http.uri; content:"/netflix"; startswith; fast_pattern; http.host; content:"ishakdjouadi2008-cyber.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6006985; classtype:social-engineering; sid:6006985; rev:1; metadata: signature_severity Major, created_et 2026_08_06;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zhta2873-lang.github.io/site-0mvvly1m)"; flow:established,to_server; http.uri; content:"/site-0mvvly1m"; startswith; fast_pattern; http.host; content:"zhta2873-lang.github.io"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006986; classtype:social-engineering; sid:6006986; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2026-08-07.urldance.com/us?howtosuecslplasma.org#nolanguage)"; flow:established,to_server; http.uri; content:"/us?howtosuecslplasma.org#nolanguage"; startswith; fast_pattern; http.host; content:"2026-08-07.urldance.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006987; classtype:social-engineering; sid:6006987; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kalxio.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kalxio.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006988; classtype:social-engineering; sid:6006988; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mvm-nexthu.com/login_up.php)"; flow:established,to_server; http.uri; content:"/login_up.php"; startswith; fast_pattern; http.host; content:"www.mvm-nexthu.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006989; classtype:social-engineering; sid:6006989; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.myacmonthy.com/login_up.php)"; flow:established,to_server; http.uri; content:"/login_up.php"; startswith; fast_pattern; http.host; content:"www.myacmonthy.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006990; classtype:social-engineering; sid:6006990; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alphazoneshop.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"alphazoneshop.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006991; classtype:social-engineering; sid:6006991; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maryjesse0113.wixsite.com/my-site-3)"; flow:established,to_server; http.uri; content:"/my-site-3"; startswith; fast_pattern; http.host; content:"maryjesse0113.wixsite.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006992; classtype:social-engineering; sid:6006992; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (livelo-promo.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"livelo-promo.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006993; classtype:social-engineering; sid:6006993; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mailnotificationcomcast.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mailnotificationcomcast.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006994; classtype:social-engineering; sid:6006994; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (genial-universe-605034.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"genial-universe-605034.framer.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006995; classtype:social-engineering; sid:6006995; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflixapp.com/calcul)"; flow:established,to_server; http.uri; content:"/calcul"; startswith; fast_pattern; http.host; content:"netflixapp.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006996; classtype:social-engineering; sid:6006996; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhommepl.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dhommepl.weebly.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006997; classtype:social-engineering; sid:6006997; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acessopessoafisica.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"acessopessoafisica.cc"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006998; classtype:social-engineering; sid:6006998; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (espaces-prims.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"espaces-prims.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6006999; classtype:social-engineering; sid:6006999; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.maxis.com.my/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.maxis.com.my"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007000; classtype:social-engineering; sid:6007000; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bilalbajwa-tech.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"bilalbajwa-tech.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007001; classtype:social-engineering; sid:6007001; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (streambell.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"streambell.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007002; classtype:social-engineering; sid:6007002; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-hormel-biz-prandar-velsik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-hormel-biz-prandar-velsik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007003; classtype:social-engineering; sid:6007003; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (subh498.github.io/Spotify-clone)"; flow:established,to_server; http.uri; content:"/Spotify-clone"; startswith; fast_pattern; http.host; content:"subh498.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007004; classtype:social-engineering; sid:6007004; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (svsgnxzsyqdkapvq.auroravaultgame.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"svsgnxzsyqdkapvq.auroravaultgame.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007005; classtype:social-engineering; sid:6007005; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xg3o-oh5spr-ulb5t4-r4dh8.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xg3o-oh5spr-ulb5t4-r4dh8.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007006; classtype:social-engineering; sid:6007006; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-vazsel-biz-prondar-hormok.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-vazsel-biz-prondar-hormok.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007007; classtype:social-engineering; sid:6007007; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcastcommunicationservice.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcastcommunicationservice.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007008; classtype:social-engineering; sid:6007008; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pjbrq1dqtwil-txmknnnx-2b3c7d-tx999a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pjbrq1dqtwil-txmknnnx-2b3c7d-tx999a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007009; classtype:social-engineering; sid:6007009; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-varkel-biz-frensok-ladmor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-varkel-biz-frensok-ladmor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007010; classtype:social-engineering; sid:6007010; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stcjp.s3.eu-north-1.amazonaws.com/esign.htm?uid=nelixsys@d9198d29b6f6d590408c2e0c0383299dec38.net)"; flow:established,to_server; http.uri; content:"/esign.htm?uid=nelixsys@d9198d29b6f6d590408c2e0c0383299dec38.net"; startswith; fast_pattern; http.host; content:"stcjp.s3.eu-north-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007011; classtype:social-engineering; sid:6007011; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-zelmor-biz-frandek-vorsal.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-zelmor-biz-frandek-vorsal.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007012; classtype:social-engineering; sid:6007012; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcascommunicationcable.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcascommunicationcable.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007013; classtype:social-engineering; sid:6007013; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-horvek-biz-kemsor-ladmik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-horvek-biz-kemsor-ladmik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007014; classtype:social-engineering; sid:6007014; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6.rewardingmyself.com/index-form.php)"; flow:established,to_server; http.uri; content:"/index-form.php"; startswith; fast_pattern; http.host; content:"6.rewardingmyself.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007015; classtype:social-engineering; sid:6007015; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-farnok-biz-heldik-prasor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-farnok-biz-heldik-prasor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007016; classtype:social-engineering; sid:6007016; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (securetrezr-public.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"securetrezr-public.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007017; classtype:social-engineering; sid:6007017; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee4949.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee4949.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007018; classtype:social-engineering; sid:6007018; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.web-comcast.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.web-comcast.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007019; classtype:social-engineering; sid:6007019; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anurag2327spotifyclone.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"anurag2327spotifyclone.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007020; classtype:social-engineering; sid:6007020; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (simple-security-page--pinewl.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"simple-security-page--pinewl.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007021; classtype:social-engineering; sid:6007021; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.addqf.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.addqf.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007022; classtype:social-engineering; sid:6007022; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-zersik-biz-hazdor-pramel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-zersik-biz-hazdor-pramel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007023; classtype:social-engineering; sid:6007023; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (90533.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"90533.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007024; classtype:social-engineering; sid:6007024; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-vernik-biz-polsar-kazrel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-vernik-biz-polsar-kazrel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007025; classtype:social-engineering; sid:6007025; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-prendal-biz-zomvik-harsok.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-prendal-biz-zomvik-harsok.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007026; classtype:social-engineering; sid:6007026; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-karmor-biz-frensel-holdik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-karmor-biz-frensel-holdik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007027; classtype:social-engineering; sid:6007027; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trazoreio-help.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trazoreio-help.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007028; classtype:social-engineering; sid:6007028; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-lavdok-biz-kormel-fransik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-lavdok-biz-kormel-fransik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007029; classtype:social-engineering; sid:6007029; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinitypageupdate.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinitypageupdate.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007030; classtype:social-engineering; sid:6007030; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wbillbell.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wbillbell.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007031; classtype:social-engineering; sid:6007031; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alternativaautopecas.com.br/wp-content/japan/?naps)"; flow:established,to_server; http.uri; content:"/wp-content/japan/?naps"; startswith; fast_pattern; http.host; content:"alternativaautopecas.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007032; classtype:social-engineering; sid:6007032; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (us--start-en-trazor-io-com-cdn--en.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"us--start-en-trazor-io-com-cdn--en.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007033; classtype:social-engineering; sid:6007033; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zh1478.craftum.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zh1478.craftum.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007034; classtype:social-engineering; sid:6007034; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (648544584.vip/agent.html)"; flow:established,to_server; http.uri; content:"/agent.html"; startswith; fast_pattern; http.host; content:"648544584.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007035; classtype:social-engineering; sid:6007035; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.definitiveledger.ca/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.definitiveledger.ca"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007036; classtype:social-engineering; sid:6007036; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-zeldok-biz-prasor-havmel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-zeldok-biz-prasor-havmel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007037; classtype:social-engineering; sid:6007037; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hemanthwbd.github.io/Spotify-Clone/)"; flow:established,to_server; http.uri; content:"/Spotify-Clone/"; startswith; fast_pattern; http.host; content:"hemanthwbd.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007038; classtype:social-engineering; sid:6007038; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-morsel-biz-kavren-holdik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-morsel-biz-kavren-holdik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007039; classtype:social-engineering; sid:6007039; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-hersik-biz-pramel-vondor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-hersik-biz-pramel-vondor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007040; classtype:social-engineering; sid:6007040; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robinhxodlogexm.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"robinhxodlogexm.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007041; classtype:social-engineering; sid:6007041; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcastupdatesignin.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcastupdatesignin.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007042; classtype:social-engineering; sid:6007042; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hefeus.github.io/clone-netflix/)"; flow:established,to_server; http.uri; content:"/clone-netflix/"; startswith; fast_pattern; http.host; content:"hefeus.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007043; classtype:social-engineering; sid:6007043; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tkordersvip.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tkordersvip.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007044; classtype:social-engineering; sid:6007044; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-page-builder--heidimarie03.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-page-builder--heidimarie03.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007045; classtype:social-engineering; sid:6007045; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wordpress-1603748-6591869.cloudwaysapps.com/payuza.natis/cc.html)"; flow:established,to_server; http.uri; content:"/payuza.natis/cc.html"; startswith; fast_pattern; http.host; content:"wordpress-1603748-6591869.cloudwaysapps.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007046; classtype:social-engineering; sid:6007046; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appsuite-clientlogins.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"appsuite-clientlogins.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007047; classtype:social-engineering; sid:6007047; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitywebmailsupport.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitywebmailsupport.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007048; classtype:social-engineering; sid:6007048; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-prasvek-biz-dolrik-vansel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-prasvek-biz-dolrik-vansel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007049; classtype:social-engineering; sid:6007049; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (000037.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"000037.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007050; classtype:social-engineering; sid:6007050; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ahoraconbdvobtenuncredito.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ahoraconbdvobtenuncredito.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007051; classtype:social-engineering; sid:6007051; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-vormor-biz-hansik-pravsel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-vormor-biz-hansik-pravsel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007052; classtype:social-engineering; sid:6007052; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sahilrohra07-svg.github.io/frontend-development-by-shubh-rohrs/)"; flow:established,to_server; http.uri; content:"/frontend-development-by-shubh-rohrs/"; startswith; fast_pattern; http.host; content:"sahilrohra07-svg.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007053; classtype:social-engineering; sid:6007053; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4.rewardingmyself.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4.rewardingmyself.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007054; classtype:social-engineering; sid:6007054; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.voicexfinity.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.voicexfinity.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007055; classtype:social-engineering; sid:6007055; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-farnik-biz-lomrek-hovsar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-farnik-biz-lomrek-hovsar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007056; classtype:social-engineering; sid:6007056; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-pramel-biz-vorsik-handor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-pramel-biz-vorsik-handor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007057; classtype:social-engineering; sid:6007057; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pleasant-points-511468.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pleasant-points-511468.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007058; classtype:social-engineering; sid:6007058; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (entersistealporete23232.iceiy.com/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"entersistealporete23232.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007059; classtype:social-engineering; sid:6007059; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wjsng52vstr-ybfch38mja-1d3e9f-mv918n.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wjsng52vstr-ybfch38mja-1d3e9f-mv918n.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007060; classtype:social-engineering; sid:6007060; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfintyupgrade.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfintyupgrade.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007061; classtype:social-engineering; sid:6007061; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (armed-rose-htczagkn.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"armed-rose-htczagkn.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007062; classtype:social-engineering; sid:6007062; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mailer-xfinity.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mailer-xfinity.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007063; classtype:social-engineering; sid:6007063; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-pralven-biz-zondik-lavmor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-pralven-biz-zondik-lavmor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007064; classtype:social-engineering; sid:6007064; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-vaskel-biz-promik-zeldor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-vaskel-biz-promik-zeldor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007065; classtype:social-engineering; sid:6007065; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-lormor-biz-vensik-kazsel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-lormor-biz-vensik-kazsel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007066; classtype:social-engineering; sid:6007066; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcastwebmailupdate.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcastwebmailupdate.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007067; classtype:social-engineering; sid:6007067; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-prasel-biz-zandik-kavdor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-prasel-biz-zandik-kavdor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007068; classtype:social-engineering; sid:6007068; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (detailed-magenta-yarmx8ve.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"detailed-magenta-yarmx8ve.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007069; classtype:social-engineering; sid:6007069; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcastverificationupdate.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcastverificationupdate.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007070; classtype:social-engineering; sid:6007070; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.yhdhgdnnd.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.yhdhgdnnd.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007071; classtype:social-engineering; sid:6007071; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcastvoicemailer.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcastvoicemailer.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007072; classtype:social-engineering; sid:6007072; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xffiniittyy.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xffiniittyy.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007073; classtype:social-engineering; sid:6007073; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-praldor-biz-kensel-hormik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-praldor-biz-kensel-hormik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007074; classtype:social-engineering; sid:6007074; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityloginupdates.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinityloginupdates.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007075; classtype:social-engineering; sid:6007075; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dustchlogingermanystore.shn-host.ru///wp-admin/maint/vbv/app/login.php)"; flow:established,to_server; http.uri; content:"///wp-admin/maint/vbv/app/login.php"; startswith; fast_pattern; http.host; content:"dustchlogingermanystore.shn-host.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007076; classtype:social-engineering; sid:6007076; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4sesor14d3cuenta.webcindario.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4sesor14d3cuenta.webcindario.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007077; classtype:social-engineering; sid:6007077; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (informapp.info/payment/banks/Canada/desjardins)"; flow:established,to_server; http.uri; content:"/payment/banks/Canada/desjardins"; startswith; fast_pattern; http.host; content:"informapp.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007078; classtype:social-engineering; sid:6007078; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anoopsamazon.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"anoopsamazon.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007079; classtype:social-engineering; sid:6007079; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-prandik-biz-zorsel-kemdor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-prandik-biz-zorsel-kemdor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007080; classtype:social-engineering; sid:6007080; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-zormel-biz-havdok-prasik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-zormel-biz-havdok-prasik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007081; classtype:social-engineering; sid:6007081; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp13ct-zormik-biz-fravdor-kansel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp13ct-zormik-biz-fravdor-kansel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007082; classtype:social-engineering; sid:6007082; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-kelvok-biz-zarmel-hentor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-kelvok-biz-zarmel-hentor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007083; classtype:social-engineering; sid:6007083; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (public-trzr-en-bridge.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"public-trzr-en-bridge.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007084; classtype:social-engineering; sid:6007084; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.newxfsync.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.newxfsync.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007085; classtype:social-engineering; sid:6007085; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-lamvik-biz-korsel-hazdok.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-lamvik-biz-korsel-hazdok.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007086; classtype:social-engineering; sid:6007086; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-havrok-biz-fersel-kamdik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-havrok-biz-fersel-kamdik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007087; classtype:social-engineering; sid:6007087; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-forsor-biz-kandel-vazmik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-forsor-biz-kandel-vazmik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007088; classtype:social-engineering; sid:6007088; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinitymedia.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinitymedia.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007089; classtype:social-engineering; sid:6007089; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.vujpzqbycpkywvwi.digitalplatforumu.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.vujpzqbycpkywvwi.digitalplatforumu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007090; classtype:social-engineering; sid:6007090; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-framik-biz-zensor-kaldok.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-framik-biz-zensor-kaldok.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007091; classtype:social-engineering; sid:6007091; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-lorsen-biz-fazvik-kremor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-lorsen-biz-fazvik-kremor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007092; classtype:social-engineering; sid:6007092; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-kemlor-biz-frasor-zendik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-kemlor-biz-frasor-zendik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007093; classtype:social-engineering; sid:6007093; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bet298.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bet298.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007094; classtype:social-engineering; sid:6007094; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-zelmor-biz-kafrik-vonsel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-zelmor-biz-kafrik-vonsel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007095; classtype:social-engineering; sid:6007095; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ycgfn9e48kq-msprqlos-4c7d1a-ycg31w.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ycgfn9e48kq-msprqlos-4c7d1a-ycg31w.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007096; classtype:social-engineering; sid:6007096; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinityloginconnect.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinityloginconnect.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007097; classtype:social-engineering; sid:6007097; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-fondik-biz-hazrel-lorsar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-fondik-biz-hazrel-lorsar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007098; classtype:social-engineering; sid:6007098; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trust-mail.my/cloud/index2.php?id=ac94411ff9029d945090177b2bc1ad5c&email=salen@3796f3f1fb78b6f9929ba71b3058d87ae86d.com&b=c3ZjaC1zcGJAbWFpbC5ydQ==)"; flow:established,to_server; http.uri; content:"/cloud/index2.php?id=ac94411ff9029d945090177b2bc1ad5c&email=salen@3796f3f1fb78b6f9929ba71b3058d87ae86d.com&b=c3ZjaC1zcGJAbWFpbC5ydQ=="; startswith; fast_pattern; http.host; content:"trust-mail.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007099; classtype:social-engineering; sid:6007099; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (btrzp63skrp-xjnshhb-2c1f8d-btq99c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"btrzp63skrp-xjnshhb-2c1f8d-btq99c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007100; classtype:social-engineering; sid:6007100; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-lormek-biz-zafrik-vensar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-lormek-biz-zafrik-vensar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007101; classtype:social-engineering; sid:6007101; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-zordel-biz-harmik-pravsel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-zordel-biz-harmik-pravsel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007102; classtype:social-engineering; sid:6007102; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-felsor-biz-kandik-zormak.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-felsor-biz-kandik-zormak.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007103; classtype:social-engineering; sid:6007103; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfnityaccount.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfnityaccount.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007104; classtype:social-engineering; sid:6007104; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-mavrek-biz-lonsar-fredok.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-mavrek-biz-lonsar-fredok.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007105; classtype:social-engineering; sid:6007105; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e.vg/KHsxZGdzv)"; flow:established,to_server; http.uri; content:"/KHsxZGdzv"; startswith; fast_pattern; http.host; content:"e.vg"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007106; classtype:social-engineering; sid:6007106; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfnityupdate.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfnityupdate.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007107; classtype:social-engineering; sid:6007107; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robinhxodlogxn.gitbook.io/account)"; flow:established,to_server; http.uri; content:"/account"; startswith; fast_pattern; http.host; content:"robinhxodlogxn.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007108; classtype:social-engineering; sid:6007108; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-kamzor-biz-feldik-pransel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-kamzor-biz-feldik-pransel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007109; classtype:social-engineering; sid:6007109; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortskins.life/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortskins.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007110; classtype:social-engineering; sid:6007110; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e7fonw-3eskv-1nylv3-vcwdw.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e7fonw-3eskv-1nylv3-vcwdw.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007111; classtype:social-engineering; sid:6007111; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-lovmer-biz-zarnik-frosel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-lovmer-biz-zarnik-frosel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007112; classtype:social-engineering; sid:6007112; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (credinominasantandermx.iceiy.com/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"credinominasantandermx.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007113; classtype:social-engineering; sid:6007113; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.svsgnxzsyqdkapvq.auroravaultgame.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.svsgnxzsyqdkapvq.auroravaultgame.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007114; classtype:social-engineering; sid:6007114; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yyedggfxgjassahd.boilorel.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yyedggfxgjassahd.boilorel.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007115; classtype:social-engineering; sid:6007115; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metabusinessconsultancy.co.uk/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metabusinessconsultancy.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007116; classtype:social-engineering; sid:6007116; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-varsel-biz-framik-holdor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-varsel-biz-framik-holdor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007117; classtype:social-engineering; sid:6007117; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (begin-hardware-trezo.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"begin-hardware-trezo.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007118; classtype:social-engineering; sid:6007118; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp3ct-grelok-biz8-harqil-tovex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp3ct-grelok-biz8-harqil-tovex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007119; classtype:social-engineering; sid:6007119; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abhijeetrajput9.github.io/Amazon-clone)"; flow:established,to_server; http.uri; content:"/Amazon-clone"; startswith; fast_pattern; http.host; content:"abhijeetrajput9.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007120; classtype:social-engineering; sid:6007120; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezor-app-bridge.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezor-app-bridge.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007121; classtype:social-engineering; sid:6007121; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-landor-biz-kersel-fravik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-landor-biz-kersel-fravik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007122; classtype:social-engineering; sid:6007122; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-pramik-biz-zoldor-kersel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-pramik-biz-zoldor-kersel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007123; classtype:social-engineering; sid:6007123; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robinhodlogmxn.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"robinhodlogmxn.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007124; classtype:social-engineering; sid:6007124; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-prensel-biz-holdar-kavmik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-prensel-biz-holdar-kavmik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007125; classtype:social-engineering; sid:6007125; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qelquro-nqx-belxeta-p8t4hk23.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qelquro-nqx-belxeta-p8t4hk23.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007126; classtype:social-engineering; sid:6007126; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stealsuuuuuuuu.top/1638808)"; flow:established,to_server; http.uri; content:"/1638808"; startswith; fast_pattern; http.host; content:"stealsuuuuuuuu.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007127; classtype:social-engineering; sid:6007127; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcastservice-update.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcastservice-update.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007128; classtype:social-engineering; sid:6007128; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazonjob-opal.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazonjob-opal.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007129; classtype:social-engineering; sid:6007129; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (saa-s-team-board--technical50.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"saa-s-team-board--technical50.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007130; classtype:social-engineering; sid:6007130; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-kandor-biz-frelvak-honsel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-kandor-biz-frelvak-honsel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007131; classtype:social-engineering; sid:6007131; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ssucursalevirtuales.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ssucursalevirtuales.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007132; classtype:social-engineering; sid:6007132; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (111112.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"111112.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007133; classtype:social-engineering; sid:6007133; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lrautoeletrica.com.br/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lrautoeletrica.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007134; classtype:social-engineering; sid:6007134; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-pronsok-biz-kafdor-zelvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-pronsok-biz-kafdor-zelvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007135; classtype:social-engineering; sid:6007135; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (viconiewcermelmarc567.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"viconiewcermelmarc567.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007136; classtype:social-engineering; sid:6007136; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezoriostr-homepage.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezoriostr-homepage.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007137; classtype:social-engineering; sid:6007137; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-hazsel-biz-prandor-velsik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-hazsel-biz-prandor-velsik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007138; classtype:social-engineering; sid:6007138; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-tersok-biz-havrel-kemdor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-tersok-biz-havrel-kemdor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007139; classtype:social-engineering; sid:6007139; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-dolrek-biz-kemsar-zarnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-dolrek-biz-kemsar-zarnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007140; classtype:social-engineering; sid:6007140; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mailcomcastonline.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mailcomcastonline.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007141; classtype:social-engineering; sid:6007141; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (incomparable-pixie-17b40f.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"incomparable-pixie-17b40f.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007142; classtype:social-engineering; sid:6007142; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mkrjb14nhwu-pldwffynt-5d4e0f-vzk33a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mkrjb14nhwu-pldwffynt-5d4e0f-vzk33a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007143; classtype:social-engineering; sid:6007143; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tzr-ioqwek.destiny72.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tzr-ioqwek.destiny72.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007144; classtype:social-engineering; sid:6007144; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lockerstatus.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lockerstatus.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007145; classtype:social-engineering; sid:6007145; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-folsar-biz-hemrik-pradok.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-folsar-biz-hemrik-pradok.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007146; classtype:social-engineering; sid:6007146; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inversionesinnovadoras.com/htaccess/?mxid=ZGRpdm9uYUBrYXBsYW5jby5jb20=)"; flow:established,to_server; http.uri; content:"/htaccess/?mxid=ZGRpdm9uYUBrYXBsYW5jby5jb20="; startswith; fast_pattern; http.host; content:"inversionesinnovadoras.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007147; classtype:social-engineering; sid:6007147; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-zafmor-biz-kersel-vandik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-zafmor-biz-kersel-vandik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007148; classtype:social-engineering; sid:6007148; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-lorsor-biz-kandik-fravmel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-lorsor-biz-kandik-fravmel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007149; classtype:social-engineering; sid:6007149; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-zeldar-biz-pransor-hormik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-zeldar-biz-pransor-hormik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007150; classtype:social-engineering; sid:6007150; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-hervak-biz-zondel-karsik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-hervak-biz-zondel-karsik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007151; classtype:social-engineering; sid:6007151; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kdply4avstr-blpqr65kmja-3d4e8f-wj519n.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kdply4avstr-blpqr65kmja-3d4e8f-wj519n.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007152; classtype:social-engineering; sid:6007152; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-veldar-biz-prasik-zormel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-veldar-biz-prasik-zormel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007153; classtype:social-engineering; sid:6007153; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-havmor-biz-pronsel-vardik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-havmor-biz-pronsel-vardik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007154; classtype:social-engineering; sid:6007154; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinitymail1.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinitymail1.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007155; classtype:social-engineering; sid:6007155; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-hamrel-biz-fersan-voldik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-hamrel-biz-fersan-voldik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007156; classtype:social-engineering; sid:6007156; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-havdok-biz-prasor-zormik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-havdok-biz-prasor-zormik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007157; classtype:social-engineering; sid:6007157; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enormous-apricot-bhhnh1v5.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"enormous-apricot-bhhnh1v5.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007158; classtype:social-engineering; sid:6007158; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinitymail-update.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinitymail-update.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007159; classtype:social-engineering; sid:6007159; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinityhub.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinityhub.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007160; classtype:social-engineering; sid:6007160; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezor-io-start-public-sso-web.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezor-io-start-public-sso-web.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007161; classtype:social-engineering; sid:6007161; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcastwebmailserver.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcastwebmailserver.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007162; classtype:social-engineering; sid:6007162; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dvkjdvjdjkldvkkl.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.dvkjdvjdjkldvkkl.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007163; classtype:social-engineering; sid:6007163; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.docu.motnatelly.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.docu.motnatelly.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007164; classtype:social-engineering; sid:6007164; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gfvcd83kfly-klmqwpdr-4e3a6b-yh555c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gfvcd83kfly-klmqwpdr-4e3a6b-yh555c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007165; classtype:social-engineering; sid:6007165; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-lavrik-biz-kersel-frondak.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-lavrik-biz-kersel-frondak.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007166; classtype:social-engineering; sid:6007166; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-faq-download.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-faq-download.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007167; classtype:social-engineering; sid:6007167; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-hesval-biz-prondik-zormek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-hesval-biz-prondik-zormek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007168; classtype:social-engineering; sid:6007168; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.y91t.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.y91t.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007169; classtype:social-engineering; sid:6007169; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-prondok-biz-zarmel-kersik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-prondok-biz-zarmel-kersik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007170; classtype:social-engineering; sid:6007170; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-zemral-biz-hondik-pravsel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-zemral-biz-hondik-pravsel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007171; classtype:social-engineering; sid:6007171; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-zendor-biz-havsel-praldik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-zendor-biz-havsel-praldik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007172; classtype:social-engineering; sid:6007172; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcastwifi.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcastwifi.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007173; classtype:social-engineering; sid:6007173; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcastbusinesspage.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcastbusinesspage.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007174; classtype:social-engineering; sid:6007174; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-starte.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-starte.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007175; classtype:social-engineering; sid:6007175; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mailserverxfinity.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mailserverxfinity.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007176; classtype:social-engineering; sid:6007176; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.signinxfinity.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.signinxfinity.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007177; classtype:social-engineering; sid:6007177; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (muhammadsaqibali-arch.github.io/6th-CSS-Assignment/)"; flow:established,to_server; http.uri; content:"/6th-CSS-Assignment/"; startswith; fast_pattern; http.host; content:"muhammadsaqibali-arch.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007178; classtype:social-engineering; sid:6007178; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafybeiaagcck5hgfawdu3qiwiik5lk4mv36kkmrnxssojtvansj4s6g3ye.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafybeiaagcck5hgfawdu3qiwiik5lk4mv36kkmrnxssojtvansj4s6g3ye.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007179; classtype:social-engineering; sid:6007179; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcast-login-page.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcast-login-page.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007180; classtype:social-engineering; sid:6007180; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uniswaprotocols.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uniswaprotocols.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007181; classtype:social-engineering; sid:6007181; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suit-trezer-web.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"suit-trezer-web.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007182; classtype:social-engineering; sid:6007182; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-page-editor--aluko103.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-page-editor--aluko103.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007183; classtype:social-engineering; sid:6007183; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jaovinic.github.io/Netflix/)"; flow:established,to_server; http.uri; content:"/Netflix/"; startswith; fast_pattern; http.host; content:"jaovinic.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007184; classtype:social-engineering; sid:6007184; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-veldar-biz-pramik-holsen.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-veldar-biz-pramik-holsen.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007185; classtype:social-engineering; sid:6007185; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hi.fxxycr.com/like/membercenter.made-in-china.com/)"; flow:established,to_server; http.uri; content:"/like/membercenter.made-in-china.com/"; startswith; fast_pattern; http.host; content:"hi.fxxycr.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007186; classtype:social-engineering; sid:6007186; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-pronsik-biz-havsel-keldor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-pronsik-biz-havsel-keldor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007187; classtype:social-engineering; sid:6007187; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-horvek-biz-prondar-zelsik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-horvek-biz-prondar-zelsik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007188; classtype:social-engineering; sid:6007188; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcastupdatemail.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcastupdatemail.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007189; classtype:social-engineering; sid:6007189; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meiitecmeskx-iss.gitbook.io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"meiitecmeskx-iss.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007190; classtype:social-engineering; sid:6007190; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastmailupdateaccount.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastmailupdateaccount.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007191; classtype:social-engineering; sid:6007191; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-framel-biz-kordik-zarsel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-framel-biz-kordik-zarsel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007192; classtype:social-engineering; sid:6007192; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-zorsel-biz-havrik-prondor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-zorsel-biz-havrik-prondor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007193; classtype:social-engineering; sid:6007193; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.agvyk.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.agvyk.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007194; classtype:social-engineering; sid:6007194; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-pravlor-biz-hazsel-kersik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-pravlor-biz-hazsel-kersik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007195; classtype:social-engineering; sid:6007195; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinitmail.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinitmail.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007196; classtype:social-engineering; sid:6007196; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cancelcardiffbncolc360.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cancelcardiffbncolc360.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007197; classtype:social-engineering; sid:6007197; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-kandor-biz-zavsel-fromik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-kandor-biz-zavsel-fromik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007198; classtype:social-engineering; sid:6007198; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cn-imtokenn.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cn-imtokenn.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007199; classtype:social-engineering; sid:6007199; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp13ct-lersik-biz-prandel-hazkor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp13ct-lersik-biz-prandel-hazkor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007200; classtype:social-engineering; sid:6007200; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.addqg.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.addqg.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007201; classtype:social-engineering; sid:6007201; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.tatenengo.ru/owa)"; flow:established,to_server; http.uri; content:"/owa"; startswith; fast_pattern; http.host; content:"mail.tatenengo.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007202; classtype:social-engineering; sid:6007202; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinityupdatemailer.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinityupdatemailer.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007203; classtype:social-engineering; sid:6007203; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faq-trzro-io-pro.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faq-trzro-io-pro.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007204; classtype:social-engineering; sid:6007204; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastonlinelogin.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastonlinelogin.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007205; classtype:social-engineering; sid:6007205; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-kordel-biz-fravik-hazmor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-kordel-biz-fravik-hazmor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007206; classtype:social-engineering; sid:6007206; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vujpzqbycpkywvwi.digitalplatforumu.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vujpzqbycpkywvwi.digitalplatforumu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007207; classtype:social-engineering; sid:6007207; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-vensok-biz-praldem-zorsik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-vensok-biz-praldem-zorsik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007208; classtype:social-engineering; sid:6007208; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.loginxfinty.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.loginxfinty.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007209; classtype:social-engineering; sid:6007209; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metsxmasklognux.gitbook.io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"metsxmasklognux.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007210; classtype:social-engineering; sid:6007210; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcastlive.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcastlive.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007211; classtype:social-engineering; sid:6007211; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docs-trezr-begin-help.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"docs-trezr-begin-help.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007212; classtype:social-engineering; sid:6007212; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (overview-en-treezor-ed.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"overview-en-treezor-ed.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007213; classtype:social-engineering; sid:6007213; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6030.tokenpocket.walletapp.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6030.tokenpocket.walletapp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007214; classtype:social-engineering; sid:6007214; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-lansik-biz-kormel-fazdor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-lansik-biz-kormel-fazdor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007215; classtype:social-engineering; sid:6007215; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tesrtnewergrcdfv-4e0e886e14bb.herokuapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tesrtnewergrcdfv-4e0e886e14bb.herokuapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007216; classtype:social-engineering; sid:6007216; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp13ct-vormor-biz-fradik-kazsel.pages.dev/rtyu-iopj-qewr-thjm/)"; flow:established,to_server; http.uri; content:"/rtyu-iopj-qewr-thjm/"; startswith; fast_pattern; http.host; content:"sp13ct-vormor-biz-fradik-kazsel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007217; classtype:social-engineering; sid:6007217; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastmailserverupdate.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastmailserverupdate.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007218; classtype:social-engineering; sid:6007218; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-fradik-biz-koldor-zensel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-fradik-biz-koldor-zensel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007219; classtype:social-engineering; sid:6007219; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mailcomcst.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mailcomcst.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007220; classtype:social-engineering; sid:6007220; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (akashsenthilkumar08.github.io/Facebook-Login-Page-Clone/)"; flow:established,to_server; http.uri; content:"/Facebook-Login-Page-Clone/"; startswith; fast_pattern; http.host; content:"akashsenthilkumar08.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007221; classtype:social-engineering; sid:6007221; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pradhan-classes.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pradhan-classes.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007222; classtype:social-engineering; sid:6007222; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-brenok-biz-valrik-hesmor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-brenok-biz-valrik-hesmor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007223; classtype:social-engineering; sid:6007223; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suit-trzr-login.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"suit-trzr-login.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007224; classtype:social-engineering; sid:6007224; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-io-start-help.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en-io-start-help.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007225; classtype:social-engineering; sid:6007225; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcastmailupgrade.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcastmailupgrade.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007226; classtype:social-engineering; sid:6007226; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-vorsel-biz-zarmor-fendik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-vorsel-biz-zarmor-fendik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007227; classtype:social-engineering; sid:6007227; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arjunm700.github.io/netflixclone/)"; flow:established,to_server; http.uri; content:"/netflixclone/"; startswith; fast_pattern; http.host; content:"arjunm700.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007228; classtype:social-engineering; sid:6007228; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-kormor-biz-fravsel-hansik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-kormor-biz-fravsel-hansik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007229; classtype:social-engineering; sid:6007229; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.yyedggfxgjassahd.boilorel.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.yyedggfxgjassahd.boilorel.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007230; classtype:social-engineering; sid:6007230; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trewdz.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trewdz.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007231; classtype:social-engineering; sid:6007231; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (focused-popup-011180.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"focused-popup-011180.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007232; classtype:social-engineering; sid:6007232; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auspost.addqh.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auspost.addqh.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007233; classtype:social-engineering; sid:6007233; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suite--trezror.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"suite--trezror.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007234; classtype:social-engineering; sid:6007234; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebokksecurity.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebokksecurity.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007235; classtype:social-engineering; sid:6007235; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (io-hardware-doc.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"io-hardware-doc.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007236; classtype:social-engineering; sid:6007236; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tavareslopes.adv.br/co/wetransfer/?email=oretx@f0487a70771921035a070a785eaa8dbb24ce.com)"; flow:established,to_server; http.uri; content:"/co/wetransfer/?email=oretx@f0487a70771921035a070a785eaa8dbb24ce.com"; startswith; fast_pattern; http.host; content:"tavareslopes.adv.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007237; classtype:social-engineering; sid:6007237; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.web-fun-checkout-prototype-uniswap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.web-fun-checkout-prototype-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007238; classtype:social-engineering; sid:6007238; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-komrel-biz-zarsik-fendok.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-komrel-biz-zarsik-fendok.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007239; classtype:social-engineering; sid:6007239; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wvww-robloxx.iconce.com/users-726594386-profile/)"; flow:established,to_server; http.uri; content:"/users-726594386-profile/"; startswith; fast_pattern; http.host; content:"wvww-robloxx.iconce.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007240; classtype:social-engineering; sid:6007240; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-foldik-biz-kamsar-varnel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-foldik-biz-kamsar-varnel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007241; classtype:social-engineering; sid:6007241; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telvora-nqx-zentora-r1t2dp83.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telvora-nqx-zentora-r1t2dp83.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007242; classtype:social-engineering; sid:6007242; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dynamic-mermaid-cd43c1.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dynamic-mermaid-cd43c1.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007243; classtype:social-engineering; sid:6007243; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mailnotificationcomcast.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mailnotificationcomcast.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007244; classtype:social-engineering; sid:6007244; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcastmailsignin.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcastmailsignin.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007245; classtype:social-engineering; sid:6007245; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.r08g.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.r08g.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007246; classtype:social-engineering; sid:6007246; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (one.pulse-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"one.pulse-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007247; classtype:social-engineering; sid:6007247; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcastnetwork.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcastnetwork.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007248; classtype:social-engineering; sid:6007248; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (us-io-tzore-io.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"us-io-tzore-io.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007249; classtype:social-engineering; sid:6007249; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paysecureverify.co.za/?r=44ad367d-e431-4dc5-93f8-9fd8c9167ffd&rg=eu)"; flow:established,to_server; http.uri; content:"/?r=44ad367d-e431-4dc5-93f8-9fd8c9167ffd&rg=eu"; startswith; fast_pattern; http.host; content:"paysecureverify.co.za"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007250; classtype:social-engineering; sid:6007250; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ycgvh2ekqlo-pjbrqlos-6c5d1a-ycg33w.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ycgvh2ekqlo-pjbrqlos-6c5d1a-ycg33w.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007251; classtype:social-engineering; sid:6007251; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-static-site--advncedair.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-static-site--advncedair.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007252; classtype:social-engineering; sid:6007252; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-voldor-biz-prandel-zarmik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-voldor-biz-prandel-zarmik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007253; classtype:social-engineering; sid:6007253; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-us-public-trezzr-io-com-cdn.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"help-us-public-trezzr-io-com-cdn.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007254; classtype:social-engineering; sid:6007254; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (u648984.softaculous.dev/wp382/wp-content/uploads/)"; flow:established,to_server; http.uri; content:"/wp382/wp-content/uploads/"; startswith; fast_pattern; http.host; content:"u648984.softaculous.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007255; classtype:social-engineering; sid:6007255; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox.com.am/users/262136467014/profile)"; flow:established,to_server; http.uri; content:"/users/262136467014/profile"; startswith; fast_pattern; http.host; content:"www.roblox.com.am"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007256; classtype:social-engineering; sid:6007256; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-korvek-biz-lamsor-fresnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-korvek-biz-lamsor-fresnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007257; classtype:social-engineering; sid:6007257; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gomdanikapil-pixel.github.io/NetflixClone/)"; flow:established,to_server; http.uri; content:"/NetflixClone/"; startswith; fast_pattern; http.host; content:"gomdanikapil-pixel.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007258; classtype:social-engineering; sid:6007258; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-kavdor-biz-fransik-zeldor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-kavdor-biz-fransik-zeldor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007259; classtype:social-engineering; sid:6007259; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezor-app.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezor-app.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007260; classtype:social-engineering; sid:6007260; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-att-com-b94bef.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"account-att-com-b94bef.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007261; classtype:social-engineering; sid:6007261; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-dravik-biz-zemlor-parsok.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-dravik-biz-zemlor-parsok.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007262; classtype:social-engineering; sid:6007262; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (johnarthurpatrikareas.com/rat)"; flow:established,to_server; http.uri; content:"/rat"; startswith; fast_pattern; http.host; content:"johnarthurpatrikareas.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007263; classtype:social-engineering; sid:6007263; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-kensor-biz-framel-zavdok.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-kensor-biz-framel-zavdok.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007264; classtype:social-engineering; sid:6007264; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (companypolicy.com.au/?r=03f5a57a-f88f-4927-968b-f17421163a6e)"; flow:established,to_server; http.uri; content:"/?r=03f5a57a-f88f-4927-968b-f17421163a6e"; startswith; fast_pattern; http.host; content:"companypolicy.com.au"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007265; classtype:social-engineering; sid:6007265; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sancomcomcf.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.sancomcomcf.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007266; classtype:social-engineering; sid:6007266; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lnkmlnjqlnjklnzmlnjmlnzmlmkulnjmlnkylnkqlmkylnzclnzalmkqlnjklnk.hasler.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lnkmlnjqlnjklnzmlnjmlnzmlmkulnjmlnkylnkqlmkylnzclnzalmkqlnjklnk.hasler.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007267; classtype:social-engineering; sid:6007267; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tweeddaleshoney.co.nz/ta/?jivsbsdnoo=google@google.com)"; flow:established,to_server; http.uri; content:"/ta/?jivsbsdnoo=google@google.com"; startswith; fast_pattern; http.host; content:"www.tweeddaleshoney.co.nz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007268; classtype:social-engineering; sid:6007268; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bslnz.nz/kepe/Roundcudee.html#google@google.com)"; flow:established,to_server; http.uri; content:"/kepe/Roundcudee.html#google@google.com"; startswith; fast_pattern; http.host; content:"bslnz.nz"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007269; classtype:social-engineering; sid:6007269; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (navjivanexporters.in//system/helpers/amr/few.html#google@google.com)"; flow:established,to_server; http.uri; content:"//system/helpers/amr/few.html#google@google.com"; startswith; fast_pattern; http.host; content:"navjivanexporters.in"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6007270; classtype:social-engineering; sid:6007270; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (exodus-web-eng.wasmer.app/index)"; flow:established,to_server; http.uri; content:"/index"; startswith; fast_pattern; http.host; content:"exodus-web-eng.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007271; classtype:social-engineering; sid:6007271; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezur-start-base-faqs-io.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezur-start-base-faqs-io.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007272; classtype:social-engineering; sid:6007272; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kukcon-xlognx.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kukcon-xlognx.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007273; classtype:social-engineering; sid:6007273; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aishwaryaugowda.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"aishwaryaugowda.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007274; classtype:social-engineering; sid:6007274; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (exodas-smart-wallat.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"exodas-smart-wallat.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007275; classtype:social-engineering; sid:6007275; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox.com.ug/users/5184319778/profile)"; flow:established,to_server; http.uri; content:"/users/5184319778/profile"; startswith; fast_pattern; http.host; content:"roblox.com.ug"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007276; classtype:social-engineering; sid:6007276; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-pransor-biz-ladvik-kersel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-pransor-biz-ladvik-kersel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007277; classtype:social-engineering; sid:6007277; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yadavpallavi835-cmd.github.io/Netflix-Clonee/)"; flow:established,to_server; http.uri; content:"/Netflix-Clonee/"; startswith; fast_pattern; http.host; content:"yadavpallavi835-cmd.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007278; classtype:social-engineering; sid:6007278; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcast11x.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcast11x.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007279; classtype:social-engineering; sid:6007279; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bank0famerica.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bank0famerica.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007280; classtype:social-engineering; sid:6007280; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bt-internet-108197.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bt-internet-108197.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007281; classtype:social-engineering; sid:6007281; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ntflx-actualizar.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ntflx-actualizar.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007282; classtype:social-engineering; sid:6007282; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yahya-masood.github.io/Netflix-clone-Project-frontend/)"; flow:established,to_server; http.uri; content:"/Netflix-clone-Project-frontend/"; startswith; fast_pattern; http.host; content:"yahya-masood.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007283; classtype:social-engineering; sid:6007283; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (usa-app-en--ledgrlive.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"usa-app-en--ledgrlive.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007284; classtype:social-engineering; sid:6007284; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.yh9969.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.yh9969.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007285; classtype:social-engineering; sid:6007285; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcastservermail.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcastservermail.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007286; classtype:social-engineering; sid:6007286; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mahananda-nova.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"mahananda-nova.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007287; classtype:social-engineering; sid:6007287; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.logintoyahoo.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.logintoyahoo.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007288; classtype:social-engineering; sid:6007288; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xbtp8-u5x-xalce-hlao-97e.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xbtp8-u5x-xalce-hlao-97e.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007289; classtype:social-engineering; sid:6007289; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinity-mail-update.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinity-mail-update.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007290; classtype:social-engineering; sid:6007290; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (phantom-mail.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"phantom-mail.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007291; classtype:social-engineering; sid:6007291; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (main-ledgre-live.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"main-ledgre-live.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007292; classtype:social-engineering; sid:6007292; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (msprq524kf-ycgfnpdr-0e9a2b-vn644c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"msprq524kf-ycgfnpdr-0e9a2b-vn644c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007293; classtype:social-engineering; sid:6007293; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.limpahoje.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.limpahoje.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007294; classtype:social-engineering; sid:6007294; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mirzohidshermanov36-hub.github.io/Instagram.com/)"; flow:established,to_server; http.uri; content:"/Instagram.com/"; startswith; fast_pattern; http.host; content:"mirzohidshermanov36-hub.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007295; classtype:social-engineering; sid:6007295; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seunovolimiteplus.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"seunovolimiteplus.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007296; classtype:social-engineering; sid:6007296; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nishthadangi.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"nishthadangi.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007297; classtype:social-engineering; sid:6007297; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ww.bussi.infy.click/metabusiness-2026)"; flow:established,to_server; http.uri; content:"/metabusiness-2026"; startswith; fast_pattern; http.host; content:"ww.bussi.infy.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007298; classtype:social-engineering; sid:6007298; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cuttizum.click/s/gRtRb8)"; flow:established,to_server; http.uri; content:"/s/gRtRb8"; startswith; fast_pattern; http.host; content:"cuttizum.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007299; classtype:social-engineering; sid:6007299; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (azalmandhai03-ctrl.github.io/NETFLIX-.-CLONE-ASSIGNMENT/)"; flow:established,to_server; http.uri; content:"/NETFLIX-.-CLONE-ASSIGNMENT/"; startswith; fast_pattern; http.host; content:"azalmandhai03-ctrl.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007300; classtype:social-engineering; sid:6007300; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.89584.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.89584.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007301; classtype:social-engineering; sid:6007301; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dqb.buzz/dpd/)"; flow:established,to_server; http.uri; content:"/dpd/"; startswith; fast_pattern; http.host; content:"dqb.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007302; classtype:social-engineering; sid:6007302; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gayan-ledger.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gayan-ledger.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007303; classtype:social-engineering; sid:6007303; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thinkaxion.com/project\;1\;PhishEdu)"; flow:established,to_server; http.uri; content:"/project|3b|1|3b|PhishEdu"; startswith; fast_pattern; http.host; content:"thinkaxion.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007304; classtype:social-engineering; sid:6007304; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seu-delivery.food/agostopromo/)"; flow:established,to_server; http.uri; content:"/agostopromo/"; startswith; fast_pattern; http.host; content:"seu-delivery.food"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007305; classtype:social-engineering; sid:6007305; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (websantander1.dothome.co.kr/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"websantander1.dothome.co.kr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007306; classtype:social-engineering; sid:6007306; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.login-wellsfargo.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.login-wellsfargo.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007307; classtype:social-engineering; sid:6007307; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xlbdw72lowi-hbkpthb-8a1c4f-xlq13c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xlbdw72lowi-hbkpthb-8a1c4f-xlq13c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007308; classtype:social-engineering; sid:6007308; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qjozvnvk6bohnpfx5m6.8d8yd9prtx649bohfe2jy7hiu.workers.dev/q/dxbAALy9C75y5TC0yk0ArQyG8uCdV8Q5V0xWZzpJ)"; flow:established,to_server; http.uri; content:"/q/dxbAALy9C75y5TC0yk0ArQyG8uCdV8Q5V0xWZzpJ"; startswith; fast_pattern; http.host; content:"qjozvnvk6bohnpfx5m6.8d8yd9prtx649bohfe2jy7hiu.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007309; classtype:social-engineering; sid:6007309; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-lavdor-biz-pravsel-hondik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-lavdor-biz-pravsel-hondik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007310; classtype:social-engineering; sid:6007310; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portal-io-start-docs.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portal-io-start-docs.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007311; classtype:social-engineering; sid:6007311; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.y45f.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.y45f.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007312; classtype:social-engineering; sid:6007312; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sahelisingharoy4.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"sahelisingharoy4.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007313; classtype:social-engineering; sid:6007313; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcastmailupdate.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcastmailupdate.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007314; classtype:social-engineering; sid:6007314; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apps-ledgr-live-en-us.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"apps-ledgr-live-en-us.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007315; classtype:social-engineering; sid:6007315; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cen4_open_mail_15.tatenengo.ru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cen4_open_mail_15.tatenengo.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007316; classtype:social-engineering; sid:6007316; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5idav.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"5idav.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007317; classtype:social-engineering; sid:6007317; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eng-ledger-io-org.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eng-ledger-io-org.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007318; classtype:social-engineering; sid:6007318; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (talal7279-byte.github.io/spotify-clone)"; flow:established,to_server; http.uri; content:"/spotify-clone"; startswith; fast_pattern; http.host; content:"talal7279-byte.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007319; classtype:social-engineering; sid:6007319; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (berzora-gld-zarquni-c2x1fw97.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"berzora-gld-zarquni-c2x1fw97.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007320; classtype:social-engineering; sid:6007320; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (visit-liive-ledgrr.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"visit-liive-ledgrr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007321; classtype:social-engineering; sid:6007321; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (resgatandopontos.dynv6.net/4048103/0229/index.php)"; flow:established,to_server; http.uri; content:"/4048103/0229/index.php"; startswith; fast_pattern; http.host; content:"resgatandopontos.dynv6.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007322; classtype:social-engineering; sid:6007322; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sarangventures.in/747534757)"; flow:established,to_server; http.uri; content:"/747534757"; startswith; fast_pattern; http.host; content:"sarangventures.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007323; classtype:social-engineering; sid:6007323; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (limitepremiumavoce.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"limitepremiumavoce.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007324; classtype:social-engineering; sid:6007324; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alarshsheikh.github.io/first_amazone/)"; flow:established,to_server; http.uri; content:"/first_amazone/"; startswith; fast_pattern; http.host; content:"alarshsheikh.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007325; classtype:social-engineering; sid:6007325; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.navyfederalsecurity.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.navyfederalsecurity.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007326; classtype:social-engineering; sid:6007326; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sztds.vincentlee.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sztds.vincentlee.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007327; classtype:social-engineering; sid:6007327; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (codingexpert985.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"codingexpert985.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007328; classtype:social-engineering; sid:6007328; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shichengyinxiang.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shichengyinxiang.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007329; classtype:social-engineering; sid:6007329; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.user-renewal-help.com/pages/info.php)"; flow:established,to_server; http.uri; content:"/pages/info.php"; startswith; fast_pattern; http.host; content:"www.user-renewal-help.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007330; classtype:social-engineering; sid:6007330; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (voecomnubank-credit-limits.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"voecomnubank-credit-limits.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007331; classtype:social-engineering; sid:6007331; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (neopixellightsaber.co/wp-includes/wps/soge/)"; flow:established,to_server; http.uri; content:"/wp-includes/wps/soge/"; startswith; fast_pattern; http.host; content:"neopixellightsaber.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007332; classtype:social-engineering; sid:6007332; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (schweiz-axaych79.de/cc.php)"; flow:established,to_server; http.uri; content:"/cc.php"; startswith; fast_pattern; http.host; content:"schweiz-axaych79.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007333; classtype:social-engineering; sid:6007333; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pendaftaran-piinjamanbri.cqq.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pendaftaran-piinjamanbri.cqq.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007334; classtype:social-engineering; sid:6007334; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-page-builder-1--bronwlanky.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-page-builder-1--bronwlanky.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007335; classtype:social-engineering; sid:6007335; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (worldwideexpressdeliveryfedx.github.io/fedx/)"; flow:established,to_server; http.uri; content:"/fedx/"; startswith; fast_pattern; http.host; content:"worldwideexpressdeliveryfedx.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007336; classtype:social-engineering; sid:6007336; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mackeyins.com/xn/link/dd/Alibaba/index.php)"; flow:established,to_server; http.uri; content:"/xn/link/dd/Alibaba/index.php"; startswith; fast_pattern; http.host; content:"mackeyins.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007337; classtype:social-engineering; sid:6007337; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (23x2x32x.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"23x2x32x.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007338; classtype:social-engineering; sid:6007338; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.fb20260701.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login.fb20260701.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007339; classtype:social-engineering; sid:6007339; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ewxexewxe.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ewxexewxe.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007340; classtype:social-engineering; sid:6007340; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cutt.ly/socsecsgsvc)"; flow:established,to_server; http.uri; content:"/socsecsgsvc"; startswith; fast_pattern; http.host; content:"cutt.ly"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007341; classtype:social-engineering; sid:6007341; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webpages-trzor-suite.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webpages-trzor-suite.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007342; classtype:social-engineering; sid:6007342; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ghaminnilagnx.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ghaminnilagnx.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007343; classtype:social-engineering; sid:6007343; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ex-ledger-live.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ex-ledger-live.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007344; classtype:social-engineering; sid:6007344; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (am.nrwhl.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"am.nrwhl.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007345; classtype:social-engineering; sid:6007345; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yousha947.github.io/netflix-assinment/)"; flow:established,to_server; http.uri; content:"/netflix-assinment/"; startswith; fast_pattern; http.host; content:"yousha947.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007346; classtype:social-engineering; sid:6007346; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (banshee.retusus.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"banshee.retusus.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007347; classtype:social-engineering; sid:6007347; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.docs-google.com/?urid=gzxpuIVeWdNiUXIxrbheaFg821tlE7QFW203x-oN08gfw89lnIlV7YBaCkZeUXTCdbLg-zBixdoNVc60bAI897zbKBJTQrLwFegyd5AqhHIh_-GkVCrmPQOhgGYjrUUkixXg6nAbwXVGYsYrqqqe)"; flow:established,to_server; http.uri; content:"/?urid=gzxpuIVeWdNiUXIxrbheaFg821tlE7QFW203x-oN08gfw89lnIlV7YBaCkZeUXTCdbLg-zBixdoNVc60bAI897zbKBJTQrLwFegyd5AqhHIh_-GkVCrmPQOhgGYjrUUkixXg6nAbwXVGYsYrqqqe"; startswith; fast_pattern; http.host; content:"www.docs-google.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007348; classtype:social-engineering; sid:6007348; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robustgorilla.com.k11betindia.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"robustgorilla.com.k11betindia.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007349; classtype:social-engineering; sid:6007349; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imtokens.tronscoin.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"imtokens.tronscoin.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007350; classtype:social-engineering; sid:6007350; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inirbhay.github.io/Spotify-web-player-clone)"; flow:established,to_server; http.uri; content:"/Spotify-web-player-clone"; startswith; fast_pattern; http.host; content:"inirbhay.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007351; classtype:social-engineering; sid:6007351; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (firstupdatenotice.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"firstupdatenotice.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007352; classtype:social-engineering; sid:6007352; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cen4_open_mail_15.tatenengo.ru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cen4_open_mail_15.tatenengo.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007353; classtype:social-engineering; sid:6007353; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (publlic-trezor-suite.typedream.app/en-us)"; flow:established,to_server; http.uri; content:"/en-us"; startswith; fast_pattern; http.host; content:"publlic-trezor-suite.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007354; classtype:social-engineering; sid:6007354; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-lordik-biz-prandel-hensor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-lordik-biz-prandel-hensor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007355; classtype:social-engineering; sid:6007355; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp13ct-vormel-biz-pradik-kersor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp13ct-vormel-biz-pradik-kersor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007356; classtype:social-engineering; sid:6007356; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinity-account-verify.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinity-account-verify.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007357; classtype:social-engineering; sid:6007357; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zeexpresss-48h.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zeexpresss-48h.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007358; classtype:social-engineering; sid:6007358; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mmustafanazeer22-cmd.github.io/Mohtashim-By-Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Mohtashim-By-Netflix-clone/"; startswith; fast_pattern; http.host; content:"mmustafanazeer22-cmd.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007359; classtype:social-engineering; sid:6007359; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gett10krobuxofficial.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.gett10krobuxofficial.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007360; classtype:social-engineering; sid:6007360; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a3b9c102.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"a3b9c102.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007361; classtype:social-engineering; sid:6007361; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (big.as/Mail/)"; flow:established,to_server; http.uri; content:"/Mail/"; startswith; fast_pattern; http.host; content:"big.as"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007362; classtype:social-engineering; sid:6007362; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (top-medicalgroup.com/offix_login/office-3D8/index.php)"; flow:established,to_server; http.uri; content:"/offix_login/office-3D8/index.php"; startswith; fast_pattern; http.host; content:"top-medicalgroup.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007363; classtype:social-engineering; sid:6007363; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alizamuhammadali010.github.io/Netflix.clone/)"; flow:established,to_server; http.uri; content:"/Netflix.clone/"; startswith; fast_pattern; http.host; content:"alizamuhammadali010.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007364; classtype:social-engineering; sid:6007364; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tramkrishan783-web.github.io/amazon_wedisit/)"; flow:established,to_server; http.uri; content:"/amazon_wedisit/"; startswith; fast_pattern; http.host; content:"tramkrishan783-web.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007365; classtype:social-engineering; sid:6007365; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.metaeducationcareer.com.au/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.metaeducationcareer.com.au"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007366; classtype:social-engineering; sid:6007366; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inposta.click/it)"; flow:established,to_server; http.uri; content:"/it"; startswith; fast_pattern; http.host; content:"inposta.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007367; classtype:social-engineering; sid:6007367; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tatenengo.ru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tatenengo.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007368; classtype:social-engineering; sid:6007368; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vnzkt61kwg-ycgfn38pli-3ce17c-vnz83k.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vnzkt61kwg-ycgfn38pli-3ce17c-vnz83k.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007369; classtype:social-engineering; sid:6007369; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sales-ledger-dzw.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sales-ledger-dzw.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007370; classtype:social-engineering; sid:6007370; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comomensagemtodososamigosdofacebook.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comomensagemtodososamigosdofacebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007371; classtype:social-engineering; sid:6007371; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cn-imtoken.tronscoin.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cn-imtoken.tronscoin.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007372; classtype:social-engineering; sid:6007372; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vinayakkubati818-del.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"vinayakkubati818-del.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007373; classtype:social-engineering; sid:6007373; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cwymkfndmd-stack.github.io/instagram-support/)"; flow:established,to_server; http.uri; content:"/instagram-support/"; startswith; fast_pattern; http.host; content:"cwymkfndmd-stack.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007374; classtype:social-engineering; sid:6007374; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maheer466.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"maheer466.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007375; classtype:social-engineering; sid:6007375; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (personal-admin-solicitar-no-permitir.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"personal-admin-solicitar-no-permitir.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007376; classtype:social-engineering; sid:6007376; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5-9-7-0-0.bioprodeintal.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"5-9-7-0-0.bioprodeintal.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007377; classtype:social-engineering; sid:6007377; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-londor-biz-hazrek-framel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-londor-biz-hazrek-framel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007378; classtype:social-engineering; sid:6007378; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ocablueuru.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ocablueuru.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007379; classtype:social-engineering; sid:6007379; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.uppeyuyfhd.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.uppeyuyfhd.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007380; classtype:social-engineering; sid:6007380; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ikzoekzonnepanelen.be/527276)"; flow:established,to_server; http.uri; content:"/527276"; startswith; fast_pattern; http.host; content:"www.ikzoekzonnepanelen.be"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007381; classtype:social-engineering; sid:6007381; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (admin-8ledger.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"admin-8ledger.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007382; classtype:social-engineering; sid:6007382; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (doc-ledgr--live.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"doc-ledgr--live.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007383; classtype:social-engineering; sid:6007383; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3x3x43xx4.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3x3x43xx4.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007384; classtype:social-engineering; sid:6007384; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.70598365756.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.70598365756.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007385; classtype:social-engineering; sid:6007385; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.89561.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.89561.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007386; classtype:social-engineering; sid:6007386; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth.properties/E.E9Xb8sCKXkI?/file.php?document=NzYxMG1pa2EuYWFsdG9AaG94aHVudC5jb20zNDA4)"; flow:established,to_server; http.uri; content:"/E.E9Xb8sCKXkI?/file.php?document=NzYxMG1pa2EuYWFsdG9AaG94aHVudC5jb20zNDA4"; startswith; fast_pattern; http.host; content:"auth.properties"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007387; classtype:social-engineering; sid:6007387; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-home-live-login.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-home-live-login.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007388; classtype:social-engineering; sid:6007388; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (openillimited.notice-payments.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"openillimited.notice-payments.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007389; classtype:social-engineering; sid:6007389; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7.therewardinglocker.com/index-form.php)"; flow:established,to_server; http.uri; content:"/index-form.php"; startswith; fast_pattern; http.host; content:"7.therewardinglocker.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007390; classtype:social-engineering; sid:6007390; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7.rewardingmyself.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7.rewardingmyself.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007391; classtype:social-engineering; sid:6007391; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iqraamir22.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"iqraamir22.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007392; classtype:social-engineering; sid:6007392; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (assign-file.sharpbranding.de/v1pFm)"; flow:established,to_server; http.uri; content:"/v1pFm"; startswith; fast_pattern; http.host; content:"assign-file.sharpbranding.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007393; classtype:social-engineering; sid:6007393; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.thr-sho52.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.thr-sho52.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007394; classtype:social-engineering; sid:6007394; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cambrianschoolbd.com/mail/)"; flow:established,to_server; http.uri; content:"/mail/"; startswith; fast_pattern; http.host; content:"www.cambrianschoolbd.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007395; classtype:social-engineering; sid:6007395; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nft-luckybox01-6e2529f3b576.herokuapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nft-luckybox01-6e2529f3b576.herokuapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007396; classtype:social-engineering; sid:6007396; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.rubaclava.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.rubaclava.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007397; classtype:social-engineering; sid:6007397; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zeexpresss-bebidas.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zeexpresss-bebidas.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007398; classtype:social-engineering; sid:6007398; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (879874.com/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"879874.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007399; classtype:social-engineering; sid:6007399; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-prandor-biz-fravik-lazsel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-prandor-biz-fravik-lazsel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007400; classtype:social-engineering; sid:6007400; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-calls.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-calls.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007401; classtype:social-engineering; sid:6007401; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login-east3.cashappps.com/ca/)"; flow:established,to_server; http.uri; content:"/ca/"; startswith; fast_pattern; http.host; content:"login-east3.cashappps.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007402; classtype:social-engineering; sid:6007402; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cloud-uphld-logn-docs.tem3.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cloud-uphld-logn-docs.tem3.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007403; classtype:social-engineering; sid:6007403; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comunidadenubank-hml-limits.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"comunidadenubank-hml-limits.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007404; classtype:social-engineering; sid:6007404; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.it-securegroup.com/?urid=wLRNn9hdwEPGUw9VBqnqy_AROsZOx6u6w5eUKiudnFs0jQvKv3V0xwlOKEd1tKay58tAxMJ43gmczcWURM4cIMSBLl68AOLQjOWdhYvS9JuId_eU3G95ZYGcALLG7UnZ1BBYzx6e5DFyUD2Sh)"; flow:established,to_server; http.uri; content:"/?urid=wLRNn9hdwEPGUw9VBqnqy_AROsZOx6u6w5eUKiudnFs0jQvKv3V0xwlOKEd1tKay58tAxMJ43gmczcWURM4cIMSBLl68AOLQjOWdhYvS9JuId_eU3G95ZYGcALLG7UnZ1BBYzx6e5DFyUD2Sh"; startswith; fast_pattern; http.host; content:"www.it-securegroup.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007405; classtype:social-engineering; sid:6007405; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (us-io-desktop-ledgr.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"us-io-desktop-ledgr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007406; classtype:social-engineering; sid:6007406; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-lavrek-biz-prandor-zelsok.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-lavrek-biz-prandor-zelsok.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007407; classtype:social-engineering; sid:6007407; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (v0r-sp.global.ssl.fastly.net/gtl/veri/sp.html)"; flow:established,to_server; http.uri; content:"/gtl/veri/sp.html"; startswith; fast_pattern; http.host; content:"v0r-sp.global.ssl.fastly.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007408; classtype:social-engineering; sid:6007408; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-ladsel-biz-kersor-hamvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-ladsel-biz-kersor-hamvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007409; classtype:social-engineering; sid:6007409; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deluxxe.com.br/home/)"; flow:established,to_server; http.uri; content:"/home/"; startswith; fast_pattern; http.host; content:"deluxxe.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007410; classtype:social-engineering; sid:6007410; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (applandfgh.icu/nhqtdrle/)"; flow:established,to_server; http.uri; content:"/nhqtdrle/"; startswith; fast_pattern; http.host; content:"applandfgh.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007411; classtype:social-engineering; sid:6007411; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (learn-ledgr-live-en-1jk.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"learn-ledgr-live-en-1jk.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007412; classtype:social-engineering; sid:6007412; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.robloxgenerator119.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.robloxgenerator119.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007413; classtype:social-engineering; sid:6007413; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ep-it-loayk4ufe95t-ggexecdrb9c0hrem.z02.azurefd.net/Win20Errfb020/index.html)"; flow:established,to_server; http.uri; content:"/Win20Errfb020/index.html"; startswith; fast_pattern; http.host; content:"ep-it-loayk4ufe95t-ggexecdrb9c0hrem.z02.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007414; classtype:social-engineering; sid:6007414; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5r3cl.org/login/index.html)"; flow:established,to_server; http.uri; content:"/login/index.html"; startswith; fast_pattern; http.host; content:"5r3cl.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007415; classtype:social-engineering; sid:6007415; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-lavsel-biz-hormek-frandik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-lavsel-biz-hormek-frandik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007416; classtype:social-engineering; sid:6007416; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhlmilano.it/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"dhlmilano.it"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007417; classtype:social-engineering; sid:6007417; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thanbayheq.github.io/DOWYRUNMEB/ATTACHEDNMEN)"; flow:established,to_server; http.uri; content:"/DOWYRUNMEB/ATTACHEDNMEN"; startswith; fast_pattern; http.host; content:"thanbayheq.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007418; classtype:social-engineering; sid:6007418; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (baohanhkangen.com/Kundenservice/)"; flow:established,to_server; http.uri; content:"/Kundenservice/"; startswith; fast_pattern; http.host; content:"baohanhkangen.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007419; classtype:social-engineering; sid:6007419; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (24h-zedelivery.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"24h-zedelivery.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007420; classtype:social-engineering; sid:6007420; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zeexpresss-delivery.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zeexpresss-delivery.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007421; classtype:social-engineering; sid:6007421; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (furious-aqua-yss2lu8g.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"furious-aqua-yss2lu8g.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007422; classtype:social-engineering; sid:6007422; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apps-ledgrs-io.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"apps-ledgrs-io.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007423; classtype:social-engineering; sid:6007423; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qelvora-nqx-larquza-a4x8hk12.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qelvora-nqx-larquza-a4x8hk12.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007424; classtype:social-engineering; sid:6007424; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-developers.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-developers.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007425; classtype:social-engineering; sid:6007425; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secondupdatenotice.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secondupdatenotice.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007426; classtype:social-engineering; sid:6007426; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docusine.com/?urid=QcAw22ro3Hy2k-wDLudNKbQwzfsL3yKQLeE7b0_B3wVOgALWCaBAUcacWU3d0KW1AwZwJryjXaGzSZ6kF_7P8EiB-KfPwbFgMIbLsfRV_SyTQ_ekNMip4dClmgKHz0nRtmu4E7r8XYR35AHtn0YAE)"; flow:established,to_server; http.uri; content:"/?urid=QcAw22ro3Hy2k-wDLudNKbQwzfsL3yKQLeE7b0_B3wVOgALWCaBAUcacWU3d0KW1AwZwJryjXaGzSZ6kF_7P8EiB-KfPwbFgMIbLsfRV_SyTQ_ekNMip4dClmgKHz0nRtmu4E7r8XYR35AHtn0YAE"; startswith; fast_pattern; http.host; content:"docusine.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007427; classtype:social-engineering; sid:6007427; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (codedbyafzalari.github.io/netflix-ui-clone/)"; flow:established,to_server; http.uri; content:"/netflix-ui-clone/"; startswith; fast_pattern; http.host; content:"codedbyafzalari.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007428; classtype:social-engineering; sid:6007428; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (playblox.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"playblox.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007429; classtype:social-engineering; sid:6007429; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-lorsik-biz-hazdel-framok.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-lorsik-biz-hazdel-framok.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007430; classtype:social-engineering; sid:6007430; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (outlooksereguri365.hstn.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"outlooksereguri365.hstn.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007431; classtype:social-engineering; sid:6007431; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (testamentenligne.info/Q0g0MS1OMTUxNS1EMDkwNjA2)"; flow:established,to_server; http.uri; content:"/Q0g0MS1OMTUxNS1EMDkwNjA2"; startswith; fast_pattern; http.host; content:"testamentenligne.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007432; classtype:social-engineering; sid:6007432; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgr-en-live-helps.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgr-en-live-helps.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007433; classtype:social-engineering; sid:6007433; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mdimjamam99.github.io/spotify-clone/)"; flow:established,to_server; http.uri; content:"/spotify-clone/"; startswith; fast_pattern; http.host; content:"mdimjamam99.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007434; classtype:social-engineering; sid:6007434; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home-live-x-ledgre-eng.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"home-live-x-ledgre-eng.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007435; classtype:social-engineering; sid:6007435; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xwldg521low-mhbkthb-7a4c2f-xwq42c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xwldg521low-mhbkthb-7a4c2f-xwq42c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007436; classtype:social-engineering; sid:6007436; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-lives-ledger-us.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en-lives-ledger-us.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007437; classtype:social-engineering; sid:6007437; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tokenim.tronscoin.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tokenim.tronscoin.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007438; classtype:social-engineering; sid:6007438; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (safe-ldge-r-live.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"safe-ldge-r-live.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007439; classtype:social-engineering; sid:6007439; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coiinbaspr-olagiim.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coiinbaspr-olagiim.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007440; classtype:social-engineering; sid:6007440; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3.therewardinglocker.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3.therewardinglocker.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007441; classtype:social-engineering; sid:6007441; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-pradok-biz-kersel-vansik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-pradok-biz-kersel-vansik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007442; classtype:social-engineering; sid:6007442; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ttrezur-en-us.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ttrezur-en-us.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007443; classtype:social-engineering; sid:6007443; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m93g57n8y-dpi68p6e0a00.edgeone.dev/english.html)"; flow:established,to_server; http.uri; content:"/english.html"; startswith; fast_pattern; http.host; content:"m93g57n8y-dpi68p6e0a00.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007444; classtype:social-engineering; sid:6007444; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (im-token.tronscoin.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"im-token.tronscoin.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007445; classtype:social-engineering; sid:6007445; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aman-boom.github.io/Instagram)"; flow:established,to_server; http.uri; content:"/Instagram"; startswith; fast_pattern; http.host; content:"aman-boom.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007446; classtype:social-engineering; sid:6007446; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webdisk.20-244-0-63.cprapid.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webdisk.20-244-0-63.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007447; classtype:social-engineering; sid:6007447; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-clone-gilt-phi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-gilt-phi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007448; classtype:social-engineering; sid:6007448; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.4sesor14d3cuenta.webcindario.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.4sesor14d3cuenta.webcindario.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007449; classtype:social-engineering; sid:6007449; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xlbdw52vstr-ycgfn38mja-8d1e3f-ms918n.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xlbdw52vstr-ycgfn38mja-8d1e3f-ms918n.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007450; classtype:social-engineering; sid:6007450; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (social2.vulidity.de/vuliscope/876d71ac-a664-4480-bf91-348d415286ae/hosting/07982858-4f3f-4e9d-bf31-477a2bc2c7df/index.html)"; flow:established,to_server; http.uri; content:"/vuliscope/876d71ac-a664-4480-bf91-348d415286ae/hosting/07982858-4f3f-4e9d-bf31-477a2bc2c7df/index.html"; startswith; fast_pattern; http.host; content:"social2.vulidity.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007451; classtype:social-engineering; sid:6007451; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-live-login-cryptos.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-live-login-cryptos.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007452; classtype:social-engineering; sid:6007452; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (njj.standard.us-east-1.oortstorages.com/docusign.fk?EMAIL=solio@b90150b26acfc6b530b9d9924a3d3381fdd3.org)"; flow:established,to_server; http.uri; content:"/docusign.fk?EMAIL=solio@b90150b26acfc6b530b9d9924a3d3381fdd3.org"; startswith; fast_pattern; http.host; content:"njj.standard.us-east-1.oortstorages.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007453; classtype:social-engineering; sid:6007453; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (originalinstagram.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"originalinstagram.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007454; classtype:social-engineering; sid:6007454; rev:1; metadata: signature_severity Major, created_et 2026_08_07;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jzkvm819m-tqbrp341k-3a1e-xwl59p.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jzkvm819m-tqbrp341k-3a1e-xwl59p.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007455; classtype:social-engineering; sid:6007455; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-hordik-biz-kamsel-frondor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-hordik-biz-kamsel-frondor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007456; classtype:social-engineering; sid:6007456; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail-spectrum-net-login.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mail-spectrum-net-login.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007457; classtype:social-engineering; sid:6007457; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (educanal.com.py/feisbuk-32454654456)"; flow:established,to_server; http.uri; content:"/feisbuk-32454654456"; startswith; fast_pattern; http.host; content:"educanal.com.py"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007458; classtype:social-engineering; sid:6007458; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-kelsor-biz-zavmik-prondel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-kelsor-biz-zavmik-prondel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007459; classtype:social-engineering; sid:6007459; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagramcoverrbrasilinstagram.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagramcoverrbrasilinstagram.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007460; classtype:social-engineering; sid:6007460; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xlbdw1b41dr-hbkptpli-8a9b6f-xlq85c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xlbdw1b41dr-hbkptpli-8a9b6f-xlq85c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007461; classtype:social-engineering; sid:6007461; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-vordel-biz-fravsel-kamrik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-vordel-biz-fravsel-kamrik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007462; classtype:social-engineering; sid:6007462; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-pravsel-biz-hazrok-zendor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-pravsel-biz-hazrok-zendor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007463; classtype:social-engineering; sid:6007463; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-hack-login.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-hack-login.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007464; classtype:social-engineering; sid:6007464; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-frelor-biz-zormik-kansel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-frelor-biz-zormik-kansel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007465; classtype:social-engineering; sid:6007465; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adobe.athena.captivatechat.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"adobe.athena.captivatechat.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007466; classtype:social-engineering; sid:6007466; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kukcon-xlognx.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kukcon-xlognx.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007467; classtype:social-engineering; sid:6007467; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jzkvm81mjwy-tqbrpren-5b8e1f-mh833a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jzkvm81mjwy-tqbrpren-5b8e1f-mh833a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007468; classtype:social-engineering; sid:6007468; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-kavmik-biz-zondor-lersak.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-kavmik-biz-zondor-lersak.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007469; classtype:social-engineering; sid:6007469; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-keldik-biz-zamrok-horsel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-keldik-biz-zamrok-horsel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007470; classtype:social-engineering; sid:6007470; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seasharebox648-e4a23cdf77d2.herokuapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"seasharebox648-e4a23cdf77d2.herokuapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007471; classtype:social-engineering; sid:6007471; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-varsik-biz-zemdok-kolmar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-varsik-biz-zemdok-kolmar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007472; classtype:social-engineering; sid:6007472; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yt2mp3api.ofismall.az/ProcessValidation/view-pr-do/plugin-read-mail/d20xODcybTU3MA**/attach-viewer-main)"; flow:established,to_server; http.uri; content:"/ProcessValidation/view-pr-do/plugin-read-mail/d20xODcybTU3MA**/attach-viewer-main"; startswith; fast_pattern; http.host; content:"yt2mp3api.ofismall.az"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007473; classtype:social-engineering; sid:6007473; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-zandek-biz-kelmor-frasik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-zandek-biz-kelmor-frasik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007474; classtype:social-engineering; sid:6007474; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.lost.com-isupport.help/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.lost.com-isupport.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007475; classtype:social-engineering; sid:6007475; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.71618.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.71618.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007476; classtype:social-engineering; sid:6007476; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-frasel-biz-zondik-pravlor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-frasel-biz-zondik-pravlor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007477; classtype:social-engineering; sid:6007477; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (odd-rice-59bf.escekolyaes.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"odd-rice-59bf.escekolyaes.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007478; classtype:social-engineering; sid:6007478; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amielitosss.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"amielitosss.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007479; classtype:social-engineering; sid:6007479; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebooklogin1now.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebooklogin1now.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007480; classtype:social-engineering; sid:6007480; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yrnald.4663.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yrnald.4663.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007481; classtype:social-engineering; sid:6007481; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (artsy-pudding-938445.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"artsy-pudding-938445.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007482; classtype:social-engineering; sid:6007482; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-vormek-biz-pransik-keldor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-vormek-biz-pransik-keldor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007483; classtype:social-engineering; sid:6007483; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myaol-serv.cwrdl.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"myaol-serv.cwrdl.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007484; classtype:social-engineering; sid:6007484; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ml-facebook.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ml-facebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007485; classtype:social-engineering; sid:6007485; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hammadbaloch-9.github.io/Facebook/)"; flow:established,to_server; http.uri; content:"/Facebook/"; startswith; fast_pattern; http.host; content:"hammadbaloch-9.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007486; classtype:social-engineering; sid:6007486; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eisha001.github.io/Netflix)"; flow:established,to_server; http.uri; content:"/Netflix"; startswith; fast_pattern; http.host; content:"eisha001.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007487; classtype:social-engineering; sid:6007487; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pyush-777.github.io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"pyush-777.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007488; classtype:social-engineering; sid:6007488; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wqdegnhwas.on-forge.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wqdegnhwas.on-forge.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007489; classtype:social-engineering; sid:6007489; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thrshopee17.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"thrshopee17.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007490; classtype:social-engineering; sid:6007490; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (msbpr5dplix-ycgfnyhy-8c9d4e-qv177a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"msbpr5dplix-ycgfnyhy-8c9d4e-qv177a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007491; classtype:social-engineering; sid:6007491; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hbkpt80gpx-xlbdw28vnz-5e2f9b-xlq91k.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hbkpt80gpx-xlbdw28vnz-5e2f9b-xlq91k.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007492; classtype:social-engineering; sid:6007492; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiifkanpaylaterzx.resmi-akzz3.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiifkanpaylaterzx.resmi-akzz3.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007493; classtype:social-engineering; sid:6007493; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (skg019403.github.io/New-1/)"; flow:established,to_server; http.uri; content:"/New-1/"; startswith; fast_pattern; http.host; content:"skg019403.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007494; classtype:social-engineering; sid:6007494; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cool-sound-9e44.jessiedunlapgof21787yad94624.workers.dev/support-index)"; flow:established,to_server; http.uri; content:"/support-index"; startswith; fast_pattern; http.host; content:"cool-sound-9e44.jessiedunlapgof21787yad94624.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007495; classtype:social-engineering; sid:6007495; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galyabet.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galyabet.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007496; classtype:social-engineering; sid:6007496; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (frosty-frog-6b2e.egfyolgvnwainsw.workers.dev/meta.help)"; flow:established,to_server; http.uri; content:"/meta.help"; startswith; fast_pattern; http.host; content:"frosty-frog-6b2e.egfyolgvnwainsw.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007497; classtype:social-engineering; sid:6007497; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-holdik-biz-fransel-pravrok.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-holdik-biz-fransel-pravrok.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007498; classtype:social-engineering; sid:6007498; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcastmailupdateaccount.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcastmailupdateaccount.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007499; classtype:social-engineering; sid:6007499; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vwjw-1ucvr-q2ql-16pc3-3sx8v8.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vwjw-1ucvr-q2ql-16pc3-3sx8v8.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007500; classtype:social-engineering; sid:6007500; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (71698.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"71698.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007501; classtype:social-engineering; sid:6007501; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newmidas.gamerstored.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"newmidas.gamerstored.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007502; classtype:social-engineering; sid:6007502; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (virtualnextpartner.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"virtualnextpartner.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007503; classtype:social-engineering; sid:6007503; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vnzkt523mjw-msprqrel-6b5d2e-hb611a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vnzkt523mjw-msprqrel-6b5d2e-hb611a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007504; classtype:social-engineering; sid:6007504; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-fravik-biz-holdor-prensak.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-fravik-biz-holdor-prensak.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007505; classtype:social-engineering; sid:6007505; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-kersok-biz-framel-londik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-kersok-biz-framel-londik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007506; classtype:social-engineering; sid:6007506; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebooklogin1now.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"facebooklogin1now.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007507; classtype:social-engineering; sid:6007507; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-harsok-biz-veldik-pramor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-harsok-biz-veldik-pramor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007508; classtype:social-engineering; sid:6007508; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instgrammail33-gif.github.io/instagram)"; flow:established,to_server; http.uri; content:"/instagram"; startswith; fast_pattern; http.host; content:"instgrammail33-gif.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007509; classtype:social-engineering; sid:6007509; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (opensea-sessions56.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"opensea-sessions56.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007510; classtype:social-engineering; sid:6007510; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookloginnet.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebookloginnet.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007511; classtype:social-engineering; sid:6007511; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (n-ux539.github.io/FDL2604C02)"; flow:established,to_server; http.uri; content:"/FDL2604C02"; startswith; fast_pattern; http.host; content:"n-ux539.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007512; classtype:social-engineering; sid:6007512; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-handor-biz-prasvik-frelok.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-handor-biz-prasvik-frelok.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007513; classtype:social-engineering; sid:6007513; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kxztp5c80sk-mvrqlwur-9e4f1c-zd611a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kxztp5c80sk-mvrqlwur-9e4f1c-zd611a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007514; classtype:social-engineering; sid:6007514; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paribcardsegr.bond/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paribcardsegr.bond"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007515; classtype:social-engineering; sid:6007515; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trustworthy-shallot-648391.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trustworthy-shallot-648391.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007516; classtype:social-engineering; sid:6007516; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paypalcredit.github.io/redeem/)"; flow:established,to_server; http.uri; content:"/redeem/"; startswith; fast_pattern; http.host; content:"paypalcredit.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007517; classtype:social-engineering; sid:6007517; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cheery-parfait-c54a7b.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cheery-parfait-c54a7b.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007518; classtype:social-engineering; sid:6007518; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagramaccounthacks.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagramaccounthacks.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007519; classtype:social-engineering; sid:6007519; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pemenangshopee66.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pemenangshopee66.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007520; classtype:social-engineering; sid:6007520; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-verification-system4.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-verification-system4.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007521; classtype:social-engineering; sid:6007521; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (exodswalet.pages.dev/]Exodus)"; flow:established,to_server; http.uri; content:"/]Exodus"; startswith; fast_pattern; http.host; content:"exodswalet.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007522; classtype:social-engineering; sid:6007522; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinity-comcasts.github.io/xfinity-flask)"; flow:established,to_server; http.uri; content:"/xfinity-flask"; startswith; fast_pattern; http.host; content:"xfinity-comcasts.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007523; classtype:social-engineering; sid:6007523; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.2-euroline.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.2-euroline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007524; classtype:social-engineering; sid:6007524; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-instagram.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-instagram.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007525; classtype:social-engineering; sid:6007525; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (opensea-ioget.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"opensea-ioget.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007526; classtype:social-engineering; sid:6007526; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-kendor-biz-frondik-zalvek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-kendor-biz-frondik-zalvek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007527; classtype:social-engineering; sid:6007527; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8ruuxo-pit64-xglds-vwh-m0lscg.pages.dev/qaz-wsx-edc-rfv)"; flow:established,to_server; http.uri; content:"/qaz-wsx-edc-rfv"; startswith; fast_pattern; http.host; content:"8ruuxo-pit64-xglds-vwh-m0lscg.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007528; classtype:social-engineering; sid:6007528; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hotmailskjfhurytnadinbox.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hotmailskjfhurytnadinbox.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007529; classtype:social-engineering; sid:6007529; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mehrazhowlader.github.io/project_test)"; flow:established,to_server; http.uri; content:"/project_test"; startswith; fast_pattern; http.host; content:"mehrazhowlader.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007530; classtype:social-engineering; sid:6007530; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebookbigeronline.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebookbigeronline.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007531; classtype:social-engineering; sid:6007531; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookloginsignub.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebookloginsignub.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007532; classtype:social-engineering; sid:6007532; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deepakkrmandal18-netizen.github.io/Instagramweb)"; flow:established,to_server; http.uri; content:"/Instagramweb"; startswith; fast_pattern; http.host; content:"deepakkrmandal18-netizen.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007533; classtype:social-engineering; sid:6007533; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comomensagemtodososamigosdofacebook.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comomensagemtodososamigosdofacebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007534; classtype:social-engineering; sid:6007534; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookloginapp.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebookloginapp.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007535; classtype:social-engineering; sid:6007535; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rebrand.ly/g59jl7z)"; flow:established,to_server; http.uri; content:"/g59jl7z"; startswith; fast_pattern; http.host; content:"rebrand.ly"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007536; classtype:social-engineering; sid:6007536; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-hormik-biz-zaldek-vansor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-hormik-biz-zaldek-vansor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007537; classtype:social-engineering; sid:6007537; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.yrnald.4663.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.yrnald.4663.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007538; classtype:social-engineering; sid:6007538; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookbigeronline.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebookbigeronline.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007539; classtype:social-engineering; sid:6007539; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (salleryonlnejbhomesiiite.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"salleryonlnejbhomesiiite.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007540; classtype:social-engineering; sid:6007540; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hidden-scene-8d69.rvxejgblnuevhsi.workers.dev/account-center)"; flow:established,to_server; http.uri; content:"/account-center"; startswith; fast_pattern; http.host; content:"hidden-scene-8d69.rvxejgblnuevhsi.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007541; classtype:social-engineering; sid:6007541; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.g97z.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.g97z.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007542; classtype:social-engineering; sid:6007542; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp13ct-prandel-biz-zormek-lavkor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp13ct-prandel-biz-zormek-lavkor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007543; classtype:social-engineering; sid:6007543; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebooklogin8989.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebooklogin8989.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007544; classtype:social-engineering; sid:6007544; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp-tools.lateinos.com.br/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp-tools.lateinos.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007545; classtype:social-engineering; sid:6007545; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fragrant-tooth-899d.nklsrqgiosckuev.workers.dev/meta.help)"; flow:established,to_server; http.uri; content:"/meta.help"; startswith; fast_pattern; http.host; content:"fragrant-tooth-899d.nklsrqgiosckuev.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007546; classtype:social-engineering; sid:6007546; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xyce-ld.nefxed.biz.id/jmk/int.html)"; flow:established,to_server; http.uri; content:"/jmk/int.html"; startswith; fast_pattern; http.host; content:"xyce-ld.nefxed.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007547; classtype:social-engineering; sid:6007547; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-demo.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-demo.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007548; classtype:social-engineering; sid:6007548; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (32pm38-usb-euw67i-cc2kt-skicc.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"32pm38-usb-euw67i-cc2kt-skicc.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007549; classtype:social-engineering; sid:6007549; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faq-ledger-live-download.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faq-ledger-live-download.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007550; classtype:social-engineering; sid:6007550; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ycgfn25kq-msprq81los-4c1d7a-vn428w.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ycgfn25kq-msprq81los-4c1d7a-vn428w.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007551; classtype:social-engineering; sid:6007551; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lost.com-isupport.help/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lost.com-isupport.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007552; classtype:social-engineering; sid:6007552; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amandiwakarrr.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"amandiwakarrr.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007553; classtype:social-engineering; sid:6007553; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trk-105.healthanswers.info/ga/click/2-17218745-21-16023-31226-17407-2f0b352bc3-432bcb9b64)"; flow:established,to_server; http.uri; content:"/ga/click/2-17218745-21-16023-31226-17407-2f0b352bc3-432bcb9b64"; startswith; fast_pattern; http.host; content:"trk-105.healthanswers.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007554; classtype:social-engineering; sid:6007554; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-kavsor-biz-londik-pramel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-kavsor-biz-londik-pramel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007555; classtype:social-engineering; sid:6007555; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faqs-trezcom-web-doc.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faqs-trezcom-web-doc.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007556; classtype:social-engineering; sid:6007556; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.digitalplatforumu.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.digitalplatforumu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007557; classtype:social-engineering; sid:6007557; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-live-get-desktop.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-live-get-desktop.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007558; classtype:social-engineering; sid:6007558; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (affifamarwat-ship-it.github.io/counter/)"; flow:established,to_server; http.uri; content:"/counter/"; startswith; fast_pattern; http.host; content:"affifamarwat-ship-it.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007559; classtype:social-engineering; sid:6007559; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.anoopsamazon.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.anoopsamazon.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007560; classtype:social-engineering; sid:6007560; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qerwrrsfwetrans.edgeone.dev/?email=a.b@c)"; flow:established,to_server; http.uri; content:"/?email=a.b@c"; startswith; fast_pattern; http.host; content:"qerwrrsfwetrans.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007561; classtype:social-engineering; sid:6007561; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shekashish.github.io/netflix_clone)"; flow:established,to_server; http.uri; content:"/netflix_clone"; startswith; fast_pattern; http.host; content:"shekashish.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007562; classtype:social-engineering; sid:6007562; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reactivarwhats.webcindario.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"reactivarwhats.webcindario.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007563; classtype:social-engineering; sid:6007563; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-instagram.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-instagram.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007564; classtype:social-engineering; sid:6007564; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mtron.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mtron.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007565; classtype:social-engineering; sid:6007565; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vanshiigurbani.github.io/spotify-clone/)"; flow:established,to_server; http.uri; content:"/spotify-clone/"; startswith; fast_pattern; http.host; content:"vanshiigurbani.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007566; classtype:social-engineering; sid:6007566; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (destructor82.github.io/Leger/)"; flow:established,to_server; http.uri; content:"/Leger/"; startswith; fast_pattern; http.host; content:"destructor82.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007567; classtype:social-engineering; sid:6007567; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webxfinitylogin.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webxfinitylogin.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007568; classtype:social-engineering; sid:6007568; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhlvarese.it/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"dhlvarese.it"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007569; classtype:social-engineering; sid:6007569; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (claimgethererblxslimited.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"claimgethererblxslimited.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007570; classtype:social-engineering; sid:6007570; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-varsor-biz-kendik-zolmar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-varsor-biz-kendik-zolmar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007571; classtype:social-engineering; sid:6007571; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tusharkumar80023-create.github.io/Instagram-)"; flow:established,to_server; http.uri; content:"/Instagram-"; startswith; fast_pattern; http.host; content:"tusharkumar80023-create.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007572; classtype:social-engineering; sid:6007572; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e8a5dd-98jv-sbu49-jb48i-ezmw.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e8a5dd-98jv-sbu49-jb48i-ezmw.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007573; classtype:social-engineering; sid:6007573; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp13ct-lavkor-biz-prandor-zersik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp13ct-lavkor-biz-prandor-zersik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007574; classtype:social-engineering; sid:6007574; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-fravsel-biz-zandor-kemvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-fravsel-biz-zandor-kemvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007575; classtype:social-engineering; sid:6007575; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.71593.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.71593.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007576; classtype:social-engineering; sid:6007576; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (liveledger-offical.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"liveledger-offical.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007577; classtype:social-engineering; sid:6007577; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-kormek-biz-hansor-vardik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-kormek-biz-hansor-vardik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007578; classtype:social-engineering; sid:6007578; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qwayinternational.in/kkiulj)"; flow:established,to_server; http.uri; content:"/kkiulj"; startswith; fast_pattern; http.host; content:"qwayinternational.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007579; classtype:social-engineering; sid:6007579; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2fd86-j7ic3-7s49z5-jkffss.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2fd86-j7ic3-7s49z5-jkffss.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007580; classtype:social-engineering; sid:6007580; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sunniacademy.org/docsign/page.html?sid=1L9mSwQk4YpXjzNx6QmAbGi9zV2kbyfPjGrlztviQAY5XqPCqgVd2pK8f2neWYOmKZoe8VddIY2J7M9nMh7fQuFgniTdb1KmqDRdD36Lc7ue7oKtdY6VzEZtVNI)"; flow:established,to_server; http.uri; content:"/docsign/page.html?sid=1L9mSwQk4YpXjzNx6QmAbGi9zV2kbyfPjGrlztviQAY5XqPCqgVd2pK8f2neWYOmKZoe8VddIY2J7M9nMh7fQuFgniTdb1KmqDRdD36Lc7ue7oKtdY6VzEZtVNI"; startswith; fast_pattern; http.host; content:"sunniacademy.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007581; classtype:social-engineering; sid:6007581; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sucurpanamigoc360.fly.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sucurpanamigoc360.fly.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007582; classtype:social-engineering; sid:6007582; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebooktrade.com/instagram.html)"; flow:established,to_server; http.uri; content:"/instagram.html"; startswith; fast_pattern; http.host; content:"facebooktrade.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007583; classtype:social-engineering; sid:6007583; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.71713.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.71713.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007584; classtype:social-engineering; sid:6007584; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rooooo22.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rooooo22.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007585; classtype:social-engineering; sid:6007585; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebooklogin8989.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebooklogin8989.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007586; classtype:social-engineering; sid:6007586; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-verification-system4.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-verification-system4.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007587; classtype:social-engineering; sid:6007587; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bybit-referral-code-id.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bybit-referral-code-id.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007588; classtype:social-engineering; sid:6007588; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (social-statements.com/esign.social-statements.com)"; flow:established,to_server; http.uri; content:"/esign.social-statements.com"; startswith; fast_pattern; http.host; content:"social-statements.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007589; classtype:social-engineering; sid:6007589; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-zermik-biz-holdor-lansak.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-zermik-biz-holdor-lansak.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007590; classtype:social-engineering; sid:6007590; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-zardok-biz-hensel-fravik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-zardok-biz-hensel-fravik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007591; classtype:social-engineering; sid:6007591; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-harsik-biz-voldek-pramel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-harsik-biz-voldek-pramel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007592; classtype:social-engineering; sid:6007592; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fizafatima24.github.io/Aamazon/)"; flow:established,to_server; http.uri; content:"/Aamazon/"; startswith; fast_pattern; http.host; content:"fizafatima24.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007593; classtype:social-engineering; sid:6007593; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-hazdok-biz-frandel-vormik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-hazdok-biz-frandel-vormik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007594; classtype:social-engineering; sid:6007594; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mhbkt4a51gp-xwldgmja-1e9f5b-mhb96c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mhbkt4a51gp-xwldgmja-1e9f5b-mhb96c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007595; classtype:social-engineering; sid:6007595; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (almax.net.br/febukk-mk-place-43556654435/)"; flow:established,to_server; http.uri; content:"/febukk-mk-place-43556654435/"; startswith; fast_pattern; http.host; content:"almax.net.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007596; classtype:social-engineering; sid:6007596; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ml-facebook.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ml-facebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007597; classtype:social-engineering; sid:6007597; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hbkpt42lkww-xlbdwwur-2b5f7a-hbk94p.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hbkpt42lkww-xlbdwwur-2b5f7a-hbk94p.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007598; classtype:social-engineering; sid:6007598; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.71381.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.71381.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007599; classtype:social-engineering; sid:6007599; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-kersel-biz-vondok-zarmik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-kersel-biz-vondok-zarmik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007600; classtype:social-engineering; sid:6007600; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (late-lab-7d38.aipsfxywsiqmxmt.workers.dev/meta.help)"; flow:established,to_server; http.uri; content:"/meta.help"; startswith; fast_pattern; http.host; content:"late-lab-7d38.aipsfxywsiqmxmt.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007601; classtype:social-engineering; sid:6007601; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.app81-facebook.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.app81-facebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007602; classtype:social-engineering; sid:6007602; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anshuman-bharti-79.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"anshuman-bharti-79.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007603; classtype:social-engineering; sid:6007603; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (celadon-stroopwafel-407584.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"celadon-stroopwafel-407584.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007604; classtype:social-engineering; sid:6007604; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ep-ch-op3izuems2p7-cmdsg8byeda5d9g3.z02.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ep-ch-op3izuems2p7-cmdsg8byeda5d9g3.z02.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007605; classtype:social-engineering; sid:6007605; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-zendok-biz-pravmik-karsel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-zendok-biz-pravmik-karsel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007606; classtype:social-engineering; sid:6007606; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ok2wt5-3n5b2-o9pq-5pm-3gjs5n.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ok2wt5-3n5b2-o9pq-5pm-3gjs5n.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007607; classtype:social-engineering; sid:6007607; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wetransfer-sampleproduct-transfer.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wetransfer-sampleproduct-transfer.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007608; classtype:social-engineering; sid:6007608; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.vkr.sqs.mybluehost.me/EN/TD-ZE5KIzX0UW4&oauth_key_signature=eyJraWQOiJrUFVqdlNhT25GWUVDakpjMmV1MXJvNGxnb2VFeXJJb2tCbU1X3BiZXN/loading.php)"; flow:established,to_server; http.uri; content:"/EN/TD-ZE5KIzX0UW4&oauth_key_signature=eyJraWQOiJrUFVqdlNhT25GWUVDakpjMmV1MXJvNGxnb2VFeXJJb2tCbU1X3BiZXN/loading.php"; startswith; fast_pattern; http.host; content:"www.vkr.sqs.mybluehost.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007609; classtype:social-engineering; sid:6007609; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (download-offical-trexrsuite.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"download-offical-trexrsuite.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007610; classtype:social-engineering; sid:6007610; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rngkuqoo.elementor.cloud/EN34FJHG7ND53/EN33UY645/M0002X1/info.html)"; flow:established,to_server; http.uri; content:"/EN34FJHG7ND53/EN33UY645/M0002X1/info.html"; startswith; fast_pattern; http.host; content:"rngkuqoo.elementor.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007611; classtype:social-engineering; sid:6007611; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (morlena-nqx-belqumi-c7x3hq98.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"morlena-nqx-belqumi-c7x3hq98.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007612; classtype:social-engineering; sid:6007612; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mydropsboxmaill.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mydropsboxmaill.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007613; classtype:social-engineering; sid:6007613; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.amazonjob-opal.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.amazonjob-opal.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007614; classtype:social-engineering; sid:6007614; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-varmik-biz-zadsel-prensor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-varmik-biz-zadsel-prensor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007615; classtype:social-engineering; sid:6007615; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inspirational-process-593665.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"inspirational-process-593665.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007616; classtype:social-engineering; sid:6007616; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.y99s.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.y99s.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007617; classtype:social-engineering; sid:6007617; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-zelrek-biz-karsik-vandom.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-zelrek-biz-karsik-vandom.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007618; classtype:social-engineering; sid:6007618; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comprehensive-employee-143296.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comprehensive-employee-143296.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007619; classtype:social-engineering; sid:6007619; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pixelquest-btg.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pixelquest-btg.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007620; classtype:social-engineering; sid:6007620; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-kandor-biz-fravmek-lorsik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-kandor-biz-fravmek-lorsik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007621; classtype:social-engineering; sid:6007621; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wesmongtx.4663.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wesmongtx.4663.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007622; classtype:social-engineering; sid:6007622; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aware-research-270929.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aware-research-270929.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007623; classtype:social-engineering; sid:6007623; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fuchsia-workshops-221572.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fuchsia-workshops-221572.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007624; classtype:social-engineering; sid:6007624; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-fransik-biz-pravdok-kelmor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-fransik-biz-pravdok-kelmor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007625; classtype:social-engineering; sid:6007625; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastupdate.framer.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastupdate.framer.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007626; classtype:social-engineering; sid:6007626; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-zorsel-biz-karmik-favdok.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-zorsel-biz-karmik-favdok.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007627; classtype:social-engineering; sid:6007627; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (new-set-3.searchsst.info/Y2gtZmVkZXgtMjAyNg/?u=163C1655&e=h.p.vonsiebenthal%40bluewin.ch&s3=&s4=&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/Y2gtZmVkZXgtMjAyNg/?u=163C1655&e=h.p.vonsiebenthal%40bluewin.ch&s3=&s4=&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"new-set-3.searchsst.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007628; classtype:social-engineering; sid:6007628; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp12ct-pravdor-biz-lansik-hormel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp12ct-pravdor-biz-lansik-hormel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007629; classtype:social-engineering; sid:6007629; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (binance-register.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"binance-register.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007630; classtype:social-engineering; sid:6007630; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitylogininc.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitylogininc.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007631; classtype:social-engineering; sid:6007631; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1-on-sign-sync-online.com/inline/app-find/app-end/)"; flow:established,to_server; http.uri; content:"/inline/app-find/app-end/"; startswith; fast_pattern; http.host; content:"1-on-sign-sync-online.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007632; classtype:social-engineering; sid:6007632; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (confirmationofmailupdate.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"confirmationofmailupdate.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007633; classtype:social-engineering; sid:6007633; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xlbdw2a16vs-ycgfnmja-8d3e2f-xlq54c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xlbdw2a16vs-ycgfnmja-8d3e2f-xlq54c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007634; classtype:social-engineering; sid:6007634; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp.123zoeken.be/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp.123zoeken.be"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007635; classtype:social-engineering; sid:6007635; rev:1; metadata: signature_severity Major, created_et 2026_08_08;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17557.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17557.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007636; classtype:social-engineering; sid:6007636; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.roblox.com.et/users/873731717396/profile)"; flow:established,to_server; http.uri; content:"/users/873731717396/profile"; startswith; fast_pattern; http.host; content:"www.roblox.com.et"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007637; classtype:social-engineering; sid:6007637; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sheokand9806.github.io/javascript-amazon-project/)"; flow:established,to_server; http.uri; content:"/javascript-amazon-project/"; startswith; fast_pattern; http.host; content:"sheokand9806.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007638; classtype:social-engineering; sid:6007638; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amount.999coin.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amount.999coin.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007639; classtype:social-engineering; sid:6007639; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qnz-odw4ji-3ajjw-c6b5ck-tzj2f.pages.dev/send_appeal_request)"; flow:established,to_server; http.uri; content:"/send_appeal_request"; startswith; fast_pattern; http.host; content:"qnz-odw4ji-3ajjw-c6b5ck-tzj2f.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007640; classtype:social-engineering; sid:6007640; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (retry-icloud.com/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"retry-icloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007641; classtype:social-engineering; sid:6007641; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (178best.zoomus.org/ese/set/authen)"; flow:established,to_server; http.uri; content:"/ese/set/authen"; startswith; fast_pattern; http.host; content:"178best.zoomus.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007642; classtype:social-engineering; sid:6007642; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amitsharma-hub.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"amitsharma-hub.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007643; classtype:social-engineering; sid:6007643; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xmqrb72kfly-zdcynpdr-2e5a8b-pj555c.pages.dev/welcome_aboard)"; flow:established,to_server; http.uri; content:"/welcome_aboard"; startswith; fast_pattern; http.host; content:"xmqrb72kfly-zdcynpdr-2e5a8b-pj555c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007644; classtype:social-engineering; sid:6007644; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sites.google.com/view/fremenageursbrdetonsfrdevg/accueil/)"; flow:established,to_server; http.uri; content:"/view/fremenageursbrdetonsfrdevg/accueil/"; startswith; fast_pattern; http.host; content:"sites.google.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007645; classtype:social-engineering; sid:6007645; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ig.do/Rengoku1a10)"; flow:established,to_server; http.uri; content:"/Rengoku1a10"; startswith; fast_pattern; http.host; content:"ig.do"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007646; classtype:social-engineering; sid:6007646; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www-itausegurancas.rf.gd/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"www-itausegurancas.rf.gd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007647; classtype:social-engineering; sid:6007647; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (distribuidora24hr.com/agostopromo/)"; flow:established,to_server; http.uri; content:"/agostopromo/"; startswith; fast_pattern; http.host; content:"distribuidora24hr.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007648; classtype:social-engineering; sid:6007648; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pemenangshopee66.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pemenangshopee66.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007649; classtype:social-engineering; sid:6007649; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kxztp616mj-mvrqlren-9b8e4f-zd922a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kxztp616mj-mvrqlren-9b8e4f-zd922a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007650; classtype:social-engineering; sid:6007650; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.options-icloud.com/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"www.options-icloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007651; classtype:social-engineering; sid:6007651; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (953581.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"953581.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007652; classtype:social-engineering; sid:6007652; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (daily-midasbuy.officiall-events.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"daily-midasbuy.officiall-events.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007653; classtype:social-engineering; sid:6007653; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.yqluvyr.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.yqluvyr.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007654; classtype:social-engineering; sid:6007654; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fedex-olive.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fedex-olive.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007655; classtype:social-engineering; sid:6007655; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hbkpt4a51gp-xlbdwmja-2e0f6b-hbk96c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hbkpt4a51gp-xlbdwmja-2e0f6b-hbk96c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007656; classtype:social-engineering; sid:6007656; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinityloginupdates.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinityloginupdates.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007657; classtype:social-engineering; sid:6007657; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (y4nl4ndirkrdsimialblgyi.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"y4nl4ndirkrdsimialblgyi.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007658; classtype:social-engineering; sid:6007658; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comfortable-amethyst-wkaujes3.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comfortable-amethyst-wkaujes3.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007659; classtype:social-engineering; sid:6007659; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trizir-bridge.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trizir-bridge.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007660; classtype:social-engineering; sid:6007660; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docs.gustavodev.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"docs.gustavodev.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007661; classtype:social-engineering; sid:6007661; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-ledger-doc-70e.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en-ledger-doc-70e.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007662; classtype:social-engineering; sid:6007662; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pu.biolyroa.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pu.biolyroa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007663; classtype:social-engineering; sid:6007663; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vdde00wq.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vdde00wq.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007664; classtype:social-engineering; sid:6007664; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robuxv2.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"robuxv2.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007665; classtype:social-engineering; sid:6007665; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (malvex.club/Rftrans/re.php)"; flow:established,to_server; http.uri; content:"/Rftrans/re.php"; startswith; fast_pattern; http.host; content:"malvex.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007666; classtype:social-engineering; sid:6007666; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.jndaj.top/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"www.jndaj.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007667; classtype:social-engineering; sid:6007667; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (olivetreecounselling.co.uk/waitforyourupdatinginfo)"; flow:established,to_server; http.uri; content:"/waitforyourupdatinginfo"; startswith; fast_pattern; http.host; content:"olivetreecounselling.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007668; classtype:social-engineering; sid:6007668; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (options-icloud.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"options-icloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007669; classtype:social-engineering; sid:6007669; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (keep-icloud.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"keep-icloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007670; classtype:social-engineering; sid:6007670; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ppt.cc/f3hUpx)"; flow:established,to_server; http.uri; content:"/f3hUpx"; startswith; fast_pattern; http.host; content:"ppt.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007671; classtype:social-engineering; sid:6007671; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhagyashridodmise75-cmd.github.io/spotify-clone/)"; flow:established,to_server; http.uri; content:"/spotify-clone/"; startswith; fast_pattern; http.host; content:"bhagyashridodmise75-cmd.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007672; classtype:social-engineering; sid:6007672; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (78c9a5.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"78c9a5.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007673; classtype:social-engineering; sid:6007673; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ayush-bijlwan.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"ayush-bijlwan.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007674; classtype:social-engineering; sid:6007674; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suite-trzur-auth-sos.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"suite-trzur-auth-sos.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007675; classtype:social-engineering; sid:6007675; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hbkpt1b20pz-xlbdwlsi-2e1f9a-hbk57c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hbkpt1b20pz-xlbdwlsi-2e1f9a-hbk57c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007676; classtype:social-engineering; sid:6007676; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.auroravaultgame.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.auroravaultgame.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007677; classtype:social-engineering; sid:6007677; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-clone-f73c.panda.new/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-clone-f73c.panda.new"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007678; classtype:social-engineering; sid:6007678; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebooklogin18.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebooklogin18.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007679; classtype:social-engineering; sid:6007679; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (msprq02nhwu-ycgfnfyn-0d5e9f-vn222a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"msprq02nhwu-ycgfnfyn-0d5e9f-vn222a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007680; classtype:social-engineering; sid:6007680; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.999coin.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.999coin.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007681; classtype:social-engineering; sid:6007681; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bbhdpromocionesonline.infy.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bbhdpromocionesonline.infy.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007682; classtype:social-engineering; sid:6007682; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ericomerieslmarc567.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ericomerieslmarc567.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007683; classtype:social-engineering; sid:6007683; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.metomosk-logi.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.metomosk-logi.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007684; classtype:social-engineering; sid:6007684; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2ff26c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2ff26c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007685; classtype:social-engineering; sid:6007685; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp14ct-holtak-biz-prenor-veskim.pages.dev/send_appeal_request)"; flow:established,to_server; http.uri; content:"/send_appeal_request"; startswith; fast_pattern; http.host; content:"sp14ct-holtak-biz-prenor-veskim.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007686; classtype:social-engineering; sid:6007686; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3x34x43xrx.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3x34x43xrx.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007687; classtype:social-engineering; sid:6007687; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thrshopee13.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"thrshopee13.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007688; classtype:social-engineering; sid:6007688; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yash-kumar-rathore.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"yash-kumar-rathore.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007689; classtype:social-engineering; sid:6007689; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityaccountmanagement.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinityaccountmanagement.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007690; classtype:social-engineering; sid:6007690; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (entiicsd.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"entiicsd.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007691; classtype:social-engineering; sid:6007691; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.rluxsends.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.rluxsends.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007692; classtype:social-engineering; sid:6007692; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bnmsc.com/app099)"; flow:established,to_server; http.uri; content:"/app099"; startswith; fast_pattern; http.host; content:"bnmsc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007693; classtype:social-engineering; sid:6007693; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp13ct-vormik-biz-prandel-kazsel.pages.dev/rtyu-iopj-qewr-thjm?welcome=1155444847661021)"; flow:established,to_server; http.uri; content:"/rtyu-iopj-qewr-thjm?welcome=1155444847661021"; startswith; fast_pattern; http.host; content:"sp13ct-vormik-biz-prandel-kazsel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007694; classtype:social-engineering; sid:6007694; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebookdatingonfacebook.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebookdatingonfacebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007695; classtype:social-engineering; sid:6007695; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creditecuador--credit004.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"creditecuador--credit004.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007696; classtype:social-engineering; sid:6007696; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (duajunaid53-gif.github.io/homepage.clone/)"; flow:established,to_server; http.uri; content:"/homepage.clone/"; startswith; fast_pattern; http.host; content:"duajunaid53-gif.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007697; classtype:social-engineering; sid:6007697; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (questvault.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"questvault.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007698; classtype:social-engineering; sid:6007698; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whatsapp.123zoeken.be/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsapp.123zoeken.be"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007699; classtype:social-engineering; sid:6007699; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17568.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17568.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007700; classtype:social-engineering; sid:6007700; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comunidadeplanejamentofuturo.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"comunidadeplanejamentofuturo.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007701; classtype:social-engineering; sid:6007701; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bjoiku.asia/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"bjoiku.asia"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007702; classtype:social-engineering; sid:6007702; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (68765.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"68765.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007703; classtype:social-engineering; sid:6007703; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maxcuru.com/rb)"; flow:established,to_server; http.uri; content:"/rb"; startswith; fast_pattern; http.host; content:"maxcuru.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007704; classtype:social-engineering; sid:6007704; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (i3kzguafkqw5ogjba8e6vpv7wmrtb9synsf23-h68.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"i3kzguafkqw5ogjba8e6vpv7wmrtb9synsf23-h68.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007705; classtype:social-engineering; sid:6007705; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox.com.ml/users/365711557369/profile)"; flow:established,to_server; http.uri; content:"/users/365711557369/profile"; startswith; fast_pattern; http.host; content:"roblox.com.ml"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007706; classtype:social-engineering; sid:6007706; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imap.frogrocket.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"imap.frogrocket.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007707; classtype:social-engineering; sid:6007707; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qelvora-nqx-zarquni-a6x1dp38.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qelvora-nqx-zarquni-a6x1dp38.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007708; classtype:social-engineering; sid:6007708; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verilopnet.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"verilopnet.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007709; classtype:social-engineering; sid:6007709; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fb.globalty.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fb.globalty.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007710; classtype:social-engineering; sid:6007710; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafybeia6yulbmb7tceq6y3rc3olcao2be35bwdlvavf6cbbcbpbt5ceeum.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafybeia6yulbmb7tceq6y3rc3olcao2be35bwdlvavf6cbbcbpbt5ceeum.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007711; classtype:social-engineering; sid:6007711; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (helps-live-engg-ledger.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"helps-live-engg-ledger.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007712; classtype:social-engineering; sid:6007712; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365bet6.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.365bet6.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007713; classtype:social-engineering; sid:6007713; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (r08h.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"r08h.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007714; classtype:social-engineering; sid:6007714; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mobapay.best/?etext=2202.7qvsee9gxl1DEUGQXq2W5HVzb2p6a2FzenZybHN5dHM.58e94bf6c6eaaa275b7af70180199cf49bcfcf73)"; flow:established,to_server; http.uri; content:"/?etext=2202.7qvsee9gxl1DEUGQXq2W5HVzb2p6a2FzenZybHN5dHM.58e94bf6c6eaaa275b7af70180199cf49bcfcf73"; startswith; fast_pattern; http.host; content:"mobapay.best"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007715; classtype:social-engineering; sid:6007715; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.binancelivetrade.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.binancelivetrade.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007716; classtype:social-engineering; sid:6007716; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faceb.ook-ee.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faceb.ook-ee.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007717; classtype:social-engineering; sid:6007717; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mandharesoham.github.io/amazon-ui-clone/)"; flow:established,to_server; http.uri; content:"/amazon-ui-clone/"; startswith; fast_pattern; http.host; content:"mandharesoham.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007718; classtype:social-engineering; sid:6007718; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (koludcqpo.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"koludcqpo.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007719; classtype:social-engineering; sid:6007719; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clktp7agpxo-kphzwmja-4f7g9c-clk96c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clktp7agpxo-kphzwmja-4f7g9c-clk96c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007720; classtype:social-engineering; sid:6007720; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uupholdxlogi.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uupholdxlogi.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007721; classtype:social-engineering; sid:6007721; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shivam94566.github.io/My-First-Website/)"; flow:established,to_server; http.uri; content:"/My-First-Website/"; startswith; fast_pattern; http.host; content:"shivam94566.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007722; classtype:social-engineering; sid:6007722; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pal-b7.github.io/Spotify-Clone/)"; flow:established,to_server; http.uri; content:"/Spotify-Clone/"; startswith; fast_pattern; http.host; content:"pal-b7.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007723; classtype:social-engineering; sid:6007723; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinitymail2025.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinitymail2025.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007724; classtype:social-engineering; sid:6007724; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhfwo457232.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dhfwo457232.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007725; classtype:social-engineering; sid:6007725; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tuitui19999.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tuitui19999.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007726; classtype:social-engineering; sid:6007726; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a1e0b3.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a1e0b3.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007727; classtype:social-engineering; sid:6007727; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (boogiestore.in/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"boogiestore.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007728; classtype:social-engineering; sid:6007728; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (starts-eng-trezrr.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"starts-eng-trezrr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007729; classtype:social-engineering; sid:6007729; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hbkpt32bfrn-xlbdwskr-2d5c8f-hbk65c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hbkpt32bfrn-xlbdwskr-2d5c8f-hbk65c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007730; classtype:social-engineering; sid:6007730; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xelzavi-nqx-belquro-r2t6dp89.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xelzavi-nqx-belquro-r2t6dp89.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007731; classtype:social-engineering; sid:6007731; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (superexpressvacuum.ca/cn/)"; flow:established,to_server; http.uri; content:"/cn/"; startswith; fast_pattern; http.host; content:"superexpressvacuum.ca"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007732; classtype:social-engineering; sid:6007732; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ql5b30.info/kbyxydvaa/)"; flow:established,to_server; http.uri; content:"/kbyxydvaa/"; startswith; fast_pattern; http.host; content:"ql5b30.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007733; classtype:social-engineering; sid:6007733; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (logn-li-ledgerr.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"logn-li-ledgerr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007734; classtype:social-engineering; sid:6007734; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (norzeta-nqx-felquro-p9t2dp53.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"norzeta-nqx-felquro-p9t2dp53.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007735; classtype:social-engineering; sid:6007735; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.74009.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.74009.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007736; classtype:social-engineering; sid:6007736; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home-en-desktop-ledgr-view.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"home-en-desktop-ledgr-view.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007737; classtype:social-engineering; sid:6007737; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee4949.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee4949.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007738; classtype:social-engineering; sid:6007738; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (demontre.com.ar/telling/)"; flow:established,to_server; http.uri; content:"/telling/"; startswith; fast_pattern; http.host; content:"demontre.com.ar"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007739; classtype:social-engineering; sid:6007739; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kelkelican.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kelkelican.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007740; classtype:social-engineering; sid:6007740; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (woen-dc91.urdgiusf.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"woen-dc91.urdgiusf.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007741; classtype:social-engineering; sid:6007741; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.rpsrescue.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.rpsrescue.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007742; classtype:social-engineering; sid:6007742; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.access-icloud.com/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"www.access-icloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007743; classtype:social-engineering; sid:6007743; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (certnfcu.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"certnfcu.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007744; classtype:social-engineering; sid:6007744; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bnbsafepay.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bnbsafepay.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007745; classtype:social-engineering; sid:6007745; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (html-vs-markdown-llm.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"html-vs-markdown-llm.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007746; classtype:social-engineering; sid:6007746; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (riveremprestimos.com/jap/?naps)"; flow:established,to_server; http.uri; content:"/jap/?naps"; startswith; fast_pattern; http.host; content:"riveremprestimos.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007747; classtype:social-engineering; sid:6007747; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cwsxlopery.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cwsxlopery.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007748; classtype:social-engineering; sid:6007748; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.paribcardsegu.bond/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.paribcardsegu.bond"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007749; classtype:social-engineering; sid:6007749; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.x98k.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.x98k.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007750; classtype:social-engineering; sid:6007750; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jaswanthperuri.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"jaswanthperuri.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007751; classtype:social-engineering; sid:6007751; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezor-suite-auth-web.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezor-suite-auth-web.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007752; classtype:social-engineering; sid:6007752; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reatcd402.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"reatcd402.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007753; classtype:social-engineering; sid:6007753; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.coincheck.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.coincheck.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007754; classtype:social-engineering; sid:6007754; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p7v3w.motnatelly.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p7v3w.motnatelly.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007755; classtype:social-engineering; sid:6007755; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rriblog03.blogspot.com/?id=c5974de8&m=1)"; flow:established,to_server; http.uri; content:"/?id=c5974de8&m=1"; startswith; fast_pattern; http.host; content:"rriblog03.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007756; classtype:social-engineering; sid:6007756; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kkm.9988330.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kkm.9988330.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007757; classtype:social-engineering; sid:6007757; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17534.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17534.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007758; classtype:social-engineering; sid:6007758; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox.com.gr/users/411177855546/profile)"; flow:established,to_server; http.uri; content:"/users/411177855546/profile"; startswith; fast_pattern; http.host; content:"roblox.com.gr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007759; classtype:social-engineering; sid:6007759; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookdatingonfacebook.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebookdatingonfacebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007760; classtype:social-engineering; sid:6007760; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4k7e.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4k7e.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007761; classtype:social-engineering; sid:6007761; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagramlogin68.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagramlogin68.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007762; classtype:social-engineering; sid:6007762; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instgram-ais.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instgram-ais.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007763; classtype:social-engineering; sid:6007763; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qf2708.craftum.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qf2708.craftum.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007764; classtype:social-engineering; sid:6007764; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (opensea.walletconnect.help/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"opensea.walletconnect.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007765; classtype:social-engineering; sid:6007765; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docs-base-bridge-faq.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"docs-base-bridge-faq.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007766; classtype:social-engineering; sid:6007766; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitymail2025.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitymail2025.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007767; classtype:social-engineering; sid:6007767; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8678v6v87.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8678v6v87.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007768; classtype:social-engineering; sid:6007768; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anjalisinha9508.github.io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"anjalisinha9508.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007769; classtype:social-engineering; sid:6007769; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (leoparntecx.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"leoparntecx.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007770; classtype:social-engineering; sid:6007770; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alentocuidadointegral.com.br/serverbank/53rd/sdhdsgijhcdctdjhdvdffutdtytytdiuyjfiyfyffkiutuiepohtgbkcvx)"; flow:established,to_server; http.uri; content:"/serverbank/53rd/sdhdsgijhcdctdjhdvdffutdtytytdiuyjfiyfyffkiutuiepohtgbkcvx"; startswith; fast_pattern; http.host; content:"alentocuidadointegral.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007771; classtype:social-engineering; sid:6007771; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (948320.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"948320.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007772; classtype:social-engineering; sid:6007772; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8fb063.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8fb063.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007773; classtype:social-engineering; sid:6007773; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qvjkt511mj-msbpr81ren-4b1e8f-hb418k.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qvjkt511mj-msbpr81ren-4b1e8f-hb418k.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007774; classtype:social-engineering; sid:6007774; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fret-rx.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fret-rx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007775; classtype:social-engineering; sid:6007775; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgrr-live-download.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgrr-live-download.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007776; classtype:social-engineering; sid:6007776; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (73047.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"73047.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007777; classtype:social-engineering; sid:6007777; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (caisse-epargne.mdps.fr/espace/)"; flow:established,to_server; http.uri; content:"/espace/"; startswith; fast_pattern; http.host; content:"caisse-epargne.mdps.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007778; classtype:social-engineering; sid:6007778; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagramlogin77.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagramlogin77.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007779; classtype:social-engineering; sid:6007779; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ycgfn0e96kq-msprqlos-4c1d8a-ycg07w.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ycgfn0e96kq-msprqlos-4c1d8a-ycg07w.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007780; classtype:social-engineering; sid:6007780; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (camilobarbosatv.com/sync/app)"; flow:established,to_server; http.uri; content:"/sync/app"; startswith; fast_pattern; http.host; content:"camilobarbosatv.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007781; classtype:social-engineering; sid:6007781; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebookloginreview.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebookloginreview.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007782; classtype:social-engineering; sid:6007782; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bank0famerica.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bank0famerica.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007783; classtype:social-engineering; sid:6007783; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creditopichincha--micreditoseguro.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"creditopichincha--micreditoseguro.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007784; classtype:social-engineering; sid:6007784; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (learn-ledgrro-en.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"learn-ledgrro-en.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007785; classtype:social-engineering; sid:6007785; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.14004.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.14004.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007786; classtype:social-engineering; sid:6007786; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sspecser.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sspecser.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007787; classtype:social-engineering; sid:6007787; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a4538b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a4538b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007788; classtype:social-engineering; sid:6007788; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vormela-gld-belquro-c8x1hk34.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vormela-gld-belquro-c8x1hk34.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007789; classtype:social-engineering; sid:6007789; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6e207b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6e207b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007790; classtype:social-engineering; sid:6007790; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coracakun.github.io/Netflix/)"; flow:established,to_server; http.uri; content:"/Netflix/"; startswith; fast_pattern; http.host; content:"coracakun.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007791; classtype:social-engineering; sid:6007791; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinmail.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinmail.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007792; classtype:social-engineering; sid:6007792; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (468398.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"468398.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007793; classtype:social-engineering; sid:6007793; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (91a45f.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"91a45f.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007794; classtype:social-engineering; sid:6007794; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7ad798.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7ad798.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007795; classtype:social-engineering; sid:6007795; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c4238a.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c4238a.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007796; classtype:social-engineering; sid:6007796; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0a63a3.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0a63a3.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007797; classtype:social-engineering; sid:6007797; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.88440.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.88440.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007798; classtype:social-engineering; sid:6007798; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.13951.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.13951.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007799; classtype:social-engineering; sid:6007799; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagramcom001.github.io/instragram)"; flow:established,to_server; http.uri; content:"/instragram"; startswith; fast_pattern; http.host; content:"instagramcom001.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007800; classtype:social-engineering; sid:6007800; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webapp.speak-whatapp.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webapp.speak-whatapp.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007801; classtype:social-engineering; sid:6007801; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b01c96.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b01c96.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007802; classtype:social-engineering; sid:6007802; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5dab8a.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"5dab8a.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007803; classtype:social-engineering; sid:6007803; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (474811.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"474811.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007804; classtype:social-engineering; sid:6007804; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mrhsbsvronline.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mrhsbsvronline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007805; classtype:social-engineering; sid:6007805; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookloginf.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebookloginf.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007806; classtype:social-engineering; sid:6007806; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xn--registre-societes-franaise-dkc.fr/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xn--registre-societes-franaise-dkc.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007807; classtype:social-engineering; sid:6007807; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagramloginpassword.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagramloginpassword.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007808; classtype:social-engineering; sid:6007808; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pendaftaraan-pinjaamanbrii.cqq.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pendaftaraan-pinjaamanbrii.cqq.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007809; classtype:social-engineering; sid:6007809; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verifyinstagramaccount.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"verifyinstagramaccount.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007810; classtype:social-engineering; sid:6007810; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ea50cf.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ea50cf.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007811; classtype:social-engineering; sid:6007811; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (16a47b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"16a47b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007812; classtype:social-engineering; sid:6007812; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebookphotoslogin.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebookphotoslogin.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007813; classtype:social-engineering; sid:6007813; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dbde4b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dbde4b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007814; classtype:social-engineering; sid:6007814; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (315247.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"315247.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007815; classtype:social-engineering; sid:6007815; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1fb9be.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1fb9be.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007816; classtype:social-engineering; sid:6007816; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp13ct-pransik-biz-kavdor-fravmel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp13ct-pransik-biz-kavdor-fravmel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007817; classtype:social-engineering; sid:6007817; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-account-manager.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-account-manager.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007818; classtype:social-engineering; sid:6007818; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c0f834.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c0f834.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007819; classtype:social-engineering; sid:6007819; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0b3ffc.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0b3ffc.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007820; classtype:social-engineering; sid:6007820; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c58ba4.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c58ba4.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007821; classtype:social-engineering; sid:6007821; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreid2tokyg67rabnt4ogsg7omtdffyrfbbsh5vizalvaenvpmsczxga.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreid2tokyg67rabnt4ogsg7omtdffyrfbbsh5vizalvaenvpmsczxga.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007822; classtype:social-engineering; sid:6007822; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.proxy.demo.biitpro.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.proxy.demo.biitpro.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007823; classtype:social-engineering; sid:6007823; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0283a4.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0283a4.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007824; classtype:social-engineering; sid:6007824; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (megaconnet.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"megaconnet.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007825; classtype:social-engineering; sid:6007825; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f961db.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f961db.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007826; classtype:social-engineering; sid:6007826; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loginaccountfacebook.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"loginaccountfacebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007827; classtype:social-engineering; sid:6007827; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f9096d.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f9096d.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007828; classtype:social-engineering; sid:6007828; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.60829.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.60829.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007829; classtype:social-engineering; sid:6007829; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c3930a.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c3930a.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007830; classtype:social-engineering; sid:6007830; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (947ff0.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"947ff0.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007831; classtype:social-engineering; sid:6007831; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wins-feed.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wins-feed.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007832; classtype:social-engineering; sid:6007832; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (w3ma11-s3tt1ng-acqu1r3d-n0w-q234hjd.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"w3ma11-s3tt1ng-acqu1r3d-n0w-q234hjd.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007833; classtype:social-engineering; sid:6007833; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.88306.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.88306.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007834; classtype:social-engineering; sid:6007834; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.13994.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.13994.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007835; classtype:social-engineering; sid:6007835; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cz-facebook.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cz-facebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007836; classtype:social-engineering; sid:6007836; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f19bce.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f19bce.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007837; classtype:social-engineering; sid:6007837; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-q.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-q.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007838; classtype:social-engineering; sid:6007838; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gett10krobuxofficial.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gett10krobuxofficial.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007839; classtype:social-engineering; sid:6007839; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.logins-msn-365.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.logins-msn-365.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007840; classtype:social-engineering; sid:6007840; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.13961.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.13961.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007841; classtype:social-engineering; sid:6007841; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagramloginon.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"instagramloginon.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007842; classtype:social-engineering; sid:6007842; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8b203f.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8b203f.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007843; classtype:social-engineering; sid:6007843; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c61514.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c61514.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007844; classtype:social-engineering; sid:6007844; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcascommunicationcable.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcascommunicationcable.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007845; classtype:social-engineering; sid:6007845; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (globe-jrstv.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"globe-jrstv.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007846; classtype:social-engineering; sid:6007846; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amirsohail100.github.io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"amirsohail100.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007847; classtype:social-engineering; sid:6007847; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinity-restore.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinity-restore.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007848; classtype:social-engineering; sid:6007848; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ayurshop.com/.cahceter/indexw.html)"; flow:established,to_server; http.uri; content:"/.cahceter/indexw.html"; startswith; fast_pattern; http.host; content:"ayurshop.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007849; classtype:social-engineering; sid:6007849; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfintyloginupdate.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfintyloginupdate.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007850; classtype:social-engineering; sid:6007850; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4c90b0.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4c90b0.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007851; classtype:social-engineering; sid:6007851; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4458e7.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4458e7.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007852; classtype:social-engineering; sid:6007852; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1c2c65.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1c2c65.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007853; classtype:social-engineering; sid:6007853; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ffbe97.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ffbe97.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007854; classtype:social-engineering; sid:6007854; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a28cdb.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a28cdb.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007855; classtype:social-engineering; sid:6007855; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (59762b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"59762b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007856; classtype:social-engineering; sid:6007856; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0b0529.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0b0529.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007857; classtype:social-engineering; sid:6007857; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-account-manager.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-account-manager.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007858; classtype:social-engineering; sid:6007858; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebookloginfriends.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebookloginfriends.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007859; classtype:social-engineering; sid:6007859; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (subflix.es/captcha)"; flow:established,to_server; http.uri; content:"/captcha"; startswith; fast_pattern; http.host; content:"subflix.es"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007860; classtype:social-engineering; sid:6007860; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fake-fb-login.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fake-fb-login.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007861; classtype:social-engineering; sid:6007861; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2c5a9b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2c5a9b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007862; classtype:social-engineering; sid:6007862; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebookcommunitylogin.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebookcommunitylogin.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007863; classtype:social-engineering; sid:6007863; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (departamentodeguiasveiculares.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"departamentodeguiasveiculares.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007864; classtype:social-engineering; sid:6007864; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.88438.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.88438.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007865; classtype:social-engineering; sid:6007865; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (msprq08qtw-vnzkt117nx-9b6c2d-hb621a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"msprq08qtw-vnzkt117nx-9b6c2d-hb621a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007866; classtype:social-engineering; sid:6007866; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfjffdfdf.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfjffdfdf.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007867; classtype:social-engineering; sid:6007867; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (14b52e.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"14b52e.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007868; classtype:social-engineering; sid:6007868; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfiniity-update.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfiniity-update.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007869; classtype:social-engineering; sid:6007869; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (741be7.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"741be7.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007870; classtype:social-engineering; sid:6007870; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.88418.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.88418.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007871; classtype:social-engineering; sid:6007871; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ba733f.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ba733f.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007872; classtype:social-engineering; sid:6007872; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.88455.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.88455.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007873; classtype:social-engineering; sid:6007873; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (worker-calm-water-4bc2.hs1hg-po.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"worker-calm-water-4bc2.hs1hg-po.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007874; classtype:social-engineering; sid:6007874; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.88326.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.88326.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007875; classtype:social-engineering; sid:6007875; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (be2901.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"be2901.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007876; classtype:social-engineering; sid:6007876; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (660eb6.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"660eb6.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007877; classtype:social-engineering; sid:6007877; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-verification-system3.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-verification-system3.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007878; classtype:social-engineering; sid:6007878; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c88d2b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c88d2b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007879; classtype:social-engineering; sid:6007879; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zorelia-bonusfortune.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zorelia-bonusfortune.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007880; classtype:social-engineering; sid:6007880; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8d52a8.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8d52a8.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007881; classtype:social-engineering; sid:6007881; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5a1034.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"5a1034.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007882; classtype:social-engineering; sid:6007882; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0719c3.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0719c3.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007883; classtype:social-engineering; sid:6007883; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookcommunitylogin.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"facebookcommunitylogin.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007884; classtype:social-engineering; sid:6007884; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a78e72.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a78e72.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007885; classtype:social-engineering; sid:6007885; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (88466.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"88466.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007886; classtype:social-engineering; sid:6007886; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (da2680.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"da2680.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007887; classtype:social-engineering; sid:6007887; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a92181.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a92181.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007888; classtype:social-engineering; sid:6007888; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfiniity-update.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfiniity-update.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007889; classtype:social-engineering; sid:6007889; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylaterz.kqm.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylaterz.kqm.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007890; classtype:social-engineering; sid:6007890; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (35229b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"35229b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007891; classtype:social-engineering; sid:6007891; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (60c96b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"60c96b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007892; classtype:social-engineering; sid:6007892; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebooklogini.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebooklogini.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007893; classtype:social-engineering; sid:6007893; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.14001.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.14001.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007894; classtype:social-engineering; sid:6007894; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityupdatedmail.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinityupdatedmail.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007895; classtype:social-engineering; sid:6007895; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a77c03.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a77c03.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007896; classtype:social-engineering; sid:6007896; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flaiz002.github.io/sdfkjnkewhq/)"; flow:established,to_server; http.uri; content:"/sdfkjnkewhq/"; startswith; fast_pattern; http.host; content:"flaiz002.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007897; classtype:social-engineering; sid:6007897; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6cd5ca.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6cd5ca.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007898; classtype:social-engineering; sid:6007898; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.14008.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.14008.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007899; classtype:social-engineering; sid:6007899; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7ea274.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7ea274.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007900; classtype:social-engineering; sid:6007900; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.oferta-2451784.cfd/oferta/neptun-przyczepka-samochodowa/13362)"; flow:established,to_server; http.uri; content:"/oferta/neptun-przyczepka-samochodowa/13362"; startswith; fast_pattern; http.host; content:"allegrolokalnie.oferta-2451784.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007901; classtype:social-engineering; sid:6007901; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfiniityy.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfiniityy.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007902; classtype:social-engineering; sid:6007902; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookphotospages90.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"facebookphotospages90.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007903; classtype:social-engineering; sid:6007903; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f37a97.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f37a97.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007904; classtype:social-engineering; sid:6007904; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp13ct-lormor-biz-frandel-zavsel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp13ct-lormor-biz-frandel-zavsel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007905; classtype:social-engineering; sid:6007905; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nizami57575.github.io/Instagram)"; flow:established,to_server; http.uri; content:"/Instagram"; startswith; fast_pattern; http.host; content:"nizami57575.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007906; classtype:social-engineering; sid:6007906; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spectrum-charter-email-updated-account.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spectrum-charter-email-updated-account.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007907; classtype:social-engineering; sid:6007907; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagramcom-instagramcom.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagramcom-instagramcom.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007908; classtype:social-engineering; sid:6007908; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.88412.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.88412.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007909; classtype:social-engineering; sid:6007909; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vnzkt7e52dr-hbkptlpw-6a5b0c-hb699a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vnzkt7e52dr-hbkptlpw-6a5b0c-hb699a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007910; classtype:social-engineering; sid:6007910; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5461a7.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"5461a7.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007911; classtype:social-engineering; sid:6007911; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8bf000.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8bf000.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007912; classtype:social-engineering; sid:6007912; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a31b2c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a31b2c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007913; classtype:social-engineering; sid:6007913; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tte-zuites.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tte-zuites.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007914; classtype:social-engineering; sid:6007914; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (226b73.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"226b73.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007915; classtype:social-engineering; sid:6007915; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.binance-register.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.binance-register.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007916; classtype:social-engineering; sid:6007916; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dcef40.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dcef40.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007917; classtype:social-engineering; sid:6007917; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-login-redirect.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-login-redirect.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007918; classtype:social-engineering; sid:6007918; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zizifn-anycast.cyliuhao01.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zizifn-anycast.cyliuhao01.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007919; classtype:social-engineering; sid:6007919; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c4wcrrr3c443c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c4wcrrr3c443c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007920; classtype:social-engineering; sid:6007920; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (681ecc.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"681ecc.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007921; classtype:social-engineering; sid:6007921; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.absencestelefone.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.absencestelefone.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007922; classtype:social-engineering; sid:6007922; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-linkedin.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"facebook-linkedin.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007923; classtype:social-engineering; sid:6007923; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a90503.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a90503.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007924; classtype:social-engineering; sid:6007924; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loginmyfacebook.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"loginmyfacebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007925; classtype:social-engineering; sid:6007925; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebooklogin333.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebooklogin333.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007926; classtype:social-engineering; sid:6007926; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klikk-paylaaterr.theix.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"klikk-paylaaterr.theix.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007927; classtype:social-engineering; sid:6007927; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-logo.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-logo.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007928; classtype:social-engineering; sid:6007928; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.13953.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.13953.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007929; classtype:social-engineering; sid:6007929; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (88407.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"88407.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007930; classtype:social-engineering; sid:6007930; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (28b829.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"28b829.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007931; classtype:social-engineering; sid:6007931; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfmailconnect.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfmailconnect.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007932; classtype:social-engineering; sid:6007932; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.88441.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.88441.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007933; classtype:social-engineering; sid:6007933; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bybithje.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bybithje.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007934; classtype:social-engineering; sid:6007934; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hbkpt52lkww-xlbdwwur-2b7f3a-hbk44p.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hbkpt52lkww-xlbdwwur-2b7f3a-hbk44p.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007935; classtype:social-engineering; sid:6007935; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (giftcodelqvn.aovlienquan-garena.com/1c2a470f171f3b9f313f1c3c9e0368a4FB)"; flow:established,to_server; http.uri; content:"/1c2a470f171f3b9f313f1c3c9e0368a4FB"; startswith; fast_pattern; http.host; content:"giftcodelqvn.aovlienquan-garena.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007936; classtype:social-engineering; sid:6007936; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookphotoslogin.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebookphotoslogin.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007937; classtype:social-engineering; sid:6007937; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.00281.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.00281.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007938; classtype:social-engineering; sid:6007938; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinitylogininc.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinitylogininc.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007939; classtype:social-engineering; sid:6007939; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ec2d17.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ec2d17.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007940; classtype:social-engineering; sid:6007940; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bad3a4.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bad3a4.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007941; classtype:social-engineering; sid:6007941; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0e1dd8.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0e1dd8.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007942; classtype:social-engineering; sid:6007942; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0eb5fe.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0eb5fe.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007943; classtype:social-engineering; sid:6007943; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8b33b9.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8b33b9.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007944; classtype:social-engineering; sid:6007944; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.88413.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.88413.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007945; classtype:social-engineering; sid:6007945; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (14014.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"14014.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007946; classtype:social-engineering; sid:6007946; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.thrshopee17.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.thrshopee17.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007947; classtype:social-engineering; sid:6007947; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (10ed95.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"10ed95.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007948; classtype:social-engineering; sid:6007948; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebooklogininfo.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebooklogininfo.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007949; classtype:social-engineering; sid:6007949; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b37e34.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b37e34.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007950; classtype:social-engineering; sid:6007950; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1e6983.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1e6983.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007951; classtype:social-engineering; sid:6007951; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8d61f1.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8d61f1.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007952; classtype:social-engineering; sid:6007952; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth-spectrum-net-update.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auth-spectrum-net-update.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007953; classtype:social-engineering; sid:6007953; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myaccountxfinity.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"myaccountxfinity.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007954; classtype:social-engineering; sid:6007954; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9c5317.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9c5317.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007955; classtype:social-engineering; sid:6007955; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ff7e66.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ff7e66.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007956; classtype:social-engineering; sid:6007956; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.88164.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.88164.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007957; classtype:social-engineering; sid:6007957; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (globalskincareid.store/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"globalskincareid.store"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007958; classtype:social-engineering; sid:6007958; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebooklogin239.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebooklogin239.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007959; classtype:social-engineering; sid:6007959; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hibafatima2782008-code.github.io/webclone-netflix/)"; flow:established,to_server; http.uri; content:"/webclone-netflix/"; startswith; fast_pattern; http.host; content:"hibafatima2782008-code.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007960; classtype:social-engineering; sid:6007960; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fb-mobile0.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fb-mobile0.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007961; classtype:social-engineering; sid:6007961; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (opensea-nftbox-fc872a1c36fe.herokuapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"opensea-nftbox-fc872a1c36fe.herokuapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007962; classtype:social-engineering; sid:6007962; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-live-safe.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-live-safe.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007963; classtype:social-engineering; sid:6007963; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitymembership.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitymembership.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007964; classtype:social-engineering; sid:6007964; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee1345.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee1345.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007965; classtype:social-engineering; sid:6007965; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-q.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-q.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007966; classtype:social-engineering; sid:6007966; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (absencestelefone.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"absencestelefone.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007967; classtype:social-engineering; sid:6007967; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e97c44.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e97c44.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007968; classtype:social-engineering; sid:6007968; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c036f7.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c036f7.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007969; classtype:social-engineering; sid:6007969; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-linkedin.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.facebook-linkedin.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007970; classtype:social-engineering; sid:6007970; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (insolj.vercel.app/Instag?chatId=8158788716)"; flow:established,to_server; http.uri; content:"/Instag?chatId=8158788716"; startswith; fast_pattern; http.host; content:"insolj.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007971; classtype:social-engineering; sid:6007971; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (438a7a.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"438a7a.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007972; classtype:social-engineering; sid:6007972; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (52db7c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"52db7c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007973; classtype:social-engineering; sid:6007973; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.uphloll-xlugnm-io.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.uphloll-xlugnm-io.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007974; classtype:social-engineering; sid:6007974; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deepik-a.github.io/NETFLIX-CLONE-BOOTSTRAP/)"; flow:established,to_server; http.uri; content:"/NETFLIX-CLONE-BOOTSTRAP/"; startswith; fast_pattern; http.host; content:"deepik-a.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007975; classtype:social-engineering; sid:6007975; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (glowremotely.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"glowremotely.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007976; classtype:social-engineering; sid:6007976; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.updatexfinity.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.updatexfinity.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007977; classtype:social-engineering; sid:6007977; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcastinfo.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcastinfo.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007978; classtype:social-engineering; sid:6007978; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uphloll-xlugnm-io.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uphloll-xlugnm-io.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007979; classtype:social-engineering; sid:6007979; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (primefamily-annulation.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"primefamily-annulation.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007980; classtype:social-engineering; sid:6007980; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (798019.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"798019.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007981; classtype:social-engineering; sid:6007981; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4706ba.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4706ba.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007982; classtype:social-engineering; sid:6007982; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitymyaccount.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitymyaccount.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007983; classtype:social-engineering; sid:6007983; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (82e7ac.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"82e7ac.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007984; classtype:social-engineering; sid:6007984; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accountfacebook.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"accountfacebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007985; classtype:social-engineering; sid:6007985; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rognyestebangiljimenez-web.github.io/freere)"; flow:established,to_server; http.uri; content:"/freere"; startswith; fast_pattern; http.host; content:"rognyestebangiljimenez-web.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007986; classtype:social-engineering; sid:6007986; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (61564.my/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"61564.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007987; classtype:social-engineering; sid:6007987; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinitymembership.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinitymembership.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007988; classtype:social-engineering; sid:6007988; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tigervision.com/.sh)"; flow:established,to_server; http.uri; content:"/.sh"; startswith; fast_pattern; http.host; content:"tigervision.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007989; classtype:social-engineering; sid:6007989; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastinfo.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastinfo.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007990; classtype:social-engineering; sid:6007990; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebooklogin99999.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebooklogin99999.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007991; classtype:social-engineering; sid:6007991; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.13960.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.13960.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007992; classtype:social-engineering; sid:6007992; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.livmoting.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.livmoting.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007993; classtype:social-engineering; sid:6007993; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.70539.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.70539.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007994; classtype:social-engineering; sid:6007994; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uj2-tocl-wyls-ykjh-9pon-os0dhc.pages.dev/qaz-wsx-edc-rfv)"; flow:established,to_server; http.uri; content:"/qaz-wsx-edc-rfv"; startswith; fast_pattern; http.host; content:"uj2-tocl-wyls-ykjh-9pon-os0dhc.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007995; classtype:social-engineering; sid:6007995; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (infoxfinity.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"infoxfinity.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007996; classtype:social-engineering; sid:6007996; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c83335.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c83335.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007997; classtype:social-engineering; sid:6007997; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-freelogin.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"facebook-freelogin.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007998; classtype:social-engineering; sid:6007998; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (welcome-ledger-live-en.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"welcome-ledger-live-en.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6007999; classtype:social-engineering; sid:6007999; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d06bd8.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d06bd8.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008000; classtype:social-engineering; sid:6008000; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (56105c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"56105c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008001; classtype:social-engineering; sid:6008001; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee1345.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee1345.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008002; classtype:social-engineering; sid:6008002; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.14011.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.14011.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008003; classtype:social-engineering; sid:6008003; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aged-tree-3d1f.ikfmaolaogmern.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aged-tree-3d1f.ikfmaolaogmern.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008004; classtype:social-engineering; sid:6008004; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.13972.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.13972.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008005; classtype:social-engineering; sid:6008005; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinitymyaccount.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinitymyaccount.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008006; classtype:social-engineering; sid:6008006; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (g29t.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"g29t.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008007; classtype:social-engineering; sid:6008007; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ac0628.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ac0628.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008008; classtype:social-engineering; sid:6008008; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sxfi.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.sxfi.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008009; classtype:social-engineering; sid:6008009; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfjffdfdf.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfjffdfdf.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008010; classtype:social-engineering; sid:6008010; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (865619.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"865619.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008011; classtype:social-engineering; sid:6008011; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.galerihadiah749.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.galerihadiah749.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008012; classtype:social-engineering; sid:6008012; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.70113.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.70113.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008013; classtype:social-engineering; sid:6008013; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c18336.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c18336.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008014; classtype:social-engineering; sid:6008014; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4c32bc.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4c32bc.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008015; classtype:social-engineering; sid:6008015; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3b0d63.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3b0d63.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008016; classtype:social-engineering; sid:6008016; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (63e3c1.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"63e3c1.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008017; classtype:social-engineering; sid:6008017; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f08b20.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f08b20.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008018; classtype:social-engineering; sid:6008018; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (16c236.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"16c236.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008019; classtype:social-engineering; sid:6008019; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wjsng72lowi-zdkpthb-1a4c5f-wjq13c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wjsng72lowi-zdkpthb-1a4c5f-wjq13c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008020; classtype:social-engineering; sid:6008020; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ms-06a-zaku-ii.prorsa.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ms-06a-zaku-ii.prorsa.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008021; classtype:social-engineering; sid:6008021; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebookcomfacebook.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebookcomfacebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008022; classtype:social-engineering; sid:6008022; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (micr0sft.github.io/com.mx/)"; flow:established,to_server; http.uri; content:"/com.mx/"; startswith; fast_pattern; http.host; content:"micr0sft.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008023; classtype:social-engineering; sid:6008023; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kocaman.github.io/workout)"; flow:established,to_server; http.uri; content:"/workout"; startswith; fast_pattern; http.host; content:"kocaman.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008024; classtype:social-engineering; sid:6008024; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (updatexfinity.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"updatexfinity.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008025; classtype:social-engineering; sid:6008025; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (niharmashru-learner.github.io/Ledger)"; flow:established,to_server; http.uri; content:"/Ledger"; startswith; fast_pattern; http.host; content:"niharmashru-learner.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008026; classtype:social-engineering; sid:6008026; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gasdiezel.com/4am)"; flow:established,to_server; http.uri; content:"/4am"; startswith; fast_pattern; http.host; content:"gasdiezel.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008027; classtype:social-engineering; sid:6008027; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chaudharysachin24682.github.io/currency-converter)"; flow:established,to_server; http.uri; content:"/currency-converter"; startswith; fast_pattern; http.host; content:"chaudharysachin24682.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008028; classtype:social-engineering; sid:6008028; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gravion-goldenfortune.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gravion-goldenfortune.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008029; classtype:social-engineering; sid:6008029; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (galerihadiah749.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"galerihadiah749.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008030; classtype:social-engineering; sid:6008030; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myxfinitysignin.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"myxfinitysignin.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008031; classtype:social-engineering; sid:6008031; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylaterb.file-resmii2.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylaterb.file-resmii2.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008032; classtype:social-engineering; sid:6008032; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (273f12.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"273f12.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008033; classtype:social-engineering; sid:6008033; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityhomeservice.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinityhomeservice.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008034; classtype:social-engineering; sid:6008034; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bf9aef.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bf9aef.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008035; classtype:social-engineering; sid:6008035; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastmailalert.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastmailalert.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008036; classtype:social-engineering; sid:6008036; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (31ae51.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"31ae51.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008037; classtype:social-engineering; sid:6008037; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c5d829.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c5d829.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008038; classtype:social-engineering; sid:6008038; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (midasbuygame.m7-event.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"midasbuygame.m7-event.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008039; classtype:social-engineering; sid:6008039; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (somyfc.com/launch/new-product/visual)"; flow:established,to_server; http.uri; content:"/launch/new-product/visual"; startswith; fast_pattern; http.host; content:"somyfc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008040; classtype:social-engineering; sid:6008040; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (06e34d.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"06e34d.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008041; classtype:social-engineering; sid:6008041; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinity-message.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinity-message.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008042; classtype:social-engineering; sid:6008042; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ciel-iz.github.io/Tracker-BrainDumping)"; flow:established,to_server; http.uri; content:"/Tracker-BrainDumping"; startswith; fast_pattern; http.host; content:"ciel-iz.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008043; classtype:social-engineering; sid:6008043; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sxfi.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sxfi.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008044; classtype:social-engineering; sid:6008044; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.13950.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.13950.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008045; classtype:social-engineering; sid:6008045; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6eff31.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6eff31.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008046; classtype:social-engineering; sid:6008046; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1f20da.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1f20da.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008047; classtype:social-engineering; sid:6008047; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-logo.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-logo.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008048; classtype:social-engineering; sid:6008048; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7e29e3.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7e29e3.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008049; classtype:social-engineering; sid:6008049; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (70c27a.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"70c27a.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008050; classtype:social-engineering; sid:6008050; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dailymidas.officiall-events.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dailymidas.officiall-events.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008051; classtype:social-engineering; sid:6008051; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagramloginpassword.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagramloginpassword.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008052; classtype:social-engineering; sid:6008052; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creditunion-authority.com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/"; startswith; fast_pattern; http.host; content:"creditunion-authority.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008053; classtype:social-engineering; sid:6008053; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1691fe.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1691fe.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008054; classtype:social-engineering; sid:6008054; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (58ec59.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"58ec59.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008055; classtype:social-engineering; sid:6008055; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-login-redirect.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-login-redirect.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008056; classtype:social-engineering; sid:6008056; rev:1; metadata: signature_severity Major, created_et 2026_08_09;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gentle-paprenjak-7fc631.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gentle-paprenjak-7fc631.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008057; classtype:social-engineering; sid:6008057; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cancelacardiffseguro360.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cancelacardiffseguro360.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008058; classtype:social-engineering; sid:6008058; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (an2210sh.github.io/NETFLIX-CLONE/)"; flow:established,to_server; http.uri; content:"/NETFLIX-CLONE/"; startswith; fast_pattern; http.host; content:"an2210sh.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008059; classtype:social-engineering; sid:6008059; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-login-ig.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-login-ig.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008060; classtype:social-engineering; sid:6008060; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15375.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15375.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008061; classtype:social-engineering; sid:6008061; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (csplaygems.com/2r17w9bw)"; flow:established,to_server; http.uri; content:"/2r17w9bw"; startswith; fast_pattern; http.host; content:"csplaygems.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008062; classtype:social-engineering; sid:6008062; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3aurbanismo.com.br/wp-content/Sys/ch/card.php)"; flow:established,to_server; http.uri; content:"/wp-content/Sys/ch/card.php"; startswith; fast_pattern; http.host; content:"3aurbanismo.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008063; classtype:social-engineering; sid:6008063; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nayansharma8123-gif.github.io/AmazonClone/)"; flow:established,to_server; http.uri; content:"/AmazonClone/"; startswith; fast_pattern; http.host; content:"nayansharma8123-gif.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008064; classtype:social-engineering; sid:6008064; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagramfollowers7894.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagramfollowers7894.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008065; classtype:social-engineering; sid:6008065; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastt1eyr.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastt1eyr.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008066; classtype:social-engineering; sid:6008066; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cybersecuritynews.com/new-wi-fi-authentication-bypass-flaw/)"; flow:established,to_server; http.uri; content:"/new-wi-fi-authentication-bypass-flaw/"; startswith; fast_pattern; http.host; content:"www.cybersecuritynews.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008067; classtype:social-engineering; sid:6008067; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp.traviyo.in/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp.traviyo.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008068; classtype:social-engineering; sid:6008068; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lscai-dev.github.io/PL-LEDGER)"; flow:established,to_server; http.uri; content:"/PL-LEDGER"; startswith; fast_pattern; http.host; content:"lscai-dev.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008069; classtype:social-engineering; sid:6008069; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c0nectt.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c0nectt.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008070; classtype:social-engineering; sid:6008070; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (checkhousetype.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"checkhousetype.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008071; classtype:social-engineering; sid:6008071; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gamebonusak-bot.github.io/Google/)"; flow:established,to_server; http.uri; content:"/Google/"; startswith; fast_pattern; http.host; content:"gamebonusak-bot.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008072; classtype:social-engineering; sid:6008072; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accesoihabilitado.iceiy.com/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"accesoihabilitado.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008073; classtype:social-engineering; sid:6008073; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (itsmeasifikbal.github.io/Ledger)"; flow:established,to_server; http.uri; content:"/Ledger"; startswith; fast_pattern; http.host; content:"itsmeasifikbal.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008074; classtype:social-engineering; sid:6008074; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ui-clone-faraz.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ui-clone-faraz.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008075; classtype:social-engineering; sid:6008075; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfiniity-update.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfiniity-update.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008076; classtype:social-engineering; sid:6008076; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp.audios-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp.audios-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008077; classtype:social-engineering; sid:6008077; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (logn-trezr-nge.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"logn-trezr-nge.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008078; classtype:social-engineering; sid:6008078; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tsihrewq333.pages.dev/gp/yourstore)"; flow:established,to_server; http.uri; content:"/gp/yourstore"; startswith; fast_pattern; http.host; content:"tsihrewq333.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008079; classtype:social-engineering; sid:6008079; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinityhomeservice.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinityhomeservice.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008080; classtype:social-engineering; sid:6008080; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.35518236365.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.35518236365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008081; classtype:social-engineering; sid:6008081; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suryanshsharma31.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"suryanshsharma31.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008082; classtype:social-engineering; sid:6008082; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cwsxlopery.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cwsxlopery.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008083; classtype:social-engineering; sid:6008083; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-ui-clone-two.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-ui-clone-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008084; classtype:social-engineering; sid:6008084; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kantox-preprod.com/fr/secure/login)"; flow:established,to_server; http.uri; content:"/fr/secure/login"; startswith; fast_pattern; http.host; content:"kantox-preprod.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008085; classtype:social-engineering; sid:6008085; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-2-0-dun.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-2-0-dun.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008086; classtype:social-engineering; sid:6008086; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.71678.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.71678.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008087; classtype:social-engineering; sid:6008087; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.infoxfinity.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.infoxfinity.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008088; classtype:social-engineering; sid:6008088; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (logins-msn-365.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"logins-msn-365.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008089; classtype:social-engineering; sid:6008089; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagramsupportverify.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagramsupportverify.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008090; classtype:social-engineering; sid:6008090; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dnxa-x.iddev.biz.id/vuxe/x4/login.php)"; flow:established,to_server; http.uri; content:"/vuxe/x4/login.php"; startswith; fast_pattern; http.host; content:"dnxa-x.iddev.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008091; classtype:social-engineering; sid:6008091; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cn.mpmxzu.com/home/register?code=20188)"; flow:established,to_server; http.uri; content:"/home/register?code=20188"; startswith; fast_pattern; http.host; content:"cn.mpmxzu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008092; classtype:social-engineering; sid:6008092; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (menuue-aktivasipays.greata.beauty/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"menuue-aktivasipays.greata.beauty"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008093; classtype:social-engineering; sid:6008093; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faceboomlogin.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"faceboomlogin.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008094; classtype:social-engineering; sid:6008094; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.leoparntecx.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.leoparntecx.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008095; classtype:social-engineering; sid:6008095; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ww38.hostmaster.m.facobok.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ww38.hostmaster.m.facobok.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008096; classtype:social-engineering; sid:6008096; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (akash8843.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"akash8843.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008097; classtype:social-engineering; sid:6008097; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fakebooklogin.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fakebooklogin.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008098; classtype:social-engineering; sid:6008098; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (x39p.top/m/)"; flow:established,to_server; http.uri; content:"/m/"; startswith; fast_pattern; http.host; content:"x39p.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008099; classtype:social-engineering; sid:6008099; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docusign.kecifang.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"docusign.kecifang.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008100; classtype:social-engineering; sid:6008100; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp.nurgulotomotiv.com.tr/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp.nurgulotomotiv.com.tr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008101; classtype:social-engineering; sid:6008101; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.loginaccountfacebook.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.loginaccountfacebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008102; classtype:social-engineering; sid:6008102; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hbkpt3bpzgo-xlbdwlsi-2e3f6a-hbk66c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hbkpt3bpzgo-xlbdwlsi-2e3f6a-hbk66c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008103; classtype:social-engineering; sid:6008103; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appreciated-decade-998592.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"appreciated-decade-998592.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008104; classtype:social-engineering; sid:6008104; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (u649090.softaculous.dev/wp377/wp-content/uploads/)"; flow:established,to_server; http.uri; content:"/wp377/wp-content/uploads/"; startswith; fast_pattern; http.host; content:"u649090.softaculous.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008105; classtype:social-engineering; sid:6008105; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (908779.com/admin)"; flow:established,to_server; http.uri; content:"/admin"; startswith; fast_pattern; http.host; content:"908779.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008106; classtype:social-engineering; sid:6008106; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-fansdanssapage.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.facebook-fansdanssapage.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008107; classtype:social-engineering; sid:6008107; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-ledger-chn.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"my-ledger-chn.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008108; classtype:social-engineering; sid:6008108; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee769.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee769.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008109; classtype:social-engineering; sid:6008109; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (71693.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"71693.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008110; classtype:social-engineering; sid:6008110; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1336ooo7.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1336ooo7.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008111; classtype:social-engineering; sid:6008111; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-opal-iota.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-opal-iota.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008112; classtype:social-engineering; sid:6008112; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robux911.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"robux911.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008113; classtype:social-engineering; sid:6008113; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.entiicsd.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.entiicsd.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008114; classtype:social-engineering; sid:6008114; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.paypal-signin.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.paypal-signin.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008115; classtype:social-engineering; sid:6008115; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prufungkontozu.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"prufungkontozu.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008116; classtype:social-engineering; sid:6008116; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (posttelecommail.github.io/post.github.io/)"; flow:established,to_server; http.uri; content:"/post.github.io/"; startswith; fast_pattern; http.host; content:"posttelecommail.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008117; classtype:social-engineering; sid:6008117; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fnxx.info/0e5a910c580997491fkbbbce199ad0427f8f.html)"; flow:established,to_server; http.uri; content:"/0e5a910c580997491fkbbbce199ad0427f8f.html"; startswith; fast_pattern; http.host; content:"fnxx.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008118; classtype:social-engineering; sid:6008118; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (codingwithdhruv15.github.io/Expense-tracker)"; flow:established,to_server; http.uri; content:"/Expense-tracker"; startswith; fast_pattern; http.host; content:"codingwithdhruv15.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008119; classtype:social-engineering; sid:6008119; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paypal-signin.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paypal-signin.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008120; classtype:social-engineering; sid:6008120; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rajansingh018.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"rajansingh018.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008121; classtype:social-engineering; sid:6008121; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (r911.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"r911.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008122; classtype:social-engineering; sid:6008122; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (damnchangeventq8.shop.page.midasbuy-zone.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"damnchangeventq8.shop.page.midasbuy-zone.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008123; classtype:social-engineering; sid:6008123; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.verilopnet.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.verilopnet.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008124; classtype:social-engineering; sid:6008124; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zowie2l.github.io/Ledger)"; flow:established,to_server; http.uri; content:"/Ledger"; startswith; fast_pattern; http.host; content:"zowie2l.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008125; classtype:social-engineering; sid:6008125; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.dhfwo457232.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.dhfwo457232.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008126; classtype:social-engineering; sid:6008126; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee769.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee769.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008127; classtype:social-engineering; sid:6008127; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (id.auth-share.su/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"id.auth-share.su"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008128; classtype:social-engineering; sid:6008128; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17548.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17548.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008129; classtype:social-engineering; sid:6008129; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagramsupportverify.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagramsupportverify.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008130; classtype:social-engineering; sid:6008130; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xldzw4avstr-ycgfnmja-6d9e7f-xlq03c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xldzw4avstr-ycgfnmja-6d9e7f-xlq03c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008131; classtype:social-engineering; sid:6008131; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metaeastasiasecurityteam.github.io/Verification-/)"; flow:established,to_server; http.uri; content:"/Verification-/"; startswith; fast_pattern; http.host; content:"metaeastasiasecurityteam.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008132; classtype:social-engineering; sid:6008132; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appleid.auth-share.su/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"appleid.auth-share.su"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008133; classtype:social-engineering; sid:6008133; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.j132l.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.j132l.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008134; classtype:social-engineering; sid:6008134; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vnzkt5c80sk-msprqwur-6e1f0c-hb611a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vnzkt5c80sk-msprqwur-6e1f0c-hb611a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008135; classtype:social-engineering; sid:6008135; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rf3x4x34x.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rf3x4x34x.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008136; classtype:social-engineering; sid:6008136; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (security-server-page--45678ghj.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"security-server-page--45678ghj.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008137; classtype:social-engineering; sid:6008137; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webdomain03.dnscpanel.com/~aguiasda/it/inbank/)"; flow:established,to_server; http.uri; content:"/~aguiasda/it/inbank/"; startswith; fast_pattern; http.host; content:"webdomain03.dnscpanel.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008138; classtype:social-engineering; sid:6008138; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.loginmyfacebook.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.loginmyfacebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008139; classtype:social-engineering; sid:6008139; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hadiqashakoor-max123.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"hadiqashakoor-max123.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008140; classtype:social-engineering; sid:6008140; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagramaaps-code.github.io/insta-6/)"; flow:established,to_server; http.uri; content:"/insta-6/"; startswith; fast_pattern; http.host; content:"instagramaaps-code.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008141; classtype:social-engineering; sid:6008141; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (worker-curly-sun-aghamohammadhossein.mhkh831221.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"worker-curly-sun-aghamohammadhossein.mhkh831221.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008142; classtype:social-engineering; sid:6008142; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagramfollowers7894.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagramfollowers7894.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008143; classtype:social-engineering; sid:6008143; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15377.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15377.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008144; classtype:social-engineering; sid:6008144; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (phost.com.br.cssi.com.br/CB/DZ/CB/espace-client/user.php)"; flow:established,to_server; http.uri; content:"/CB/DZ/CB/espace-client/user.php"; startswith; fast_pattern; http.host; content:"phost.com.br.cssi.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008145; classtype:social-engineering; sid:6008145; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram002.github.io/Instagrem)"; flow:established,to_server; http.uri; content:"/Instagrem"; startswith; fast_pattern; http.host; content:"instagram002.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008146; classtype:social-engineering; sid:6008146; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.y4nl4ndirkrdsimialblgyi.duckdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.y4nl4ndirkrdsimialblgyi.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008147; classtype:social-engineering; sid:6008147; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wwwmaxpointsprogram.us.cc/4g/home.html)"; flow:established,to_server; http.uri; content:"/4g/home.html"; startswith; fast_pattern; http.host; content:"wwwmaxpointsprogram.us.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008148; classtype:social-engineering; sid:6008148; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facbookloging.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facbookloging.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008149; classtype:social-engineering; sid:6008149; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vicho2014pro29328-sudo.github.io/Datos-billi-butcher-bot-rbx)"; flow:established,to_server; http.uri; content:"/Datos-billi-butcher-bot-rbx"; startswith; fast_pattern; http.host; content:"vicho2014pro29328-sudo.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008150; classtype:social-engineering; sid:6008150; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.wesmongtx.4663.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.wesmongtx.4663.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008151; classtype:social-engineering; sid:6008151; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7ashwani7.github.io/Spotify-Clone/)"; flow:established,to_server; http.uri; content:"/Spotify-Clone/"; startswith; fast_pattern; http.host; content:"7ashwani7.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008152; classtype:social-engineering; sid:6008152; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-gray-iota.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-gray-iota.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008153; classtype:social-engineering; sid:6008153; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-payment-console-redirect.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app-payment-console-redirect.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008154; classtype:social-engineering; sid:6008154; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sarthak83006.github.io/Netflix-frontpage/)"; flow:established,to_server; http.uri; content:"/Netflix-frontpage/"; startswith; fast_pattern; http.host; content:"sarthak83006.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008155; classtype:social-engineering; sid:6008155; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kaleabsintayehu489-dotcom.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"kaleabsintayehu489-dotcom.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008156; classtype:social-engineering; sid:6008156; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastxfi.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastxfi.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008157; classtype:social-engineering; sid:6008157; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facbookloging.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"facbookloging.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008158; classtype:social-engineering; sid:6008158; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zdkpt80gpx-wjsng28kxz-3e2f5b-wjq91k.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zdkpt80gpx-wjsng28kxz-3e2f5b-wjq91k.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008159; classtype:social-engineering; sid:6008159; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (php-web-server-3--jmhernandez2990.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"php-web-server-3--jmhernandez2990.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008160; classtype:social-engineering; sid:6008160; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastxfinityapp.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastxfinityapp.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008161; classtype:social-engineering; sid:6008161; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mface-book.com.vn/nguyenhuong834?a&l)"; flow:established,to_server; http.uri; content:"/nguyenhuong834?a&l"; startswith; fast_pattern; http.host; content:"mface-book.com.vn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008162; classtype:social-engineering; sid:6008162; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (page--trezrr-io-logg.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"page--trezrr-io-logg.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008163; classtype:social-engineering; sid:6008163; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ahmeddev61.github.io/Netflix_clone/)"; flow:established,to_server; http.uri; content:"/Netflix_clone/"; startswith; fast_pattern; http.host; content:"ahmeddev61.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008164; classtype:social-engineering; sid:6008164; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amycanterbury.com/PROPERTY)"; flow:established,to_server; http.uri; content:"/PROPERTY"; startswith; fast_pattern; http.host; content:"amycanterbury.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008165; classtype:social-engineering; sid:6008165; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (giftcodelqvnlq.aovlienquan-garena.com/2554f36e14492ddbabcef9d0a46ec792FB)"; flow:established,to_server; http.uri; content:"/2554f36e14492ddbabcef9d0a46ec792FB"; startswith; fast_pattern; http.host; content:"giftcodelqvnlq.aovlienquan-garena.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008166; classtype:social-engineering; sid:6008166; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhdservisscuentresolu.yzz.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bhdservisscuentresolu.yzz.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008167; classtype:social-engineering; sid:6008167; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (polizcardactiv.bond/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"polizcardactiv.bond"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008168; classtype:social-engineering; sid:6008168; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (97ee8.catex.at/cnbcard/?b=YTo0OntzOjU6ImxhYmVsIjtzOjM6IllZVCI7czozOiJ1c3IiO2k6MTYxNjtzOjQ6Im5vcGQiO3M6MTQ6InJzczIuc2F5bGVyLmF0IjtzOjE6Im8iO2k6MjEzNTt9)"; flow:established,to_server; http.uri; content:"/cnbcard/?b=YTo0OntzOjU6ImxhYmVsIjtzOjM6IllZVCI7czozOiJ1c3IiO2k6MTYxNjtzOjQ6Im5vcGQiO3M6MTQ6InJzczIuc2F5bGVyLmF0IjtzOjE6Im8iO2k6MjEzNTt9"; startswith; fast_pattern; http.host; content:"97ee8.catex.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008169; classtype:social-engineering; sid:6008169; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (34cr34cr3c-8ap.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"34cr34cr3c-8ap.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008170; classtype:social-engineering; sid:6008170; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-germany.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-germany.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008171; classtype:social-engineering; sid:6008171; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (axpgames.github.io/robloxlogin/)"; flow:established,to_server; http.uri; content:"/robloxlogin/"; startswith; fast_pattern; http.host; content:"axpgames.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008172; classtype:social-engineering; sid:6008172; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1336ooo4.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1336ooo4.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008173; classtype:social-engineering; sid:6008173; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.thrshopee13.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.thrshopee13.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008174; classtype:social-engineering; sid:6008174; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.acur.me/l/ZkLgp)"; flow:established,to_server; http.uri; content:"/l/ZkLgp"; startswith; fast_pattern; http.host; content:"www.acur.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008175; classtype:social-engineering; sid:6008175; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telvora-nqx-zentora-a5x6hk34.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telvora-nqx-zentora-a5x6hk34.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008176; classtype:social-engineering; sid:6008176; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ycgfn00lkwg-vnzktplx-4a7d0e-ycg66w.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ycgfn00lkwg-vnzktplx-4a7d0e-ycg66w.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008177; classtype:social-engineering; sid:6008177; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-demo.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-demo.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008178; classtype:social-engineering; sid:6008178; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.damnchangeventq8.shop.page.midasbuy-zone.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.damnchangeventq8.shop.page.midasbuy-zone.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008179; classtype:social-engineering; sid:6008179; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.koludcqpo.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.koludcqpo.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008180; classtype:social-engineering; sid:6008180; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fedex-olive.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fedex-olive.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008181; classtype:social-engineering; sid:6008181; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-fansdanssapage.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"facebook-fansdanssapage.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008182; classtype:social-engineering; sid:6008182; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreidia54cvtcl6pqordwdjcjmkrfmco3kvfyzedmycxhdt7tk3fexau.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreidia54cvtcl6pqordwdjcjmkrfmco3kvfyzedmycxhdt7tk3fexau.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008183; classtype:social-engineering; sid:6008183; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tweakzen.com/app/delta-executor/)"; flow:established,to_server; http.uri; content:"/app/delta-executor/"; startswith; fast_pattern; http.host; content:"www.tweakzen.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008184; classtype:social-engineering; sid:6008184; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinity-connect-newupdate.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinity-connect-newupdate.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008185; classtype:social-engineering; sid:6008185; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagramfollowersfake.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagramfollowersfake.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008186; classtype:social-engineering; sid:6008186; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steamcommumminty.cam/tradeoffer/new/partner=64318432token=r0igerPI34832)"; flow:established,to_server; http.uri; content:"/tradeoffer/new/partner=64318432token=r0igerPI34832"; startswith; fast_pattern; http.host; content:"steamcommumminty.cam"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008187; classtype:social-engineering; sid:6008187; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp13ct-lormel-biz-pradik-zavkor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp13ct-lormel-biz-pradik-zavkor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008188; classtype:social-engineering; sid:6008188; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vjump.shueisha.co.jp/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vjump.shueisha.co.jp"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008189; classtype:social-engineering; sid:6008189; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagramsupportsegurity.github.io/Instagram)"; flow:established,to_server; http.uri; content:"/Instagram"; startswith; fast_pattern; http.host; content:"instagramsupportsegurity.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008190; classtype:social-engineering; sid:6008190; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (middleeastfragrances.online.middleeastfragrances.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"middleeastfragrances.online.middleeastfragrances.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008191; classtype:social-engineering; sid:6008191; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfonlineserver.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfonlineserver.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008192; classtype:social-engineering; sid:6008192; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rblox363.github.io/rob/)"; flow:established,to_server; http.uri; content:"/rob/"; startswith; fast_pattern; http.host; content:"rblox363.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008193; classtype:social-engineering; sid:6008193; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (middleeastfragrances.website.middleeastfragrances.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"middleeastfragrances.website.middleeastfragrances.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008194; classtype:social-engineering; sid:6008194; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (puyaaaaa.github.io/roblox-rg/)"; flow:established,to_server; http.uri; content:"/roblox-rg/"; startswith; fast_pattern; http.host; content:"puyaaaaa.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008195; classtype:social-engineering; sid:6008195; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinvoice.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinvoice.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008196; classtype:social-engineering; sid:6008196; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ggforshi-cmyk.github.io/roblox-game/)"; flow:established,to_server; http.uri; content:"/roblox-game/"; startswith; fast_pattern; http.host; content:"ggforshi-cmyk.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008197; classtype:social-engineering; sid:6008197; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-clone-gray-iota.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-gray-iota.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008198; classtype:social-engineering; sid:6008198; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (msprq82nhwu-ycgfnfyn-0d3e1f-vn855a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"msprq82nhwu-ycgfnfyn-0d3e1f-vn855a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008199; classtype:social-engineering; sid:6008199; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (duishalik.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"duishalik.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008200; classtype:social-engineering; sid:6008200; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thisfreeinstagramfollowers.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"thisfreeinstagramfollowers.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008201; classtype:social-engineering; sid:6008201; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p01--docapostar24--df8ybdpttf6b.code.run/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p01--docapostar24--df8ybdpttf6b.code.run"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008202; classtype:social-engineering; sid:6008202; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trzer-suite-info.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trzer-suite-info.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008203; classtype:social-engineering; sid:6008203; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ycgfn61lkwg-vnzktpli-4ce79c-ycg22c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ycgfn61lkwg-vnzktpli-4ce79c-ycg22c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008204; classtype:social-engineering; sid:6008204; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebooklivepage.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebooklivepage.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008205; classtype:social-engineering; sid:6008205; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (access-lieledgr-eng.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"access-lieledgr-eng.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008206; classtype:social-engineering; sid:6008206; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ybfch2ekqlo-mvrqllos-7c6d3a-ybf33w.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ybfch2ekqlo-mvrqllos-7c6d3a-ybf33w.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008207; classtype:social-engineering; sid:6008207; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastinc.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastinc.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008208; classtype:social-engineering; sid:6008208; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcastinc.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcastinc.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008209; classtype:social-engineering; sid:6008209; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagramlikescheap.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagramlikescheap.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008210; classtype:social-engineering; sid:6008210; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xelmavi-vrk-belquna-p2t9dk81.pages.dev/send_appeal_request)"; flow:established,to_server; http.uri; content:"/send_appeal_request"; startswith; fast_pattern; http.host; content:"xelmavi-vrk-belquna-p2t9dk81.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008211; classtype:social-engineering; sid:6008211; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (techwithmanishhq.github.io/Spotify-Clone)"; flow:established,to_server; http.uri; content:"/Spotify-Clone"; startswith; fast_pattern; http.host; content:"techwithmanishhq.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008212; classtype:social-engineering; sid:6008212; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dmivok-trelna-2ed83f-vjbyh-6cb712.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dmivok-trelna-2ed83f-vjbyh-6cb712.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008213; classtype:social-engineering; sid:6008213; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-live-connect-desktop.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-live-connect-desktop.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008214; classtype:social-engineering; sid:6008214; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rblx-r0bux540xyz.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rblx-r0bux540xyz.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008215; classtype:social-engineering; sid:6008215; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rittajj.onthewifi.com/metanet/)"; flow:established,to_server; http.uri; content:"/metanet/"; startswith; fast_pattern; http.host; content:"rittajj.onthewifi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008216; classtype:social-engineering; sid:6008216; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fastidious-tanuki-1d7a77.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fastidious-tanuki-1d7a77.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008217; classtype:social-engineering; sid:6008217; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (long-cake-a10a.buidebidexlvtey.workers.dev/meta.help)"; flow:established,to_server; http.uri; content:"/meta.help"; startswith; fast_pattern; http.host; content:"long-cake-a10a.buidebidexlvtey.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008218; classtype:social-engineering; sid:6008218; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rimmisharma25.github.io/Netflix)"; flow:established,to_server; http.uri; content:"/Netflix"; startswith; fast_pattern; http.host; content:"rimmisharma25.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008219; classtype:social-engineering; sid:6008219; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp13ct-frasel-biz-zormor-lavdik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp13ct-frasel-biz-zormor-lavdik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008220; classtype:social-engineering; sid:6008220; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookloginss.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebookloginss.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008221; classtype:social-engineering; sid:6008221; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp15ct-zavven-biz-korun-qelix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp15ct-zavven-biz-korun-qelix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008222; classtype:social-engineering; sid:6008222; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebooklogin123.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebooklogin123.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008223; classtype:social-engineering; sid:6008223; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (virtual-personas.de/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"virtual-personas.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008224; classtype:social-engineering; sid:6008224; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.blox-drop.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.blox-drop.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008225; classtype:social-engineering; sid:6008225; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mchiajsi.us.cc/5g/home.html)"; flow:established,to_server; http.uri; content:"/5g/home.html"; startswith; fast_pattern; http.host; content:"mchiajsi.us.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008226; classtype:social-engineering; sid:6008226; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgre-live-en.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgre-live-en.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008227; classtype:social-engineering; sid:6008227; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trk-gol.aphipa.info/Y2gtZmVkZXgtMjAyNg/)"; flow:established,to_server; http.uri; content:"/Y2gtZmVkZXgtMjAyNg/"; startswith; fast_pattern; http.host; content:"trk-gol.aphipa.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008228; classtype:social-engineering; sid:6008228; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (am.sohll.lol/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"am.sohll.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008229; classtype:social-engineering; sid:6008229; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mobile-xfinity.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mobile-xfinity.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008230; classtype:social-engineering; sid:6008230; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (middleeastfragrances.store.middleeastfragrances.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"middleeastfragrances.store.middleeastfragrances.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008231; classtype:social-engineering; sid:6008231; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-clone-opal-iota.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-clone-opal-iota.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008232; classtype:social-engineering; sid:6008232; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-verification-system3.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-verification-system3.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008233; classtype:social-engineering; sid:6008233; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.wh-apghm.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.wh-apghm.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008234; classtype:social-engineering; sid:6008234; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fb-faceboook.blogspot.com/?google_abuse=GOOGLE_ABUSE_EXEMPTION=ID=177b9949f8930038:TM=1785479352:C=%3E:IP=2605:fe80:2b:105:1c00:5fff:fe00:292-:S=rEAZNIrShlz_CMcj-uQ9MQ\;+path=/\;+domain=google.com\;+expires=Fri)"; flow:established,to_server; http.uri; content:"/?google_abuse=GOOGLE_ABUSE_EXEMPTION=ID=177b9949f8930038:TM=1785479352:C=%3E:IP=2605:fe80:2b:105:1c00:5fff:fe00:292-:S=rEAZNIrShlz_CMcj-uQ9MQ|3b|+path=/|3b|+domain=google.com|3b|+expires=Fri"; startswith; fast_pattern; http.host; content:"fb-faceboook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008235; classtype:social-engineering; sid:6008235; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.busanopen.org/office/msgvoice/source/Login.php)"; flow:established,to_server; http.uri; content:"/office/msgvoice/source/Login.php"; startswith; fast_pattern; http.host; content:"www.busanopen.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008236; classtype:social-engineering; sid:6008236; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebooklogincc.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebooklogincc.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008237; classtype:social-engineering; sid:6008237; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.faceboomlogin.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.faceboomlogin.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008238; classtype:social-engineering; sid:6008238; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faq-trzzer-suite.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faq-trzzer-suite.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008239; classtype:social-engineering; sid:6008239; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (awsforensicl3ns-west1apprunner-dprd03feve9j.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"awsforensicl3ns-west1apprunner-dprd03feve9j.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008240; classtype:social-engineering; sid:6008240; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (misscroma.site/ar24/)"; flow:established,to_server; http.uri; content:"/ar24/"; startswith; fast_pattern; http.host; content:"misscroma.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008241; classtype:social-engineering; sid:6008241; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mansithakur204.github.io/spotify-inspired-music-player)"; flow:established,to_server; http.uri; content:"/spotify-inspired-music-player"; startswith; fast_pattern; http.host; content:"mansithakur204.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008242; classtype:social-engineering; sid:6008242; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hotmailskjfhurytnadinbox.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hotmailskjfhurytnadinbox.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008243; classtype:social-engineering; sid:6008243; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site--docapost24ar--df8ybdpttf6b.code.run/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site--docapost24ar--df8ybdpttf6b.code.run"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008244; classtype:social-engineering; sid:6008244; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.site-jn6w55wca.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.site-jn6w55wca.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008245; classtype:social-engineering; sid:6008245; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robloxc.com.es/users/190934801/profile)"; flow:established,to_server; http.uri; content:"/users/190934801/profile"; startswith; fast_pattern; http.host; content:"robloxc.com.es"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008246; classtype:social-engineering; sid:6008246; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp13ct-frandel-biz-zormek-lavsel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp13ct-frandel-biz-zormek-lavsel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008247; classtype:social-engineering; sid:6008247; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.site-ah3d6z3ed.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.site-ah3d6z3ed.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008248; classtype:social-engineering; sid:6008248; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.metamaskwallett.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.metamaskwallett.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008249; classtype:social-engineering; sid:6008249; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.myaccountxfinity.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.myaccountxfinity.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008250; classtype:social-engineering; sid:6008250; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.z-bio.link/i92alq/)"; flow:established,to_server; http.uri; content:"/i92alq/"; startswith; fast_pattern; http.host; content:"www.z-bio.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008251; classtype:social-engineering; sid:6008251; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (norqula-nqx-zentora-p1t7dw65.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"norqula-nqx-zentora-p1t7dw65.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008252; classtype:social-engineering; sid:6008252; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tranifer-bnb.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tranifer-bnb.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008253; classtype:social-engineering; sid:6008253; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (simple-home-591117.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"simple-home-591117.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008254; classtype:social-engineering; sid:6008254; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcastxfi.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcastxfi.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008255; classtype:social-engineering; sid:6008255; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (laaroma.store.middleeastfragrances.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"laaroma.store.middleeastfragrances.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008256; classtype:social-engineering; sid:6008256; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-login-ig.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-login-ig.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008257; classtype:social-engineering; sid:6008257; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (logincomcastt.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"logincomcastt.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008258; classtype:social-engineering; sid:6008258; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp15ct-turqel-biz-zunax-kavro.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp15ct-turqel-biz-zunax-kavro.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008259; classtype:social-engineering; sid:6008259; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rroblox.wf/share?code=96041925588136299153057679665385&type=Profile&source=ProfileShare&gameid=2753915549)"; flow:established,to_server; http.uri; content:"/share?code=96041925588136299153057679665385&type=Profile&source=ProfileShare&gameid=2753915549"; startswith; fast_pattern; http.host; content:"rroblox.wf"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008260; classtype:social-engineering; sid:6008260; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.rroblox.wf/users/1179291790/profile)"; flow:established,to_server; http.uri; content:"/users/1179291790/profile"; startswith; fast_pattern; http.host; content:"www.rroblox.wf"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008261; classtype:social-engineering; sid:6008261; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zoltar-frenko-d5b740-ggrht-bn2406pke.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zoltar-frenko-d5b740-ggrht-bn2406pke.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008262; classtype:social-engineering; sid:6008262; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (25f54b2b-58b1-45c3-bd24-0ee1c8e9cfd0.selstorage.ru/524/52462818748/bcb/52462818748_bcbc735fc613264a17e73dd987c14ae8.jpg)"; flow:established,to_server; http.uri; content:"/524/52462818748/bcb/52462818748_bcbc735fc613264a17e73dd987c14ae8.jpg"; startswith; fast_pattern; http.host; content:"25f54b2b-58b1-45c3-bd24-0ee1c8e9cfd0.selstorage.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008263; classtype:social-engineering; sid:6008263; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-freelogin.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-freelogin.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008264; classtype:social-engineering; sid:6008264; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebooklivepage.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebooklivepage.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008265; classtype:social-engineering; sid:6008265; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pichincha--credit004.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pichincha--credit004.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008266; classtype:social-engineering; sid:6008266; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-mjemyma8d.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-mjemyma8d.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008267; classtype:social-engineering; sid:6008267; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (addons-moz-illa-org.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"addons-moz-illa-org.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008268; classtype:social-engineering; sid:6008268; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sitio6.apps.viupay.live/sign_on.php?error=)"; flow:established,to_server; http.uri; content:"/sign_on.php?error="; startswith; fast_pattern; http.host; content:"sitio6.apps.viupay.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008269; classtype:social-engineering; sid:6008269; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (middleeastfragrances.cyou.middleeastfragrances.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"middleeastfragrances.cyou.middleeastfragrances.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008270; classtype:social-engineering; sid:6008270; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfmailconnect.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfmailconnect.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008271; classtype:social-engineering; sid:6008271; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (grandhoreb.com/adobe-secure/installer/)"; flow:established,to_server; http.uri; content:"/adobe-secure/installer/"; startswith; fast_pattern; http.host; content:"grandhoreb.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008272; classtype:social-engineering; sid:6008272; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.site-mjemyma8d.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.site-mjemyma8d.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008273; classtype:social-engineering; sid:6008273; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-zkmjek3ad.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-zkmjek3ad.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008274; classtype:social-engineering; sid:6008274; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ghein4.systeme.io/spectrum)"; flow:established,to_server; http.uri; content:"/spectrum"; startswith; fast_pattern; http.host; content:"ghein4.systeme.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008275; classtype:social-engineering; sid:6008275; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rapid-oak-629.injaltransferwillgonabaid.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rapid-oak-629.injaltransferwillgonabaid.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008276; classtype:social-engineering; sid:6008276; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vvrl.cc/a330k8)"; flow:established,to_server; http.uri; content:"/a330k8"; startswith; fast_pattern; http.host; content:"vvrl.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008277; classtype:social-engineering; sid:6008277; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nlink.at/www_roblox_com_users_7324139977_profile)"; flow:established,to_server; http.uri; content:"/www_roblox_com_users_7324139977_profile"; startswith; fast_pattern; http.host; content:"nlink.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008278; classtype:social-engineering; sid:6008278; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creditos-pichincha-miles--pichincmiles.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"creditos-pichincha-miles--pichincmiles.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008279; classtype:social-engineering; sid:6008279; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appeid.rcloud.me.farmbase.co.tz/DUVzTTavlOw/?redirection=login)"; flow:established,to_server; http.uri; content:"/DUVzTTavlOw/?redirection=login"; startswith; fast_pattern; http.host; content:"appeid.rcloud.me.farmbase.co.tz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008280; classtype:social-engineering; sid:6008280; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebooksignuplogin.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebooksignuplogin.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008281; classtype:social-engineering; sid:6008281; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xlbdw5avstr-ycgfnmja-8d9e2f-xlq20c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xlbdw5avstr-ycgfnmja-8d9e2f-xlq20c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008282; classtype:social-engineering; sid:6008282; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.imtoken-biz.org.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.imtoken-biz.org.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008283; classtype:social-engineering; sid:6008283; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seasharetip72-ed101816bbdf.herokuapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"seasharetip72-ed101816bbdf.herokuapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008284; classtype:social-engineering; sid:6008284; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagramfollowersfake.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagramfollowersfake.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008285; classtype:social-engineering; sid:6008285; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hnhpvt.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hnhpvt.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008286; classtype:social-engineering; sid:6008286; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15370.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15370.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008287; classtype:social-engineering; sid:6008287; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (raiffeisen-five.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"raiffeisen-five.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008288; classtype:social-engineering; sid:6008288; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (increasefollowersforinstagram.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"increasefollowersforinstagram.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008289; classtype:social-engineering; sid:6008289; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-vjgfidl3x.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-vjgfidl3x.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008290; classtype:social-engineering; sid:6008290; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fathimaminhazain.github.io/clone-landingPage/)"; flow:established,to_server; http.uri; content:"/clone-landingPage/"; startswith; fast_pattern; http.host; content:"fathimaminhazain.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008291; classtype:social-engineering; sid:6008291; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (asvxzxzwsvg.eu.cc/es)"; flow:established,to_server; http.uri; content:"/es"; startswith; fast_pattern; http.host; content:"asvxzxzwsvg.eu.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008292; classtype:social-engineering; sid:6008292; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.c0nectt.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.c0nectt.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008293; classtype:social-engineering; sid:6008293; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-jn6w55wca.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-jn6w55wca.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008294; classtype:social-engineering; sid:6008294; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-2-0-dun.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-2-0-dun.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008295; classtype:social-engineering; sid:6008295; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp13ct-kersik-biz-fransor-hazvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp13ct-kersik-biz-fransor-hazvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008296; classtype:social-engineering; sid:6008296; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (personal-finance-egy.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"personal-finance-egy.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008297; classtype:social-engineering; sid:6008297; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (laaroma.online.middleeastfragrances.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"laaroma.online.middleeastfragrances.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008298; classtype:social-engineering; sid:6008298; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.pl-013337.icu/oferta/skuter-wodny-nie-uzywany-3-lata/58304)"; flow:established,to_server; http.uri; content:"/oferta/skuter-wodny-nie-uzywany-3-lata/58304"; startswith; fast_pattern; http.host; content:"allegrolokalnie.pl-013337.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008299; classtype:social-engineering; sid:6008299; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (121jio.senes.at/stakings/?b=YTo0OntzOjU6ImxhYmVsIjtzOjA6IiI7czozOiJ1c3IiO2k6MTY0NDtzOjQ6Im5vcGQiO3M6MTM6InJzcy5zYXlsZXIuYXQiO3M6MToibyI7aToxMTM2O30=)"; flow:established,to_server; http.uri; content:"/stakings/?b=YTo0OntzOjU6ImxhYmVsIjtzOjA6IiI7czozOiJ1c3IiO2k6MTY0NDtzOjQ6Im5vcGQiO3M6MTM6InJzcy5zYXlsZXIuYXQiO3M6MToibyI7aToxMTM2O30="; startswith; fast_pattern; http.host; content:"121jio.senes.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008300; classtype:social-engineering; sid:6008300; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (generous-acknowledgment-515790.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"generous-acknowledgment-515790.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008301; classtype:social-engineering; sid:6008301; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagramlikescheap.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagramlikescheap.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008302; classtype:social-engineering; sid:6008302; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login-soporte.iceiy.com/?i=1)"; flow:established,to_server; http.uri; content:"/?i=1"; startswith; fast_pattern; http.host; content:"login-soporte.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008303; classtype:social-engineering; sid:6008303; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfiniity-update.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfiniity-update.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008304; classtype:social-engineering; sid:6008304; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bright-rectangle-577387.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bright-rectangle-577387.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008305; classtype:social-engineering; sid:6008305; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cancelcardiffbahora.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cancelcardiffbahora.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008306; classtype:social-engineering; sid:6008306; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17564.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17564.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008307; classtype:social-engineering; sid:6008307; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (just-aquamarine-5n8epwhf.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"just-aquamarine-5n8epwhf.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008308; classtype:social-engineering; sid:6008308; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rblx3.github.io/rblx/)"; flow:established,to_server; http.uri; content:"/rblx/"; startswith; fast_pattern; http.host; content:"rblx3.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008309; classtype:social-engineering; sid:6008309; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dinesh12966.github.io/phishing-site/)"; flow:established,to_server; http.uri; content:"/phishing-site/"; startswith; fast_pattern; http.host; content:"dinesh12966.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008310; classtype:social-engineering; sid:6008310; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox-lo.github.io/roblox-log/)"; flow:established,to_server; http.uri; content:"/roblox-log/"; startswith; fast_pattern; http.host; content:"roblox-lo.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008311; classtype:social-engineering; sid:6008311; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arubaservizispid.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"arubaservizispid.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008312; classtype:social-engineering; sid:6008312; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.16878.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.16878.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008313; classtype:social-engineering; sid:6008313; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox.com.pt/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"roblox.com.pt"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008314; classtype:social-engineering; sid:6008314; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p01--ar24docsecurity--qmjhcscz5dnb.code.run/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p01--ar24docsecurity--qmjhcscz5dnb.code.run"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008315; classtype:social-engineering; sid:6008315; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creditos-pichicha--rondonpokemon0.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"creditos-pichicha--rondonpokemon0.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008316; classtype:social-engineering; sid:6008316; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ahhhh.pe.kr/zb41/data/1057168297/)"; flow:established,to_server; http.uri; content:"/zb41/data/1057168297/"; startswith; fast_pattern; http.host; content:"www.ahhhh.pe.kr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008317; classtype:social-engineering; sid:6008317; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfintiylogin.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfintiylogin.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008318; classtype:social-engineering; sid:6008318; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamaskwallett.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metamaskwallett.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008319; classtype:social-engineering; sid:6008319; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (erfan82erfan.github.io/instagram_login/)"; flow:established,to_server; http.uri; content:"/instagram_login/"; startswith; fast_pattern; http.host; content:"erfan82erfan.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008320; classtype:social-engineering; sid:6008320; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (polite-bavarois-37ef3b.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"polite-bavarois-37ef3b.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008321; classtype:social-engineering; sid:6008321; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (naybabuta.github.io/nay-tify/)"; flow:established,to_server; http.uri; content:"/nay-tify/"; startswith; fast_pattern; http.host; content:"naybabuta.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008322; classtype:social-engineering; sid:6008322; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-ah3d6z3ed.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-ah3d6z3ed.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008323; classtype:social-engineering; sid:6008323; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (homeledger.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"homeledger.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008324; classtype:social-engineering; sid:6008324; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7ro-wwv-ftvh-2np810-9v8crh.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7ro-wwv-ftvh-2np810-9v8crh.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008325; classtype:social-engineering; sid:6008325; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-ibvl0r5pu.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-ibvl0r5pu.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008326; classtype:social-engineering; sid:6008326; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arshad-deshmukh.github.io/Amazon-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-Clone"; startswith; fast_pattern; http.host; content:"arshad-deshmukh.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008327; classtype:social-engineering; sid:6008327; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (misilabario.cl/dhl/dhl/)"; flow:established,to_server; http.uri; content:"/dhl/dhl/"; startswith; fast_pattern; http.host; content:"misilabario.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008328; classtype:social-engineering; sid:6008328; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcasstweb.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcasstweb.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008329; classtype:social-engineering; sid:6008329; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.g14w.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.g14w.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008330; classtype:social-engineering; sid:6008330; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vismayamanoj029.github.io/amazonclone)"; flow:established,to_server; http.uri; content:"/amazonclone"; startswith; fast_pattern; http.host; content:"vismayamanoj029.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008331; classtype:social-engineering; sid:6008331; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (middleeastfragrances.site.middleeastfragrances.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"middleeastfragrances.site.middleeastfragrances.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008332; classtype:social-engineering; sid:6008332; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rechnungdirekt24.com/public/de.html)"; flow:established,to_server; http.uri; content:"/public/de.html"; startswith; fast_pattern; http.host; content:"rechnungdirekt24.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008333; classtype:social-engineering; sid:6008333; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebookloginsignub.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebookloginsignub.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008334; classtype:social-engineering; sid:6008334; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-wallets-auth-edges.vercel.app/ledger%20form/verify.html)"; flow:established,to_server; http.uri; content:"/ledger%20form/verify.html"; startswith; fast_pattern; http.host; content:"ledger-wallets-auth-edges.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008335; classtype:social-engineering; sid:6008335; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (locketheart.org/proj/oneapp)"; flow:established,to_server; http.uri; content:"/proj/oneapp"; startswith; fast_pattern; http.host; content:"locketheart.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008336; classtype:social-engineering; sid:6008336; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (panhalkarpratiksha7-jpg.github.io/Amazon_clone/)"; flow:established,to_server; http.uri; content:"/Amazon_clone/"; startswith; fast_pattern; http.host; content:"panhalkarpratiksha7-jpg.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008337; classtype:social-engineering; sid:6008337; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ycgfn88lkwg-vnzktplx-4a5d9e-ycg17w.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ycgfn88lkwg-vnzktplx-4a5d9e-ycg17w.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008338; classtype:social-engineering; sid:6008338; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sock-zizifn-kr.ludeaphd.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sock-zizifn-kr.ludeaphd.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008339; classtype:social-engineering; sid:6008339; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (powercleantank.com.au/secure/sorce/wmailt.html)"; flow:established,to_server; http.uri; content:"/secure/sorce/wmailt.html"; startswith; fast_pattern; http.host; content:"powercleantank.com.au"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008340; classtype:social-engineering; sid:6008340; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cancelacardiffseguro360.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cancelacardiffseguro360.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008341; classtype:social-engineering; sid:6008341; rev:1; metadata: signature_severity Major, created_et 2026_08_10;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (omayshamart02.com/808/ss7up/ss7up/edg/?info=google@google.com)"; flow:established,to_server; http.uri; content:"/808/ss7up/ss7up/edg/?info=google@google.com"; startswith; fast_pattern; http.host; content:"omayshamart02.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008342; classtype:social-engineering; sid:6008342; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (71a71d.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"71a71d.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008343; classtype:social-engineering; sid:6008343; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (orange-nl.comparecycle.com/nl)"; flow:established,to_server; http.uri; content:"/nl"; startswith; fast_pattern; http.host; content:"orange-nl.comparecycle.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008344; classtype:social-engineering; sid:6008344; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e94ad2.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e94ad2.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008345; classtype:social-engineering; sid:6008345; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fabrcicio14.github.io/produbanco/login.html)"; flow:established,to_server; http.uri; content:"/produbanco/login.html"; startswith; fast_pattern; http.host; content:"fabrcicio14.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008346; classtype:social-engineering; sid:6008346; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (malikauppala.github.io/E-Commerce-Website)"; flow:established,to_server; http.uri; content:"/E-Commerce-Website"; startswith; fast_pattern; http.host; content:"malikauppala.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008347; classtype:social-engineering; sid:6008347; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (claimed-gifts.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"claimed-gifts.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008348; classtype:social-engineering; sid:6008348; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (premierepulse.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"premierepulse.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008349; classtype:social-engineering; sid:6008349; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.photosalert-com.us/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.photosalert-com.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008350; classtype:social-engineering; sid:6008350; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bui809319-rgb.github.io/www.Roblox-vng.login/)"; flow:established,to_server; http.uri; content:"/www.Roblox-vng.login/"; startswith; fast_pattern; http.host; content:"bui809319-rgb.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008351; classtype:social-engineering; sid:6008351; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-ledgr-start.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"account-ledgr-start.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008352; classtype:social-engineering; sid:6008352; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (addqo.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"addqo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008353; classtype:social-engineering; sid:6008353; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgerlive-dowload.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgerlive-dowload.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008354; classtype:social-engineering; sid:6008354; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (solicitudespersonas360bc.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"solicitudespersonas360bc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008355; classtype:social-engineering; sid:6008355; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fellroriana.mx/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fellroriana.mx"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008356; classtype:social-engineering; sid:6008356; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cancelcardiffbahora.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cancelcardiffbahora.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008357; classtype:social-engineering; sid:6008357; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhartrajsaini4144-stack.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"bhartrajsaini4144-stack.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008358; classtype:social-engineering; sid:6008358; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (approved-doc.sharpbranding.de/SxS9T/index.php)"; flow:established,to_server; http.uri; content:"/SxS9T/index.php"; startswith; fast_pattern; http.host; content:"approved-doc.sharpbranding.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008359; classtype:social-engineering; sid:6008359; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mvrql5dplix-ybfchyhy-3c4d9e-kx177a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mvrql5dplix-ybfchyhy-3c4d9e-kx177a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008360; classtype:social-engineering; sid:6008360; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeesellerjob.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopeesellerjob.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008361; classtype:social-engineering; sid:6008361; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhdpulseacut0808.yzz.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bhdpulseacut0808.yzz.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008362; classtype:social-engineering; sid:6008362; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail1.aselsan.com.tr/owa/auth/logon.aspx)"; flow:established,to_server; http.uri; content:"/owa/auth/logon.aspx"; startswith; fast_pattern; http.host; content:"mail1.aselsan.com.tr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008363; classtype:social-engineering; sid:6008363; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jvr-portal.metaprofiling.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jvr-portal.metaprofiling.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008364; classtype:social-engineering; sid:6008364; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (626960.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"626960.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008365; classtype:social-engineering; sid:6008365; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blockbook-doge.sspwallet.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"blockbook-doge.sspwallet.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008366; classtype:social-engineering; sid:6008366; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-account-desk.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-account-desk.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008367; classtype:social-engineering; sid:6008367; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flnd-location.us/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"flnd-location.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008368; classtype:social-engineering; sid:6008368; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (available-ledger-hardware-wallet.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"available-ledger-hardware-wallet.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008369; classtype:social-engineering; sid:6008369; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.taskpartners.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.taskpartners.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008370; classtype:social-engineering; sid:6008370; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.vartellondigital.life/resgatar/)"; flow:established,to_server; http.uri; content:"/resgatar/"; startswith; fast_pattern; http.host; content:"www.vartellondigital.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008371; classtype:social-engineering; sid:6008371; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lphone-localizable.life/FL26)"; flow:established,to_server; http.uri; content:"/FL26"; startswith; fast_pattern; http.host; content:"lphone-localizable.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008372; classtype:social-engineering; sid:6008372; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dev-docusign-net-signing-document.pantheonsite.io/?email=valor9@177290b2aaf56e788a7e9c66c16ee5e50c5e.com&company=FREEPORT%20FIRE/EMS)"; flow:established,to_server; http.uri; content:"/?email=valor9@177290b2aaf56e788a7e9c66c16ee5e50c5e.com&company=FREEPORT%20FIRE/EMS"; startswith; fast_pattern; http.host; content:"dev-docusign-net-signing-document.pantheonsite.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008373; classtype:social-engineering; sid:6008373; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lnglrl.com/ethhangqing/6777.html)"; flow:established,to_server; http.uri; content:"/ethhangqing/6777.html"; startswith; fast_pattern; http.host; content:"lnglrl.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008374; classtype:social-engineering; sid:6008374; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portamtseg-socialgob.click/es)"; flow:established,to_server; http.uri; content:"/es"; startswith; fast_pattern; http.host; content:"portamtseg-socialgob.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008375; classtype:social-engineering; sid:6008375; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (location-pings.info/help?TbF)"; flow:established,to_server; http.uri; content:"/help?TbF"; startswith; fast_pattern; http.host; content:"location-pings.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008376; classtype:social-engineering; sid:6008376; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (promt-dpem7p8ov9s7.edgeone.dev/fitsal.html?eta=a.b@c)"; flow:established,to_server; http.uri; content:"/fitsal.html?eta=a.b@c"; startswith; fast_pattern; http.host; content:"promt-dpem7p8ov9s7.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008377; classtype:social-engineering; sid:6008377; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (326948.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"326948.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008378; classtype:social-engineering; sid:6008378; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookloginpage1.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebookloginpage1.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008379; classtype:social-engineering; sid:6008379; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sms-ghost.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sms-ghost.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008380; classtype:social-engineering; sid:6008380; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitycomcastsecurity.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitycomcastsecurity.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008381; classtype:social-engineering; sid:6008381; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nextwhatsapp.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nextwhatsapp.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008382; classtype:social-engineering; sid:6008382; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloudfind.live/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"icloudfind.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008383; classtype:social-engineering; sid:6008383; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.raiffeisen-five.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.raiffeisen-five.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008384; classtype:social-engineering; sid:6008384; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (revanthchowdaryarekatla.github.io/MyShop/)"; flow:established,to_server; http.uri; content:"/MyShop/"; startswith; fast_pattern; http.host; content:"revanthchowdaryarekatla.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008385; classtype:social-engineering; sid:6008385; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2d7dc0.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2d7dc0.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008386; classtype:social-engineering; sid:6008386; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bnpp.test.verifcv.com/connexion)"; flow:established,to_server; http.uri; content:"/connexion"; startswith; fast_pattern; http.host; content:"bnpp.test.verifcv.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008387; classtype:social-engineering; sid:6008387; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0c3cfe.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0c3cfe.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008388; classtype:social-engineering; sid:6008388; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (isamrabbani.github.io/Web-Project)"; flow:established,to_server; http.uri; content:"/Web-Project"; startswith; fast_pattern; http.host; content:"isamrabbani.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008389; classtype:social-engineering; sid:6008389; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-mguv8qsqe.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-mguv8qsqe.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008390; classtype:social-engineering; sid:6008390; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e720639b-3fe0-4f60-9dac-c851a51c27a4-00-1wfhaq8e2y5kg.worf.replit.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e720639b-3fe0-4f60-9dac-c851a51c27a4-00-1wfhaq8e2y5kg.worf.replit.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008391; classtype:social-engineering; sid:6008391; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cloud-ledgre-liv.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cloud-ledgre-liv.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008392; classtype:social-engineering; sid:6008392; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (linkt.customerservicef.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"linkt.customerservicef.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008393; classtype:social-engineering; sid:6008393; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.signin-icloud.sa.com/FL26)"; flow:established,to_server; http.uri; content:"/FL26"; startswith; fast_pattern; http.host; content:"mail.signin-icloud.sa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008394; classtype:social-engineering; sid:6008394; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (akashghoredev-26.github.io/Netflix-India-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-India-Clone/"; startswith; fast_pattern; http.host; content:"akashghoredev-26.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008395; classtype:social-engineering; sid:6008395; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gs.opdhxe.com/peter/ScXeQ06.htm?key=8f4K9mQ2Xx7)"; flow:established,to_server; http.uri; content:"/peter/ScXeQ06.htm?key=8f4K9mQ2Xx7"; startswith; fast_pattern; http.host; content:"gs.opdhxe.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008396; classtype:social-engineering; sid:6008396; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7f001d.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7f001d.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008397; classtype:social-engineering; sid:6008397; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.norvathglobal.life/confirmar-saque/)"; flow:established,to_server; http.uri; content:"/confirmar-saque/"; startswith; fast_pattern; http.host; content:"www.norvathglobal.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008398; classtype:social-engineering; sid:6008398; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aniel1921.github.io/Netflix-Clone)"; flow:established,to_server; http.uri; content:"/Netflix-Clone"; startswith; fast_pattern; http.host; content:"aniel1921.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008399; classtype:social-engineering; sid:6008399; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bold-app-ledgerstart.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bold-app-ledgerstart.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008400; classtype:social-engineering; sid:6008400; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (signin-icloud.sa.com/FL26)"; flow:established,to_server; http.uri; content:"/FL26"; startswith; fast_pattern; http.host; content:"signin-icloud.sa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008401; classtype:social-engineering; sid:6008401; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (com-myjahibi-visconowengroup.4everland.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"com-myjahibi-visconowengroup.4everland.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008402; classtype:social-engineering; sid:6008402; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accessotkkdigital.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"accessotkkdigital.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008403; classtype:social-engineering; sid:6008403; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (siyahklasor.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"siyahklasor.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008404; classtype:social-engineering; sid:6008404; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mobile-xfinity.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mobile-xfinity.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008405; classtype:social-engineering; sid:6008405; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (otkdigitalacess.vercel.app/confirmar-saque/)"; flow:established,to_server; http.uri; content:"/confirmar-saque/"; startswith; fast_pattern; http.host; content:"otkdigitalacess.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008406; classtype:social-engineering; sid:6008406; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (taskpartners.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"taskpartners.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008407; classtype:social-engineering; sid:6008407; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.flnd-location.us/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.flnd-location.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008408; classtype:social-engineering; sid:6008408; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.17560.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.17560.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008409; classtype:social-engineering; sid:6008409; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vihaanrawat.github.io/netflix-ui-clone/)"; flow:established,to_server; http.uri; content:"/netflix-ui-clone/"; startswith; fast_pattern; http.host; content:"vihaanrawat.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008410; classtype:social-engineering; sid:6008410; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hovqr.me/e31f921a/)"; flow:established,to_server; http.uri; content:"/e31f921a/"; startswith; fast_pattern; http.host; content:"hovqr.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008411; classtype:social-engineering; sid:6008411; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sachinkumar0407.github.io/NETFLIX-CLONE)"; flow:established,to_server; http.uri; content:"/NETFLIX-CLONE"; startswith; fast_pattern; http.host; content:"sachinkumar0407.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008412; classtype:social-engineering; sid:6008412; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tjvgyph.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tjvgyph.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008413; classtype:social-engineering; sid:6008413; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rivere.s3-website-us-west-1.amazonaws.com/?uid=abuse@namecheap.com)"; flow:established,to_server; http.uri; content:"/?uid=abuse@namecheap.com"; startswith; fast_pattern; http.host; content:"rivere.s3-website-us-west-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008414; classtype:social-engineering; sid:6008414; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aum0718.github.io/Netflix_clone/)"; flow:established,to_server; http.uri; content:"/Netflix_clone/"; startswith; fast_pattern; http.host; content:"aum0718.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008415; classtype:social-engineering; sid:6008415; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecuardorcredit--ecuadorcred.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ecuardorcredit--ecuadorcred.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008416; classtype:social-engineering; sid:6008416; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (83f7ab.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"83f7ab.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008417; classtype:social-engineering; sid:6008417; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp13ct-fransik-biz-hazmor-keldor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp13ct-fransik-biz-hazmor-keldor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008418; classtype:social-engineering; sid:6008418; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tienda.airis.es/js/de/)"; flow:established,to_server; http.uri; content:"/js/de/"; startswith; fast_pattern; http.host; content:"tienda.airis.es"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008419; classtype:social-engineering; sid:6008419; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yuueuueyyryr.s3.us-west-1.amazonaws.com/deed.html)"; flow:established,to_server; http.uri; content:"/deed.html"; startswith; fast_pattern; http.host; content:"yuueuueyyryr.s3.us-west-1.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008420; classtype:social-engineering; sid:6008420; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.accessotkkdigital.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.accessotkkdigital.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008421; classtype:social-engineering; sid:6008421; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15372.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15372.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008422; classtype:social-engineering; sid:6008422; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fb-faceboook.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.fb-faceboook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008423; classtype:social-engineering; sid:6008423; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.duishalik.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.duishalik.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008424; classtype:social-engineering; sid:6008424; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (buscar-lphone.life/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"buscar-lphone.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008425; classtype:social-engineering; sid:6008425; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsappwebred.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"whatsappwebred.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008426; classtype:social-engineering; sid:6008426; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ihttps-www-roblox.co/login?returnUrl=16687975)"; flow:established,to_server; http.uri; content:"/login?returnUrl=16687975"; startswith; fast_pattern; http.host; content:"ihttps-www-roblox.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008427; classtype:social-engineering; sid:6008427; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1acc0c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1acc0c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008428; classtype:social-engineering; sid:6008428; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (devsanmaden.com/Login/?token=7fa93775b6f898323af3ead3a1976cd6f2f0b88b55c52efbc5d8677149fcf31514efc0112f971574f771cb0afb543ddbfaa6d3c51840269efabd0beb57e637a3)"; flow:established,to_server; http.uri; content:"/Login/?token=7fa93775b6f898323af3ead3a1976cd6f2f0b88b55c52efbc5d8677149fcf31514efc0112f971574f771cb0afb543ddbfaa6d3c51840269efabd0beb57e637a3"; startswith; fast_pattern; http.host; content:"devsanmaden.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008429; classtype:social-engineering; sid:6008429; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reqtube.com/uiehaopm/)"; flow:established,to_server; http.uri; content:"/uiehaopm/"; startswith; fast_pattern; http.host; content:"reqtube.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008430; classtype:social-engineering; sid:6008430; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (findmaps.us/help?mCR)"; flow:established,to_server; http.uri; content:"/help?mCR"; startswith; fast_pattern; http.host; content:"findmaps.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008431; classtype:social-engineering; sid:6008431; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blushing-mission-518321.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"blushing-mission-518321.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008432; classtype:social-engineering; sid:6008432; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (venixfit.com/tpsuniversity/tpsuniversity.html)"; flow:established,to_server; http.uri; content:"/tpsuniversity/tpsuniversity.html"; startswith; fast_pattern; http.host; content:"venixfit.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008433; classtype:social-engineering; sid:6008433; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (querrymambatik.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"querrymambatik.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008434; classtype:social-engineering; sid:6008434; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flndme-device.info/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"flndme-device.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008435; classtype:social-engineering; sid:6008435; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apps-us-desktop-ledgre.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"apps-us-desktop-ledgre.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008436; classtype:social-engineering; sid:6008436; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeeid547.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopeeid547.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008437; classtype:social-engineering; sid:6008437; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.thisfreeinstagramfollowers.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.thisfreeinstagramfollowers.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008438; classtype:social-engineering; sid:6008438; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.icloudfind.live/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.icloudfind.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008439; classtype:social-engineering; sid:6008439; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-metamuskwalet.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"help-metamuskwalet.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008440; classtype:social-engineering; sid:6008440; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (asamee.com/ap/izkr8m3wb6oeav12n9ltu7xf0sdhgq4jc5ypxtk65gpr9juay1ih48ow3lc0qfs7bd2ezvnm)"; flow:established,to_server; http.uri; content:"/ap/izkr8m3wb6oeav12n9ltu7xf0sdhgq4jc5ypxtk65gpr9juay1ih48ow3lc0qfs7bd2ezvnm"; startswith; fast_pattern; http.host; content:"asamee.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008441; classtype:social-engineering; sid:6008441; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.navigator.follow.solutions.forward.ch.matrassenstock.be/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.navigator.follow.solutions.forward.ch.matrassenstock.be"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008442; classtype:social-engineering; sid:6008442; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creditopichincha-2026--creditoenline3.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"creditopichincha-2026--creditoenline3.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008443; classtype:social-engineering; sid:6008443; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcastt1eyr.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcastt1eyr.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008444; classtype:social-engineering; sid:6008444; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dana-id.websitecare1.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dana-id.websitecare1.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008445; classtype:social-engineering; sid:6008445; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp15ct-nulqor-biz-zavren-telvi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp15ct-nulqor-biz-zavren-telvi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008446; classtype:social-engineering; sid:6008446; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.acessoregularizacaocnh.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.acessoregularizacaocnh.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008447; classtype:social-engineering; sid:6008447; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebookmail-facebook.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.facebookmail-facebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008448; classtype:social-engineering; sid:6008448; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.lphone-localizable.life/FL26)"; flow:established,to_server; http.uri; content:"/FL26"; startswith; fast_pattern; http.host; content:"mail.lphone-localizable.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008449; classtype:social-engineering; sid:6008449; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (assessment-portal.metaprofiling.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"assessment-portal.metaprofiling.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008450; classtype:social-engineering; sid:6008450; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (695615.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"695615.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008451; classtype:social-engineering; sid:6008451; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-portal-email.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-portal-email.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008452; classtype:social-engineering; sid:6008452; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (69ad32.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"69ad32.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008453; classtype:social-engineering; sid:6008453; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (net16ct-kav-biz-nori-telu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"net16ct-kav-biz-nori-telu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008454; classtype:social-engineering; sid:6008454; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ottkdigital.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ottkdigital.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008455; classtype:social-engineering; sid:6008455; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.money-guard.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.money-guard.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008456; classtype:social-engineering; sid:6008456; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mailcomcastnet.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mailcomcastnet.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008457; classtype:social-engineering; sid:6008457; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.www-mapsflndmy.info/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"www.www-mapsflndmy.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008458; classtype:social-engineering; sid:6008458; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.h5-app.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.h5-app.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008459; classtype:social-engineering; sid:6008459; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meinpaypalnc-ch.peropack.be/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"meinpaypalnc-ch.peropack.be"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008460; classtype:social-engineering; sid:6008460; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ajustedeperfil.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"ajustedeperfil.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008461; classtype:social-engineering; sid:6008461; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.northstardigital.life/resgatar/)"; flow:established,to_server; http.uri; content:"/resgatar/"; startswith; fast_pattern; http.host; content:"www.northstardigital.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008462; classtype:social-engineering; sid:6008462; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tarjetasdecredito-bcolombia.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tarjetasdecredito-bcolombia.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008463; classtype:social-engineering; sid:6008463; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zhantuzs.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zhantuzs.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008464; classtype:social-engineering; sid:6008464; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lntermatico.virtual-ecuador.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lntermatico.virtual-ecuador.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008465; classtype:social-engineering; sid:6008465; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ottkdigital.vercel.app/confirmar-saque/)"; flow:established,to_server; http.uri; content:"/confirmar-saque/"; startswith; fast_pattern; http.host; content:"ottkdigital.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008466; classtype:social-engineering; sid:6008466; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blockbook-ltc.sspwallet.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"blockbook-ltc.sspwallet.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008467; classtype:social-engineering; sid:6008467; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.whatsappwebred.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.whatsappwebred.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008468; classtype:social-engineering; sid:6008468; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tkacess.vercel.app/confirmar-saque/)"; flow:established,to_server; http.uri; content:"/confirmar-saque/"; startswith; fast_pattern; http.host; content:"tkacess.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008469; classtype:social-engineering; sid:6008469; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9000-firebase-hv-1781765441869.cluster-cd3bsnf6r5bemwki2bxljme5as.cloudworkstations.dev/?monospaceUid=102703)"; flow:established,to_server; http.uri; content:"/?monospaceUid=102703"; startswith; fast_pattern; http.host; content:"9000-firebase-hv-1781765441869.cluster-cd3bsnf6r5bemwki2bxljme5as.cloudworkstations.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008470; classtype:social-engineering; sid:6008470; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.buscar-lphone.life/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.buscar-lphone.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008471; classtype:social-engineering; sid:6008471; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lastrofinanceiroalpha.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"lastrofinanceiroalpha.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008472; classtype:social-engineering; sid:6008472; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.lphone-localizable.top/FL26)"; flow:established,to_server; http.uri; content:"/FL26"; startswith; fast_pattern; http.host; content:"mail.lphone-localizable.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008473; classtype:social-engineering; sid:6008473; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (black-card-472507.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"black-card-472507.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008474; classtype:social-engineering; sid:6008474; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mooshimooshe.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mooshimooshe.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008475; classtype:social-engineering; sid:6008475; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-pay.pal-ch.com/?gi=666d13e4013e)"; flow:established,to_server; http.uri; content:"/?gi=666d13e4013e"; startswith; fast_pattern; http.host; content:"my-pay.pal-ch.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008476; classtype:social-engineering; sid:6008476; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.phone-locatesvvblm.us/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.phone-locatesvvblm.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008477; classtype:social-engineering; sid:6008477; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mm2-private-server.github.io/mm2-private-server/)"; flow:established,to_server; http.uri; content:"/mm2-private-server/"; startswith; fast_pattern; http.host; content:"mm2-private-server.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008478; classtype:social-engineering; sid:6008478; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.inf-cloud.us/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.inf-cloud.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008479; classtype:social-engineering; sid:6008479; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.it-supportdesk.com/signin?t=eyJhbGciOiJIUzI1NiJ9.eyJ0cmFja2luZ190b2tlbiI6IjJkNWFhODRiLWIwNWYtNDU3My04MWIxLWZkODJlODBlMjZkMSIsImNlbGwiOiJodHRwczovL3FnYmZ3b3c2MGYuZXhlY3V0ZS1hcGkudXMtd2VzdC0yLmFtYXpvbmF3cy5jb20vcHJvZC9hcGkvcGhpc2hpbmdjYW1wYWlnbiIsImNhbXBhaWduX3Rva2VuIjoiZGM5OWUzNDktMzQ2NC00ZDdiLTkxM2QtNDY1NDFhOGRhMjc5IiwidGVzdF90b2tlbiI6ZmFsc2UsImV4dGVybmFsX3RyYWluaW5nIjpmYWxzZSwiZGlyZWN0X2RlbGl2ZXJ5Ijp0cnVlLCJpYXQiOjE3ODYyMjIzMjYsImlzcyI6Imh0dHBzOi8vYXBwLnBoaXNodGhyZWF0LmNvbSIsImV4cCI6MTc5Mzk5ODMyNn0.wzHHY_-E8emzpmEyY5NKtAQqPaulBB_vhrF8lo6B49g)"; flow:established,to_server; http.uri; content:"/signin?t=eyJhbGciOiJIUzI1NiJ9.eyJ0cmFja2luZ190b2tlbiI6IjJkNWFhODRiLWIwNWYtNDU3My04MWIxLWZkODJlODBlMjZkMSIsImNlbGwiOiJodHRwczovL3FnYmZ3b3c2MGYuZXhlY3V0ZS1hcGkudXMtd2VzdC0yLmFtYXpvbmF3cy5jb20vcHJvZC9hcGkvcGhpc2hpbmdjYW1wYWlnbiIsImNhbXBhaWduX3Rva2VuIjoiZGM5OWUzNDktMzQ2NC00ZDdiLTkxM2QtNDY1NDFhOGRhMjc5IiwidGVzdF90b2tlbiI6ZmFsc2UsImV4dGVybmFsX3RyYWluaW5nIjpmYWxzZSwiZGlyZWN0X2RlbGl2ZXJ5Ijp0cnVlLCJpYXQiOjE3ODYyMjIzMjYsImlzcyI6Imh0dHBzOi8vYXBwLnBoaXNodGhyZWF0LmNvbSIsImV4cCI6MTc5Mzk5ODMyNn0.wzHHY_-E8emzpmEyY5NKtAQqPaulBB_vhrF8lo6B49g"; startswith; fast_pattern; http.host; content:"www.it-supportdesk.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008480; classtype:social-engineering; sid:6008480; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-2022.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-2022.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008481; classtype:social-engineering; sid:6008481; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (326952.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"326952.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008482; classtype:social-engineering; sid:6008482; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1d6c55.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1d6c55.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008483; classtype:social-engineering; sid:6008483; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (transcript.katanareviewpolicy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"transcript.katanareviewpolicy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008484; classtype:social-engineering; sid:6008484; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-2022.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-2022.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008485; classtype:social-engineering; sid:6008485; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inf-cloud.us/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"inf-cloud.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008486; classtype:social-engineering; sid:6008486; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.y36l.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.y36l.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008487; classtype:social-engineering; sid:6008487; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dwadfergs.com/checkout.html)"; flow:established,to_server; http.uri; content:"/checkout.html"; startswith; fast_pattern; http.host; content:"dwadfergs.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008488; classtype:social-engineering; sid:6008488; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gbkilt.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.gbkilt.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008489; classtype:social-engineering; sid:6008489; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.www-mapsflndmy.info/FL26/)"; flow:established,to_server; http.uri; content:"/FL26/"; startswith; fast_pattern; http.host; content:"mail.www-mapsflndmy.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008490; classtype:social-engineering; sid:6008490; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (03dac8.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"03dac8.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008491; classtype:social-engineering; sid:6008491; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mon-delta-indol.vercel.app/Mondaypp.html)"; flow:established,to_server; http.uri; content:"/Mondaypp.html"; startswith; fast_pattern; http.host; content:"mon-delta-indol.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008492; classtype:social-engineering; sid:6008492; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loginservice.cloud/E.D_4ouY6_LyE?/articles/How-do-I-sign-a-DocuSign-document-Basic-Signing)"; flow:established,to_server; http.uri; content:"/E.D_4ouY6_LyE?/articles/How-do-I-sign-a-DocuSign-document-Basic-Signing"; startswith; fast_pattern; http.host; content:"loginservice.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008493; classtype:social-engineering; sid:6008493; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebooklogin123.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.facebooklogin123.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008494; classtype:social-engineering; sid:6008494; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (326945.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"326945.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008495; classtype:social-engineering; sid:6008495; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yahoomailoilna.github.io/yahoo/)"; flow:established,to_server; http.uri; content:"/yahoo/"; startswith; fast_pattern; http.host; content:"yahoomailoilna.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008496; classtype:social-engineering; sid:6008496; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (online-ops.mypasschange.com/landingPage/2/96a2809e94d411f1abc80a58a9feac02)"; flow:established,to_server; http.uri; content:"/landingPage/2/96a2809e94d411f1abc80a58a9feac02"; startswith; fast_pattern; http.host; content:"online-ops.mypasschange.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008497; classtype:social-engineering; sid:6008497; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (logid359-hlga.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"logid359-hlga.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008498; classtype:social-engineering; sid:6008498; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yarenbocekilaclama.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yarenbocekilaclama.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008499; classtype:social-engineering; sid:6008499; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox-robux10kadm1n.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"roblox-robux10kadm1n.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008500; classtype:social-engineering; sid:6008500; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (essentialoilroots.com/docs/sbcglobal/)"; flow:established,to_server; http.uri; content:"/docs/sbcglobal/"; startswith; fast_pattern; http.host; content:"essentialoilroots.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008501; classtype:social-engineering; sid:6008501; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fellroriana.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fellroriana.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008502; classtype:social-engineering; sid:6008502; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (g26r1.icu/uiehaopm/)"; flow:established,to_server; http.uri; content:"/uiehaopm/"; startswith; fast_pattern; http.host; content:"g26r1.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008503; classtype:social-engineering; sid:6008503; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kunalkharat2008.github.io/Amazon-Homepage-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Homepage-Clone/"; startswith; fast_pattern; http.host; content:"kunalkharat2008.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008504; classtype:social-engineering; sid:6008504; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (otkacess.vercel.app/confirmar-saque/)"; flow:established,to_server; http.uri; content:"/confirmar-saque/"; startswith; fast_pattern; http.host; content:"otkacess.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008505; classtype:social-engineering; sid:6008505; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookmail-facebook.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"facebookmail-facebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008506; classtype:social-engineering; sid:6008506; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (office.zepke-consulting.sbs/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca)"; flow:established,to_server; http.uri; content:"/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca"; startswith; fast_pattern; http.host; content:"office.zepke-consulting.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008507; classtype:social-engineering; sid:6008507; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (get-web-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"get-web-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008508; classtype:social-engineering; sid:6008508; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sinkrone.com/saiko/action.htm)"; flow:established,to_server; http.uri; content:"/saiko/action.htm"; startswith; fast_pattern; http.host; content:"sinkrone.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008509; classtype:social-engineering; sid:6008509; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pedagio-consulta.dns.army/placa/debitos/ver-debitos1/)"; flow:established,to_server; http.uri; content:"/placa/debitos/ver-debitos1/"; startswith; fast_pattern; http.host; content:"pedagio-consulta.dns.army"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008510; classtype:social-engineering; sid:6008510; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sobe-ai-sim.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sobe-ai-sim.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008511; classtype:social-engineering; sid:6008511; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (com-ledger-lyve.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"com-ledger-lyve.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008512; classtype:social-engineering; sid:6008512; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mok1715.github.io/Netflix-Landing-Page-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Landing-Page-Clone/"; startswith; fast_pattern; http.host; content:"mok1715.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008513; classtype:social-engineering; sid:6008513; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhltools.se/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dhltools.se"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008514; classtype:social-engineering; sid:6008514; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fa91d1.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fa91d1.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008515; classtype:social-engineering; sid:6008515; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (architayadav0707.github.io/spotify-clone)"; flow:established,to_server; http.uri; content:"/spotify-clone"; startswith; fast_pattern; http.host; content:"architayadav0707.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008516; classtype:social-engineering; sid:6008516; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qwxqw.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qwxqw.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008517; classtype:social-engineering; sid:6008517; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lphone-localizable.top/FL26)"; flow:established,to_server; http.uri; content:"/FL26"; startswith; fast_pattern; http.host; content:"lphone-localizable.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008518; classtype:social-engineering; sid:6008518; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netflix-ui-clone-two.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netflix-ui-clone-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008519; classtype:social-engineering; sid:6008519; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arch-z39.pages.dev/en/)"; flow:established,to_server; http.uri; content:"/en/"; startswith; fast_pattern; http.host; content:"arch-z39.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008520; classtype:social-engineering; sid:6008520; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (frontend-eight-gamma-89.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"frontend-eight-gamma-89.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008521; classtype:social-engineering; sid:6008521; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (97123.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"97123.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008522; classtype:social-engineering; sid:6008522; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamuxsklogen.gitbook.io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"metamuxsklogen.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008523; classtype:social-engineering; sid:6008523; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (begin--ledgerlive.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"begin--ledgerlive.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008524; classtype:social-engineering; sid:6008524; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.rblx-r0bux540xyz.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.rblx-r0bux540xyz.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008525; classtype:social-engineering; sid:6008525; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (df4f2f.icefactory.cl/Sgnczba74YHNuEY0xvVUpDeMEpanPSRYZW2A9Noog1YepBQKbaaSfaBGpGN1oHL5/?rotated=1)"; flow:established,to_server; http.uri; content:"/Sgnczba74YHNuEY0xvVUpDeMEpanPSRYZW2A9Noog1YepBQKbaaSfaBGpGN1oHL5/?rotated=1"; startswith; fast_pattern; http.host; content:"df4f2f.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008526; classtype:social-engineering; sid:6008526; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (remvends.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"remvends.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008527; classtype:social-engineering; sid:6008527; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zdkpt32bfrn-wjsngskr-5d8c1f-zdk65c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zdkpt32bfrn-wjsngskr-5d8c1f-zdk65c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008528; classtype:social-engineering; sid:6008528; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creditoecuador-46--ecuadorcredit3.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"creditoecuador-46--ecuadorcredit3.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008529; classtype:social-engineering; sid:6008529; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp13ct-prador-biz-zelmik-kansor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp13ct-prador-biz-zelmik-kansor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008530; classtype:social-engineering; sid:6008530; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steamcommunityio.ink/pubg)"; flow:established,to_server; http.uri; content:"/pubg"; startswith; fast_pattern; http.host; content:"steamcommunityio.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008531; classtype:social-engineering; sid:6008531; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kayak.it/Lombardia-Italia-Hotel.1668.dr.html)"; flow:established,to_server; http.uri; content:"/Lombardia-Italia-Hotel.1668.dr.html"; startswith; fast_pattern; http.host; content:"www.kayak.it"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008532; classtype:social-engineering; sid:6008532; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bybiititnc.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bybiititnc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008533; classtype:social-engineering; sid:6008533; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dao1-64sp.vercel.app/davidao.html)"; flow:established,to_server; http.uri; content:"/davidao.html"; startswith; fast_pattern; http.host; content:"dao1-64sp.vercel.app"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008534; classtype:social-engineering; sid:6008534; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (edusofia.mx/week/hinet/index.php#hinet@hinet.net)"; flow:established,to_server; http.uri; content:"/week/hinet/index.php#hinet@hinet.net"; startswith; fast_pattern; http.host; content:"edusofia.mx"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008535; classtype:social-engineering; sid:6008535; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (viptiger.com.br/xh/hinet/index.php#google@google.com)"; flow:established,to_server; http.uri; content:"/xh/hinet/index.php#google@google.com"; startswith; fast_pattern; http.host; content:"viptiger.com.br"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6008536; classtype:social-engineering; sid:6008536; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeeid547.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopeeid547.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008537; classtype:social-engineering; sid:6008537; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp15ct-kavrex-biz-zunven-tavri.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp15ct-kavrex-biz-zunven-tavri.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008538; classtype:social-engineering; sid:6008538; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8bf1b6.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8bf1b6.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008539; classtype:social-engineering; sid:6008539; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f29f9b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f29f9b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008540; classtype:social-engineering; sid:6008540; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (us-support-ledgor-en.pages.dev/page4.html/)"; flow:established,to_server; http.uri; content:"/page4.html/"; startswith; fast_pattern; http.host; content:"us-support-ledgor-en.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008541; classtype:social-engineering; sid:6008541; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8b3a0a.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8b3a0a.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008542; classtype:social-engineering; sid:6008542; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7ddc0a.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7ddc0a.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008543; classtype:social-engineering; sid:6008543; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9d16d5.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9d16d5.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008544; classtype:social-engineering; sid:6008544; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-ledgrs-live.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app-ledgrs-live.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008545; classtype:social-engineering; sid:6008545; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bogodukhov.com.ua/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bogodukhov.com.ua"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008546; classtype:social-engineering; sid:6008546; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (startedio-trezox.zapier.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"startedio-trezox.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008547; classtype:social-engineering; sid:6008547; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portal-de-desembolso-pc--agzc3668.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portal-de-desembolso-pc--agzc3668.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008548; classtype:social-engineering; sid:6008548; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (access-ledgr-dextop-en.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"access-ledgr-dextop-en.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008549; classtype:social-engineering; sid:6008549; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (skilled-gold-etzyiudb.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"skilled-gold-etzyiudb.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008550; classtype:social-engineering; sid:6008550; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b32aaf.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b32aaf.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008551; classtype:social-engineering; sid:6008551; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f65299.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f65299.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008552; classtype:social-engineering; sid:6008552; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a0330c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a0330c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008553; classtype:social-engineering; sid:6008553; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coderkubes.com/duke/index.html)"; flow:established,to_server; http.uri; content:"/duke/index.html"; startswith; fast_pattern; http.host; content:"coderkubes.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008554; classtype:social-engineering; sid:6008554; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (52b7b2.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"52b7b2.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008555; classtype:social-engineering; sid:6008555; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (im-use-whatapp.hl.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"im-use-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008556; classtype:social-engineering; sid:6008556; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mailer6-ver.mdbgo.io/?eta=3mail@a.b.c0/)"; flow:established,to_server; http.uri; content:"/?eta=3mail@a.b.c0/"; startswith; fast_pattern; http.host; content:"mailer6-ver.mdbgo.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008557; classtype:social-engineering; sid:6008557; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinity-signon.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinity-signon.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008558; classtype:social-engineering; sid:6008558; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (assets-ledgrlive-eng.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"assets-ledgrlive-eng.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008559; classtype:social-engineering; sid:6008559; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktivasi-fiturxdana-pay3.yums.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktivasi-fiturxdana-pay3.yums.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008560; classtype:social-engineering; sid:6008560; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (802811.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"802811.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008561; classtype:social-engineering; sid:6008561; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.claimed-gifts.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.claimed-gifts.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008562; classtype:social-engineering; sid:6008562; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookloginid.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebookloginid.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008563; classtype:social-engineering; sid:6008563; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp15ct-zorqel-biz-melven-qavix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp15ct-zorqel-biz-melven-qavix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008564; classtype:social-engineering; sid:6008564; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp15ct-vurvex-biz-nurzen-zorli.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp15ct-vurvex-biz-nurzen-zorli.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008565; classtype:social-engineering; sid:6008565; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (motiva-rodoviadigital.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"motiva-rodoviadigital.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008566; classtype:social-engineering; sid:6008566; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-ledgrslive-en-us.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app-ledgrslive-en-us.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008567; classtype:social-engineering; sid:6008567; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.walletcoinbase-zeta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.walletcoinbase-zeta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008568; classtype:social-engineering; sid:6008568; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinityservice.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinityservice.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008569; classtype:social-engineering; sid:6008569; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creditoecuador-2026--creditopichi38.replit.app/?monto=10000)"; flow:established,to_server; http.uri; content:"/?monto=10000"; startswith; fast_pattern; http.host; content:"creditoecuador-2026--creditopichi38.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008570; classtype:social-engineering; sid:6008570; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ccer-hfa0fmdue4ebhcbd.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ccer-hfa0fmdue4ebhcbd.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008571; classtype:social-engineering; sid:6008571; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gitnikit.github.io/phisingsitefacebook)"; flow:established,to_server; http.uri; content:"/phisingsitefacebook"; startswith; fast_pattern; http.host; content:"gitnikit.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008572; classtype:social-engineering; sid:6008572; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-nexo.com/review.php)"; flow:established,to_server; http.uri; content:"/review.php"; startswith; fast_pattern; http.host; content:"secure-nexo.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008573; classtype:social-engineering; sid:6008573; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4233e0.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4233e0.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008574; classtype:social-engineering; sid:6008574; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (virat-kohli10.github.io/paybox-demo)"; flow:established,to_server; http.uri; content:"/paybox-demo"; startswith; fast_pattern; http.host; content:"virat-kohli10.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008575; classtype:social-engineering; sid:6008575; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2fa6a4.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2fa6a4.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008576; classtype:social-engineering; sid:6008576; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (28610d.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"28610d.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008577; classtype:social-engineering; sid:6008577; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.frontend-eight-gamma-89.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.frontend-eight-gamma-89.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008578; classtype:social-engineering; sid:6008578; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0ee24f.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0ee24f.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008579; classtype:social-engineering; sid:6008579; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zkbsicherung.com/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"zkbsicherung.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008580; classtype:social-engineering; sid:6008580; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d6dc84.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d6dc84.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008581; classtype:social-engineering; sid:6008581; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kuocnminlogox.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kuocnminlogox.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008582; classtype:social-engineering; sid:6008582; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (relay-fr-me.com/connexion.php)"; flow:established,to_server; http.uri; content:"/connexion.php"; startswith; fast_pattern; http.host; content:"relay-fr-me.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008583; classtype:social-engineering; sid:6008583; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1cadf3.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1cadf3.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008584; classtype:social-engineering; sid:6008584; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anirudhsajeesh0.github.io/Siteclone)"; flow:established,to_server; http.uri; content:"/Siteclone"; startswith; fast_pattern; http.host; content:"anirudhsajeesh0.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008585; classtype:social-engineering; sid:6008585; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c67030.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c67030.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008586; classtype:social-engineering; sid:6008586; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecf7d6.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ecf7d6.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008587; classtype:social-engineering; sid:6008587; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ask-ledgrwalet-liv.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ask-ledgrwalet-liv.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008588; classtype:social-engineering; sid:6008588; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.me-ta-ma-sk-log-in.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.me-ta-ma-sk-log-in.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008589; classtype:social-engineering; sid:6008589; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (filmistanstudios.com/mails/alibaba/)"; flow:established,to_server; http.uri; content:"/mails/alibaba/"; startswith; fast_pattern; http.host; content:"filmistanstudios.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008590; classtype:social-engineering; sid:6008590; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8f93ee.icefactory.cl/plQZiQcKliKJpcE0vLiUXtZ0xra45CerGQA00X13RWRPAqIHuyMpMD4oHxJ7BaLt/?rotated=1)"; flow:established,to_server; http.uri; content:"/plQZiQcKliKJpcE0vLiUXtZ0xra45CerGQA00X13RWRPAqIHuyMpMD4oHxJ7BaLt/?rotated=1"; startswith; fast_pattern; http.host; content:"8f93ee.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008591; classtype:social-engineering; sid:6008591; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.refund-paylater.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.refund-paylater.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008592; classtype:social-engineering; sid:6008592; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3009de.icefactory.cl/htp4NS9mxacptre8XAgCjYiV4xQBm0F6YKIPhgOSaazIP4RZWyGpCO7tAstUGSpp/?rotated=1)"; flow:established,to_server; http.uri; content:"/htp4NS9mxacptre8XAgCjYiV4xQBm0F6YKIPhgOSaazIP4RZWyGpCO7tAstUGSpp/?rotated=1"; startswith; fast_pattern; http.host; content:"3009de.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008593; classtype:social-engineering; sid:6008593; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appleservices.alwaysdata.net/ref/?_fm=71a724b20779)"; flow:established,to_server; http.uri; content:"/ref/?_fm=71a724b20779"; startswith; fast_pattern; http.host; content:"appleservices.alwaysdata.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008594; classtype:social-engineering; sid:6008594; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7d7be1.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7d7be1.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008595; classtype:social-engineering; sid:6008595; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blog.ubair.com/anotherday/app/index.php)"; flow:established,to_server; http.uri; content:"/anotherday/app/index.php"; startswith; fast_pattern; http.host; content:"blog.ubair.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008596; classtype:social-engineering; sid:6008596; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (df9709.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"df9709.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008597; classtype:social-engineering; sid:6008597; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cloud-desktop-en-ledgr.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cloud-desktop-en-ledgr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008598; classtype:social-engineering; sid:6008598; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a95e7b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a95e7b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008599; classtype:social-engineering; sid:6008599; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc488c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dc488c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008600; classtype:social-engineering; sid:6008600; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (center.verifiblueaccountstatusai.click/index.php)"; flow:established,to_server; http.uri; content:"/index.php"; startswith; fast_pattern; http.host; content:"center.verifiblueaccountstatusai.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008601; classtype:social-engineering; sid:6008601; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8b0c57.icefactory.cl/oprdlbcMyNhisYOpw3W5LPYwcpB24Psl47ukBVyjHcY2Q3EgH7yuA19j0qnAHdlU/?rotated=1)"; flow:established,to_server; http.uri; content:"/oprdlbcMyNhisYOpw3W5LPYwcpB24Psl47ukBVyjHcY2Q3EgH7yuA19j0qnAHdlU/?rotated=1"; startswith; fast_pattern; http.host; content:"8b0c57.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008602; classtype:social-engineering; sid:6008602; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (81ef2a.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"81ef2a.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008603; classtype:social-engineering; sid:6008603; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1b0466.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1b0466.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008604; classtype:social-engineering; sid:6008604; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (access-ledgrlive-io.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"access-ledgrlive-io.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008605; classtype:social-engineering; sid:6008605; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17cbf5.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17cbf5.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008606; classtype:social-engineering; sid:6008606; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accountservicescenter.co.za/?r=2936e486-3960-4b99-9e03-f1a94bfde3ae&rg=eu)"; flow:established,to_server; http.uri; content:"/?r=2936e486-3960-4b99-9e03-f1a94bfde3ae&rg=eu"; startswith; fast_pattern; http.host; content:"accountservicescenter.co.za"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008607; classtype:social-engineering; sid:6008607; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ae1d2c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ae1d2c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008608; classtype:social-engineering; sid:6008608; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-app-tre-jor.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-app-tre-jor.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008609; classtype:social-engineering; sid:6008609; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rakuten-two.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rakuten-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008610; classtype:social-engineering; sid:6008610; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (338874.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"338874.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008611; classtype:social-engineering; sid:6008611; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (733ef5.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"733ef5.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008612; classtype:social-engineering; sid:6008612; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a31cf6.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a31cf6.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008613; classtype:social-engineering; sid:6008613; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d51b01.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d51b01.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008614; classtype:social-engineering; sid:6008614; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagramfollowers146.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagramfollowers146.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008615; classtype:social-engineering; sid:6008615; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (net16ct-toru-biz-vemi-zano.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"net16ct-toru-biz-vemi-zano.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008616; classtype:social-engineering; sid:6008616; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (33dbae.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"33dbae.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008617; classtype:social-engineering; sid:6008617; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4bc19e.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4bc19e.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008618; classtype:social-engineering; sid:6008618; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (connecte-bridge.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"connecte-bridge.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008619; classtype:social-engineering; sid:6008619; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alok-kumar-sing.github.io/Amazon-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-Clone"; startswith; fast_pattern; http.host; content:"alok-kumar-sing.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008620; classtype:social-engineering; sid:6008620; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (biturbo.com.pk/Inbox/online.html)"; flow:established,to_server; http.uri; content:"/Inbox/online.html"; startswith; fast_pattern; http.host; content:"biturbo.com.pk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008621; classtype:social-engineering; sid:6008621; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (advance-ledgr-live.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"advance-ledgr-live.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008622; classtype:social-engineering; sid:6008622; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d482fb.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d482fb.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008623; classtype:social-engineering; sid:6008623; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflix-clone-steel-three-83.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflix-clone-steel-three-83.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008624; classtype:social-engineering; sid:6008624; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vrushali-janbhare.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"vrushali-janbhare.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008625; classtype:social-engineering; sid:6008625; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f73f3c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f73f3c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008626; classtype:social-engineering; sid:6008626; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (23aa9d.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"23aa9d.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008627; classtype:social-engineering; sid:6008627; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookloginreview.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebookloginreview.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008628; classtype:social-engineering; sid:6008628; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apps-ledgger-li.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"apps-ledgger-li.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008629; classtype:social-engineering; sid:6008629; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp13ct-vormik-biz-frandel-kazdor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp13ct-vormik-biz-frandel-kazdor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008630; classtype:social-engineering; sid:6008630; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (78v6786v8.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"78v6786v8.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008631; classtype:social-engineering; sid:6008631; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dfrespay.fdnk.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dfrespay.fdnk.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008632; classtype:social-engineering; sid:6008632; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1ecdb5.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1ecdb5.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008633; classtype:social-engineering; sid:6008633; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (laibakhan139.github.io/netflix-home-page)"; flow:established,to_server; http.uri; content:"/netflix-home-page"; startswith; fast_pattern; http.host; content:"laibakhan139.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008634; classtype:social-engineering; sid:6008634; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a-desktop-live-ledgr.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a-desktop-live-ledgr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008635; classtype:social-engineering; sid:6008635; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1df173.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1df173.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008636; classtype:social-engineering; sid:6008636; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c08923.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c08923.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008637; classtype:social-engineering; sid:6008637; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qualitybh.art.br/fil/sd)"; flow:established,to_server; http.uri; content:"/fil/sd"; startswith; fast_pattern; http.host; content:"qualitybh.art.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008638; classtype:social-engineering; sid:6008638; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (666c8b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"666c8b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008639; classtype:social-engineering; sid:6008639; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2897d4.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2897d4.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008640; classtype:social-engineering; sid:6008640; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (plaermoxred.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"plaermoxred.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008641; classtype:social-engineering; sid:6008641; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (97479b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"97479b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008642; classtype:social-engineering; sid:6008642; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accss-metamsk-lgn.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"accss-metamsk-lgn.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008643; classtype:social-engineering; sid:6008643; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apps-ledgre-live.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"apps-ledgre-live.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008644; classtype:social-engineering; sid:6008644; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a004ef.icefactory.cl/z1fDlFv2ERntwcitD5KbGNZK4XsGAfD7mMGadbVv9bmihF3xzQrpO30EKqkZDuJd/?rotated=1)"; flow:established,to_server; http.uri; content:"/z1fDlFv2ERntwcitD5KbGNZK4XsGAfD7mMGadbVv9bmihF3xzQrpO30EKqkZDuJd/?rotated=1"; startswith; fast_pattern; http.host; content:"a004ef.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008645; classtype:social-engineering; sid:6008645; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (base-ledger-app.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"base-ledger-app.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008646; classtype:social-engineering; sid:6008646; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bing-ledgrhardwear.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bing-ledgrhardwear.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008647; classtype:social-engineering; sid:6008647; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (access-ledger-live-desktop.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"access-ledger-live-desktop.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008648; classtype:social-engineering; sid:6008648; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imhrithik.github.io/Sound-Vibe/)"; flow:established,to_server; http.uri; content:"/Sound-Vibe/"; startswith; fast_pattern; http.host; content:"imhrithik.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008649; classtype:social-engineering; sid:6008649; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robloxcondo.my.id/jun7x1)"; flow:established,to_server; http.uri; content:"/jun7x1"; startswith; fast_pattern; http.host; content:"robloxcondo.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008650; classtype:social-engineering; sid:6008650; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c38a9f.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c38a9f.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008651; classtype:social-engineering; sid:6008651; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0f1bfe.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0f1bfe.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008652; classtype:social-engineering; sid:6008652; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (21c52f.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"21c52f.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008653; classtype:social-engineering; sid:6008653; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.chain-swap-interface-v2.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.chain-swap-interface-v2.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008654; classtype:social-engineering; sid:6008654; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yetteli.sbs/flights/index.html)"; flow:established,to_server; http.uri; content:"/flights/index.html"; startswith; fast_pattern; http.host; content:"yetteli.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008655; classtype:social-engineering; sid:6008655; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alon-live-ledgr.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"alon-live-ledgr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008656; classtype:social-engineering; sid:6008656; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (assets-ledgrolive-learn.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"assets-ledgrolive-learn.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008657; classtype:social-engineering; sid:6008657; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (21064b.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"21064b.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008658; classtype:social-engineering; sid:6008658; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebooklogin21.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebooklogin21.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008659; classtype:social-engineering; sid:6008659; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robiox.top/home)"; flow:established,to_server; http.uri; content:"/home"; startswith; fast_pattern; http.host; content:"robiox.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008660; classtype:social-engineering; sid:6008660; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopeeinc1111.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopeeinc1111.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008661; classtype:social-engineering; sid:6008661; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fbf1d9.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fbf1d9.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008662; classtype:social-engineering; sid:6008662; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (welcome-begin-trezo-en.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"welcome-begin-trezo-en.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008663; classtype:social-engineering; sid:6008663; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (validarm1c-0s00.webcindario.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"validarm1c-0s00.webcindario.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008664; classtype:social-engineering; sid:6008664; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e702a1.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e702a1.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008665; classtype:social-engineering; sid:6008665; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ask-ledgr-live.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ask-ledgr-live.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008666; classtype:social-engineering; sid:6008666; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.rakuten-two.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.rakuten-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008667; classtype:social-engineering; sid:6008667; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-ledgr-livedoc.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app-ledgr-livedoc.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008668; classtype:social-engineering; sid:6008668; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fccc69.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fccc69.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008669; classtype:social-engineering; sid:6008669; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (start-io-trezr-public-cdn.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"start-io-trezr-public-cdn.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008670; classtype:social-engineering; sid:6008670; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (binance-trading-bot-36q.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"binance-trading-bot-36q.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008671; classtype:social-engineering; sid:6008671; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a1a4ab.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a1a4ab.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008672; classtype:social-engineering; sid:6008672; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (34711b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"34711b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008673; classtype:social-engineering; sid:6008673; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (567536.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"567536.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008674; classtype:social-engineering; sid:6008674; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-trezor-io-start-app.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-trezor-io-start-app.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008675; classtype:social-engineering; sid:6008675; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0ficinavirttual4.site/index1.php)"; flow:established,to_server; http.uri; content:"/index1.php"; startswith; fast_pattern; http.host; content:"0ficinavirttual4.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008676; classtype:social-engineering; sid:6008676; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.binance-referral-code-btcbonus.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.binance-referral-code-btcbonus.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008677; classtype:social-engineering; sid:6008677; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0dddf4.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0dddf4.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008678; classtype:social-engineering; sid:6008678; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vnzkt819m-msprq341k-2a4e-xlb59p.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vnzkt819m-msprq341k-2a4e-xlb59p.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008679; classtype:social-engineering; sid:6008679; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopeeinc1111.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopeeinc1111.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008680; classtype:social-engineering; sid:6008680; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (06249e.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"06249e.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008681; classtype:social-engineering; sid:6008681; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (express-dhl-dpe3103d2mga.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"express-dhl-dpe3103d2mga.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008682; classtype:social-engineering; sid:6008682; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fab207.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fab207.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008683; classtype:social-engineering; sid:6008683; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (df63ff.icefactory.cl/ksiernCZ4HYpjtK68wPm52ZTufIAomjS1w79usIbBVc5J3nhoAQa4dqRKO0GKdyp/?rotated=1)"; flow:established,to_server; http.uri; content:"/ksiernCZ4HYpjtK68wPm52ZTufIAomjS1w79usIbBVc5J3nhoAQa4dqRKO0GKdyp/?rotated=1"; startswith; fast_pattern; http.host; content:"df63ff.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008684; classtype:social-engineering; sid:6008684; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4d2582.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4d2582.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008685; classtype:social-engineering; sid:6008685; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b268b9.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b268b9.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008686; classtype:social-engineering; sid:6008686; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b000e9.winnicart.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b000e9.winnicart.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008687; classtype:social-engineering; sid:6008687; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (connec-treoz-bridge.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"connec-treoz-bridge.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008688; classtype:social-engineering; sid:6008688; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nhzn-ju8-gh5-64ls-gfewy-4vo.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nhzn-ju8-gh5-64ls-gfewy-4vo.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008689; classtype:social-engineering; sid:6008689; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f6676d.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f6676d.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008690; classtype:social-engineering; sid:6008690; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-ledgr-downlod.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app-ledgr-downlod.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008691; classtype:social-engineering; sid:6008691; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mass-orange-drrrexhk.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mass-orange-drrrexhk.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008692; classtype:social-engineering; sid:6008692; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (004e3a.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"004e3a.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008693; classtype:social-engineering; sid:6008693; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chain-swap-interface-v2.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chain-swap-interface-v2.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008694; classtype:social-engineering; sid:6008694; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1fba23.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1fba23.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008695; classtype:social-engineering; sid:6008695; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8be6e8.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8be6e8.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008696; classtype:social-engineering; sid:6008696; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (81cc79.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"81cc79.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008697; classtype:social-engineering; sid:6008697; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (access-us-ledger.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"access-us-ledger.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008698; classtype:social-engineering; sid:6008698; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5e20c6.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"5e20c6.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008699; classtype:social-engineering; sid:6008699; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tariasnot.duckdns.org/Docsign00.html)"; flow:established,to_server; http.uri; content:"/Docsign00.html"; startswith; fast_pattern; http.host; content:"tariasnot.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008700; classtype:social-engineering; sid:6008700; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (los108.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"los108.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008701; classtype:social-engineering; sid:6008701; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (10920c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"10920c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008702; classtype:social-engineering; sid:6008702; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-opfq.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-opfq.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008703; classtype:social-engineering; sid:6008703; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6062fd.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6062fd.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008704; classtype:social-engineering; sid:6008704; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.logid359-hlga.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.logid359-hlga.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008705; classtype:social-engineering; sid:6008705; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebooksupportphonenumber12300.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"facebooksupportphonenumber12300.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008706; classtype:social-engineering; sid:6008706; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (began-ledger-live-desktop-eng-us.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"began-ledger-live-desktop-eng-us.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008707; classtype:social-engineering; sid:6008707; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smilling-long-pannel.edgeone.dev/?eta=torikpro@0f52f931ef5f3d9424a897162d0e1cfba9c2.com)"; flow:established,to_server; http.uri; content:"/?eta=torikpro@0f52f931ef5f3d9424a897162d0e1cfba9c2.com"; startswith; fast_pattern; http.host; content:"smilling-long-pannel.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008708; classtype:social-engineering; sid:6008708; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bridallehenga.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bridallehenga.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008709; classtype:social-engineering; sid:6008709; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7b591c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7b591c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008710; classtype:social-engineering; sid:6008710; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ce5e30.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ce5e30.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008711; classtype:social-engineering; sid:6008711; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8feed4.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8feed4.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008712; classtype:social-engineering; sid:6008712; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityverifynow.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinityverifynow.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008713; classtype:social-engineering; sid:6008713; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loginfacebookverification.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"loginfacebookverification.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008714; classtype:social-engineering; sid:6008714; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (53cfaf.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"53cfaf.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008715; classtype:social-engineering; sid:6008715; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rootmadhav.github.io/Netflix-clone-2023/)"; flow:established,to_server; http.uri; content:"/Netflix-clone-2023/"; startswith; fast_pattern; http.host; content:"rootmadhav.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008716; classtype:social-engineering; sid:6008716; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (grespayw.grespay.web.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"grespayw.grespay.web.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008717; classtype:social-engineering; sid:6008717; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aea1d5.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aea1d5.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008718; classtype:social-engineering; sid:6008718; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bd2de7.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bd2de7.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008719; classtype:social-engineering; sid:6008719; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creditopichinchaecuador-2026--creditoenline3.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"creditopichinchaecuador-2026--creditoenline3.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008720; classtype:social-engineering; sid:6008720; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sock-zizifn-jp.ludea-lau.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sock-zizifn-jp.ludea-lau.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008721; classtype:social-engineering; sid:6008721; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8bfe2e.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8bfe2e.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008722; classtype:social-engineering; sid:6008722; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bnc-flb.web.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bnc-flb.web.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008723; classtype:social-engineering; sid:6008723; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b1a4fd.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b1a4fd.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008724; classtype:social-engineering; sid:6008724; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vormora-zxt-lenqumi-c8x1fc67.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vormora-zxt-lenqumi-c8x1fc67.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008725; classtype:social-engineering; sid:6008725; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bai.infura-ipfs.io/ipfs/bafkreifg5u6op7zz6su3tg53j6ftrg3brcaiphlilet2wwqgobzziiunha)"; flow:established,to_server; http.uri; content:"/ipfs/bafkreifg5u6op7zz6su3tg53j6ftrg3brcaiphlilet2wwqgobzziiunha"; startswith; fast_pattern; http.host; content:"bai.infura-ipfs.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008726; classtype:social-engineering; sid:6008726; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebooksupportphonenumber12300.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebooksupportphonenumber12300.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008727; classtype:social-engineering; sid:6008727; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d90a71.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d90a71.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008728; classtype:social-engineering; sid:6008728; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (logan-blokiie-us.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"logan-blokiie-us.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008729; classtype:social-engineering; sid:6008729; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (io-public-trzors-com.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"io-public-trzors-com.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008730; classtype:social-engineering; sid:6008730; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (00hwee-9rck-fuj-bvii3-y210am.pages.dev/qaz-wsx-edc-rfv?welcome=106906109377741&token248=106906109377741&name_token136=Lippert%20Marine)"; flow:established,to_server; http.uri; content:"/qaz-wsx-edc-rfv?welcome=106906109377741&token248=106906109377741&name_token136=Lippert%20Marine"; startswith; fast_pattern; http.host; content:"00hwee-9rck-fuj-bvii3-y210am.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008731; classtype:social-engineering; sid:6008731; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fecb46.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fecb46.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008732; classtype:social-engineering; sid:6008732; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7f55ef.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7f55ef.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008733; classtype:social-engineering; sid:6008733; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clicks-ledger-live.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clicks-ledger-live.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008734; classtype:social-engineering; sid:6008734; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (access-en-ledger-live-download.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"access-en-ledger-live-download.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008735; classtype:social-engineering; sid:6008735; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5b0307.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"5b0307.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008736; classtype:social-engineering; sid:6008736; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aedaa5.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aedaa5.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008737; classtype:social-engineering; sid:6008737; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4255e4.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4255e4.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008738; classtype:social-engineering; sid:6008738; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp13ct-pravdor-biz-kersik-frandel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp13ct-pravdor-biz-kersik-frandel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008739; classtype:social-engineering; sid:6008739; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a2007f.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a2007f.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008740; classtype:social-engineering; sid:6008740; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (18aafc.winnicart.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"18aafc.winnicart.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008741; classtype:social-engineering; sid:6008741; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dovessrbx.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dovessrbx.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008742; classtype:social-engineering; sid:6008742; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bd3685.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bd3685.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008743; classtype:social-engineering; sid:6008743; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (access-ledgr-desktop.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"access-ledgr-desktop.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008744; classtype:social-engineering; sid:6008744; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deanschneideroasis.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"deanschneideroasis.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008745; classtype:social-engineering; sid:6008745; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apps-ledgerr.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"apps-ledgerr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008746; classtype:social-engineering; sid:6008746; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (779a0e.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"779a0e.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008747; classtype:social-engineering; sid:6008747; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ucdgxfhcgjhvkjblk-dp6se8xlrpxx.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ucdgxfhcgjhvkjblk-dp6se8xlrpxx.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008748; classtype:social-engineering; sid:6008748; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d9854f.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d9854f.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008749; classtype:social-engineering; sid:6008749; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nutritious-amethyst-jy6c7lj2.edgeone.dev/home)"; flow:established,to_server; http.uri; content:"/home"; startswith; fast_pattern; http.host; content:"nutritious-amethyst-jy6c7lj2.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008750; classtype:social-engineering; sid:6008750; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (guide-library-30bd.siti111856.workers.dev/privacy-information-center/)"; flow:established,to_server; http.uri; content:"/privacy-information-center/"; startswith; fast_pattern; http.host; content:"guide-library-30bd.siti111856.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008751; classtype:social-engineering; sid:6008751; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faq-public-trezro-us.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faq-public-trezro-us.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008752; classtype:social-engineering; sid:6008752; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (48a2ba.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"48a2ba.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008753; classtype:social-engineering; sid:6008753; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3c5d30.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3c5d30.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008754; classtype:social-engineering; sid:6008754; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5f98ad.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"5f98ad.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008755; classtype:social-engineering; sid:6008755; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (431b3d.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"431b3d.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008756; classtype:social-engineering; sid:6008756; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (srv1888708.hstgr.cloud/rew/)"; flow:established,to_server; http.uri; content:"/rew/"; startswith; fast_pattern; http.host; content:"srv1888708.hstgr.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008757; classtype:social-engineering; sid:6008757; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (75dbd9.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"75dbd9.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008758; classtype:social-engineering; sid:6008758; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a0c31f.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a0c31f.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008759; classtype:social-engineering; sid:6008759; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d44bd3.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d44bd3.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008760; classtype:social-engineering; sid:6008760; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityservice.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinityservice.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008761; classtype:social-engineering; sid:6008761; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (efe114.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"efe114.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008762; classtype:social-engineering; sid:6008762; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-x-desktop-ledgre.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app-x-desktop-ledgre.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008763; classtype:social-engineering; sid:6008763; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ffacebooklogin.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ffacebooklogin.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008764; classtype:social-engineering; sid:6008764; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0b2cdc.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0b2cdc.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008765; classtype:social-engineering; sid:6008765; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e52f7e.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e52f7e.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008766; classtype:social-engineering; sid:6008766; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (center.verifiblueprofilesecureai.cfd/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"center.verifiblueprofilesecureai.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008767; classtype:social-engineering; sid:6008767; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bb2f98.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bb2f98.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008768; classtype:social-engineering; sid:6008768; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (advance-li-ledgrr.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"advance-li-ledgrr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008769; classtype:social-engineering; sid:6008769; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ffacebooklogin.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ffacebooklogin.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008770; classtype:social-engineering; sid:6008770; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dbea2c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dbea2c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008771; classtype:social-engineering; sid:6008771; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (efe794.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"efe794.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008772; classtype:social-engineering; sid:6008772; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth.verifibluebusinesscentermetaai.click/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"auth.verifibluebusinesscentermetaai.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008773; classtype:social-engineering; sid:6008773; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (641f8e.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"641f8e.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008774; classtype:social-engineering; sid:6008774; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zanquro-zxt-melvani-p5t8dk31.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zanquro-zxt-melvani-p5t8dk31.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008775; classtype:social-engineering; sid:6008775; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bf5893.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bf5893.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008776; classtype:social-engineering; sid:6008776; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (forthit.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"forthit.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008777; classtype:social-engineering; sid:6008777; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (930898.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"930898.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008778; classtype:social-engineering; sid:6008778; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app---ledger-live.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app---ledger-live.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008779; classtype:social-engineering; sid:6008779; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (binance-referral-code-btcbonus.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"binance-referral-code-btcbonus.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008780; classtype:social-engineering; sid:6008780; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (perturbed-univer-d5a135.bestoptiontrade1.workers.dev/373d5a135.xlsx)"; flow:established,to_server; http.uri; content:"/373d5a135.xlsx"; startswith; fast_pattern; http.host; content:"perturbed-univer-d5a135.bestoptiontrade1.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008781; classtype:social-engineering; sid:6008781; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cf.1689888.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cf.1689888.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008782; classtype:social-engineering; sid:6008782; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netrajs.github.io/spotify_clone)"; flow:established,to_server; http.uri; content:"/spotify_clone"; startswith; fast_pattern; http.host; content:"netrajs.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008783; classtype:social-engineering; sid:6008783; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (93bb9e.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"93bb9e.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008784; classtype:social-engineering; sid:6008784; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-carol.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-carol.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008785; classtype:social-engineering; sid:6008785; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.accountfacebook.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.accountfacebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008786; classtype:social-engineering; sid:6008786; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fortnate.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fortnate.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008787; classtype:social-engineering; sid:6008787; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f784a5.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f784a5.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008788; classtype:social-engineering; sid:6008788; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (staticfile-kimkaro66.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"staticfile-kimkaro66.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008789; classtype:social-engineering; sid:6008789; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebookloginf.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebookloginf.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008790; classtype:social-engineering; sid:6008790; rev:1; metadata: signature_severity Major, created_et 2026_08_11;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eu.auditmessages.eu/?r=3daa0bcfdd8c18f30accb071a56a63ca)"; flow:established,to_server; http.uri; content:"/?r=3daa0bcfdd8c18f30accb071a56a63ca"; startswith; fast_pattern; http.host; content:"eu.auditmessages.eu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008791; classtype:social-engineering; sid:6008791; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (orpecas.ind.br/auth/verifying)"; flow:established,to_server; http.uri; content:"/auth/verifying"; startswith; fast_pattern; http.host; content:"orpecas.ind.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008792; classtype:social-engineering; sid:6008792; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cotacao.simulacaoaqui.com.br/auto-1/)"; flow:established,to_server; http.uri; content:"/auto-1/"; startswith; fast_pattern; http.host; content:"cotacao.simulacaoaqui.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008793; classtype:social-engineering; sid:6008793; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (de6416.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"de6416.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008794; classtype:social-engineering; sid:6008794; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uruk-trck.aakhir.us/Y2gtZmVkZXgtMjAyNg/)"; flow:established,to_server; http.uri; content:"/Y2gtZmVkZXgtMjAyNg/"; startswith; fast_pattern; http.host; content:"uruk-trck.aakhir.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008795; classtype:social-engineering; sid:6008795; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comacstnew.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comacstnew.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008796; classtype:social-engineering; sid:6008796; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (geupsrrjfncovb9da7cggdwt3mov4ffiasf25-h28v.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"geupsrrjfncovb9da7cggdwt3mov4ffiasf25-h28v.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008797; classtype:social-engineering; sid:6008797; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6f3fb389-505d-4271-85be-559253652574-00-1da2kwibr6ek8.janeway.replit.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6f3fb389-505d-4271-85be-559253652574-00-1da2kwibr6ek8.janeway.replit.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008798; classtype:social-engineering; sid:6008798; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (88c700.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"88c700.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008799; classtype:social-engineering; sid:6008799; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-page-editor--brorafishing.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-page-editor--brorafishing.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008800; classtype:social-engineering; sid:6008800; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (notificationdusystement.framer.media/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"notificationdusystement.framer.media"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008801; classtype:social-engineering; sid:6008801; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eu.microsft.org/?r=121b9d6609c848d34ad90e8920a100b7)"; flow:established,to_server; http.uri; content:"/?r=121b9d6609c848d34ad90e8920a100b7"; startswith; fast_pattern; http.host; content:"eu.microsft.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008802; classtype:social-engineering; sid:6008802; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (77182b.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"77182b.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008803; classtype:social-engineering; sid:6008803; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7c2a38.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7c2a38.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008804; classtype:social-engineering; sid:6008804; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebookloginid.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebookloginid.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008805; classtype:social-engineering; sid:6008805; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (db22ab.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"db22ab.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008806; classtype:social-engineering; sid:6008806; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (72a6ab.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"72a6ab.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008807; classtype:social-engineering; sid:6008807; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sicredi.dedyn.io/i.php?sb)"; flow:established,to_server; http.uri; content:"/i.php?sb"; startswith; fast_pattern; http.host; content:"sicredi.dedyn.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008808; classtype:social-engineering; sid:6008808; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (headshotsandcorporate.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"headshotsandcorporate.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008809; classtype:social-engineering; sid:6008809; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (400cf3.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"400cf3.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008810; classtype:social-engineering; sid:6008810; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (snaply-git-main-khadir-salims-projects.vercel.app/account/Login)"; flow:established,to_server; http.uri; content:"/account/Login"; startswith; fast_pattern; http.host; content:"snaply-git-main-khadir-salims-projects.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008811; classtype:social-engineering; sid:6008811; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ec857f.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ec857f.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008812; classtype:social-engineering; sid:6008812; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (orngsuppoacesco.duckdns.org/Orange/)"; flow:established,to_server; http.uri; content:"/Orange/"; startswith; fast_pattern; http.host; content:"orngsuppoacesco.duckdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008813; classtype:social-engineering; sid:6008813; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blockwavewallet.com/admin/login)"; flow:established,to_server; http.uri; content:"/admin/login"; startswith; fast_pattern; http.host; content:"blockwavewallet.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008814; classtype:social-engineering; sid:6008814; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (outlook-fastseed-validate-75484.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"outlook-fastseed-validate-75484.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008815; classtype:social-engineering; sid:6008815; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (blunp-bfrnk-skrunt-3o92lm-vznk-flomax.pages.dev/appeals/submit-appeal-form/return)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-form/return"; startswith; fast_pattern; http.host; content:"blunp-bfrnk-skrunt-3o92lm-vznk-flomax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008816; classtype:social-engineering; sid:6008816; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6ab91a.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6ab91a.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008817; classtype:social-engineering; sid:6008817; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b4c18a.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b4c18a.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008818; classtype:social-engineering; sid:6008818; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cbe9db.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cbe9db.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008819; classtype:social-engineering; sid:6008819; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-ykencquuj.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-ykencquuj.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008820; classtype:social-engineering; sid:6008820; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wx3bux7387x.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wx3bux7387x.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008821; classtype:social-engineering; sid:6008821; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (drul-tk.esepa.info/Y2gtZmVkZXgtMjAyNg/?u=163C1655&e=josephina22%40hanmail.net&s3=&s4=&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/Y2gtZmVkZXgtMjAyNg/?u=163C1655&e=josephina22%40hanmail.net&s3=&s4=&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"drul-tk.esepa.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008822; classtype:social-engineering; sid:6008822; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d67661.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d67661.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008823; classtype:social-engineering; sid:6008823; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (11.rewardinglocker.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"11.rewardinglocker.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008824; classtype:social-engineering; sid:6008824; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9cdb7f.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9cdb7f.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008825; classtype:social-engineering; sid:6008825; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (53f86c.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"53f86c.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008826; classtype:social-engineering; sid:6008826; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5060fd.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"5060fd.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008827; classtype:social-engineering; sid:6008827; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagramlogin68.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagramlogin68.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008828; classtype:social-engineering; sid:6008828; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-mu-rosy.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-mu-rosy.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008829; classtype:social-engineering; sid:6008829; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ravquza-nqx-felmori-r7x2hc91.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ravquza-nqx-felmori-r7x2hc91.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008830; classtype:social-engineering; sid:6008830; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ganpatimatrimonial.com/Z/Orange/)"; flow:established,to_server; http.uri; content:"/Z/Orange/"; startswith; fast_pattern; http.host; content:"www.ganpatimatrimonial.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008831; classtype:social-engineering; sid:6008831; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (321406.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"321406.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008832; classtype:social-engineering; sid:6008832; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sempreevoluindoembuscademelhoria.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"sempreevoluindoembuscademelhoria.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008833; classtype:social-engineering; sid:6008833; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.login-page-instagram.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.login-page-instagram.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008834; classtype:social-engineering; sid:6008834; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezor.win/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"trezor.win"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008835; classtype:social-engineering; sid:6008835; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fb18c8.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fb18c8.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008836; classtype:social-engineering; sid:6008836; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (soyambuilds.github.io/spotify_clone/)"; flow:established,to_server; http.uri; content:"/spotify_clone/"; startswith; fast_pattern; http.host; content:"soyambuilds.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008837; classtype:social-engineering; sid:6008837; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wells-fargo-ac06dd.previewship.net/investing/retirement/ira/select)"; flow:established,to_server; http.uri; content:"/investing/retirement/ira/select"; startswith; fast_pattern; http.host; content:"wells-fargo-ac06dd.previewship.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008838; classtype:social-engineering; sid:6008838; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebooklogin21.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebooklogin21.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008839; classtype:social-engineering; sid:6008839; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (634574.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"634574.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008840; classtype:social-engineering; sid:6008840; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee5155.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopee5155.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008841; classtype:social-engineering; sid:6008841; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2026081122224512788112.onamaeweb.jp/Particular/login.php)"; flow:established,to_server; http.uri; content:"/Particular/login.php"; startswith; fast_pattern; http.host; content:"2026081122224512788112.onamaeweb.jp"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008842; classtype:social-engineering; sid:6008842; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (74cbf3.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"74cbf3.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008843; classtype:social-engineering; sid:6008843; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6cc8b8.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6cc8b8.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008844; classtype:social-engineering; sid:6008844; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (683b70.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"683b70.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008845; classtype:social-engineering; sid:6008845; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dev-nasrullah-pk.github.io/netflix-clone/)"; flow:established,to_server; http.uri; content:"/netflix-clone/"; startswith; fast_pattern; http.host; content:"dev-nasrullah-pk.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008846; classtype:social-engineering; sid:6008846; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6b0e8e.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6b0e8e.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008847; classtype:social-engineering; sid:6008847; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cafcanadasupport.ca/core/client/rbcroyal/)"; flow:established,to_server; http.uri; content:"/core/client/rbcroyal/"; startswith; fast_pattern; http.host; content:"cafcanadasupport.ca"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008848; classtype:social-engineering; sid:6008848; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (soumya-shree-panda.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"soumya-shree-panda.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008849; classtype:social-engineering; sid:6008849; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (floridabloghealth.us/license/Adobe_Installer.html)"; flow:established,to_server; http.uri; content:"/license/Adobe_Installer.html"; startswith; fast_pattern; http.host; content:"floridabloghealth.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008850; classtype:social-engineering; sid:6008850; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.vip365.app/eng/home/index)"; flow:established,to_server; http.uri; content:"/eng/home/index"; startswith; fast_pattern; http.host; content:"m.vip365.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008851; classtype:social-engineering; sid:6008851; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (38de70.arcadejafet.cl/P4LFlNxUQMZMcULZOLvgmyVN3jyTBkQs2vok0OXyI7OO64Xv9gGyYjPgX8olCwDE/?rotated=1)"; flow:established,to_server; http.uri; content:"/P4LFlNxUQMZMcULZOLvgmyVN3jyTBkQs2vok0OXyI7OO64Xv9gGyYjPgX8olCwDE/?rotated=1"; startswith; fast_pattern; http.host; content:"38de70.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008852; classtype:social-engineering; sid:6008852; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.undian-shopee536.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.undian-shopee536.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008853; classtype:social-engineering; sid:6008853; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ed9ce0.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ed9ce0.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008854; classtype:social-engineering; sid:6008854; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6d8c0c.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6d8c0c.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008855; classtype:social-engineering; sid:6008855; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abhshek-78.github.io/Spotify_clone/)"; flow:established,to_server; http.uri; content:"/Spotify_clone/"; startswith; fast_pattern; http.host; content:"abhshek-78.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008856; classtype:social-engineering; sid:6008856; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (open-portal-8hjs.p-srkphq9l.workers.dev/l/PoNTeF3YfFQ/)"; flow:established,to_server; http.uri; content:"/l/PoNTeF3YfFQ/"; startswith; fast_pattern; http.host; content:"open-portal-8hjs.p-srkphq9l.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008857; classtype:social-engineering; sid:6008857; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.increasefollowersforinstagram.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.increasefollowersforinstagram.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008858; classtype:social-engineering; sid:6008858; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (25be0c.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"25be0c.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008859; classtype:social-engineering; sid:6008859; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login-page-instagram.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login-page-instagram.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008860; classtype:social-engineering; sid:6008860; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e1c058.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e1c058.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008861; classtype:social-engineering; sid:6008861; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9c2cc0.arcadejafet.cl/H6eBtCQqYCrb9wak52DUBwEGmSjsd3qibdmsmrPNtpev6vPz0LYOuYByK1tv34ES/?rotated=1)"; flow:established,to_server; http.uri; content:"/H6eBtCQqYCrb9wak52DUBwEGmSjsd3qibdmsmrPNtpev6vPz0LYOuYByK1tv34ES/?rotated=1"; startswith; fast_pattern; http.host; content:"9c2cc0.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008862; classtype:social-engineering; sid:6008862; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d066d3.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d066d3.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008863; classtype:social-engineering; sid:6008863; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spectrmweb3onlne.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spectrmweb3onlne.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008864; classtype:social-engineering; sid:6008864; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (walletcoinbase-zeta.vercel.app/download.html)"; flow:established,to_server; http.uri; content:"/download.html"; startswith; fast_pattern; http.host; content:"walletcoinbase-zeta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008865; classtype:social-engineering; sid:6008865; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alliedmiddleeast.com/wp/digitalloginfull-page/l_ogin.php)"; flow:established,to_server; http.uri; content:"/wp/digitalloginfull-page/l_ogin.php"; startswith; fast_pattern; http.host; content:"alliedmiddleeast.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008866; classtype:social-engineering; sid:6008866; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (898fd7.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"898fd7.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008867; classtype:social-engineering; sid:6008867; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a891bf.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a891bf.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008868; classtype:social-engineering; sid:6008868; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (259a86.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"259a86.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008869; classtype:social-engineering; sid:6008869; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitemail.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitemail.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008870; classtype:social-engineering; sid:6008870; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0a2991.arcadejafet.cl/1rTndRPiKL9bUtVGdZ1CB4aAAwjfsmLzWnZjmLauvxOe9RiOIrjQTexG4AhDZ4TW/?rotated=1)"; flow:established,to_server; http.uri; content:"/1rTndRPiKL9bUtVGdZ1CB4aAAwjfsmLzWnZjmLauvxOe9RiOIrjQTexG4AhDZ4TW/?rotated=1"; startswith; fast_pattern; http.host; content:"0a2991.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008871; classtype:social-engineering; sid:6008871; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ce35dd.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ce35dd.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008872; classtype:social-engineering; sid:6008872; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mercadopagobrasil.digital/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mercadopagobrasil.digital"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008873; classtype:social-engineering; sid:6008873; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f885d9.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f885d9.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008874; classtype:social-engineering; sid:6008874; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (23x2x32x-tz1.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"23x2x32x-tz1.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008875; classtype:social-engineering; sid:6008875; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (688883.arcadejafet.cl/WvmGizudcTXtmQBADF3ujDwdUNUFzaZ1MpNCrLQnB0Y0BnpKbS2Toj7UejUEoB52/?rotated=1)"; flow:established,to_server; http.uri; content:"/WvmGizudcTXtmQBADF3ujDwdUNUFzaZ1MpNCrLQnB0Y0BnpKbS2Toj7UejUEoB52/?rotated=1"; startswith; fast_pattern; http.host; content:"688883.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008876; classtype:social-engineering; sid:6008876; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-mu-rosy.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-mu-rosy.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008877; classtype:social-engineering; sid:6008877; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4b224d.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4b224d.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008878; classtype:social-engineering; sid:6008878; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (717ac0.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"717ac0.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008879; classtype:social-engineering; sid:6008879; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c88ea3.arcadejafet.cl/ulWy5tOPmkqR23B2wx2DPPSvbMNJ9n9BTOwqPnJyxGboiA6OoDy5YNUa4INlyza5/?rotated=1)"; flow:established,to_server; http.uri; content:"/ulWy5tOPmkqR23B2wx2DPPSvbMNJ9n9BTOwqPnJyxGboiA6OoDy5YNUa4INlyza5/?rotated=1"; startswith; fast_pattern; http.host; content:"c88ea3.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008880; classtype:social-engineering; sid:6008880; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (906b94.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"906b94.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008881; classtype:social-engineering; sid:6008881; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (skrab-qtwiz-vlypx-5c04ad-srkt-vlasco.pages.dev/appeals/submit-appeal-form/return)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-form/return"; startswith; fast_pattern; http.host; content:"skrab-qtwiz-vlypx-5c04ad-srkt-vlasco.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008882; classtype:social-engineering; sid:6008882; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spotifyasoma.github.io/Javascript-amazon/amazon.html)"; flow:established,to_server; http.uri; content:"/Javascript-amazon/amazon.html"; startswith; fast_pattern; http.host; content:"spotifyasoma.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008883; classtype:social-engineering; sid:6008883; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp13ct-frazor-biz-lensik-hazmel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp13ct-frazor-biz-lensik-hazmel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008884; classtype:social-engineering; sid:6008884; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cakto.app/7Tm34cP/?affiliate=iEK5KwZ7)"; flow:established,to_server; http.uri; content:"/7Tm34cP/?affiliate=iEK5KwZ7"; startswith; fast_pattern; http.host; content:"cakto.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008885; classtype:social-engineering; sid:6008885; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a1406b.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a1406b.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008886; classtype:social-engineering; sid:6008886; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5ef9ae.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"5ef9ae.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008887; classtype:social-engineering; sid:6008887; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6b36c7.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6b36c7.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008888; classtype:social-engineering; sid:6008888; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trck-new-210.casadelfreno.info/ga/click/2-17275556-21-16418-31995-17858-1eb3c9f3af-659f46f282)"; flow:established,to_server; http.uri; content:"/ga/click/2-17275556-21-16418-31995-17858-1eb3c9f3af-659f46f282"; startswith; fast_pattern; http.host; content:"trck-new-210.casadelfreno.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008889; classtype:social-engineering; sid:6008889; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mwizz.leadsbr.com.br/latest/index.php/campaigns/tr945ms1zw413/track-url/mz028zdd19c4e/ba5ef5127add126807499a632a9d2da5f3efbb93)"; flow:established,to_server; http.uri; content:"/latest/index.php/campaigns/tr945ms1zw413/track-url/mz028zdd19c4e/ba5ef5127add126807499a632a9d2da5f3efbb93"; startswith; fast_pattern; http.host; content:"mwizz.leadsbr.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008890; classtype:social-engineering; sid:6008890; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comacstnew.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comacstnew.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008891; classtype:social-engineering; sid:6008891; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rf3zfz3.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rf3zfz3.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008892; classtype:social-engineering; sid:6008892; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3173c7.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3173c7.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008893; classtype:social-engineering; sid:6008893; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-auto-liker.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-auto-liker.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008894; classtype:social-engineering; sid:6008894; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pendaftaraan-pinjaamanbrii.kvv.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pendaftaraan-pinjaamanbrii.kvv.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008895; classtype:social-engineering; sid:6008895; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (73b70c.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"73b70c.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008896; classtype:social-engineering; sid:6008896; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a1d504.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a1d504.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008897; classtype:social-engineering; sid:6008897; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bancolombiacupoaumento.vercel.app/seguro.php)"; flow:established,to_server; http.uri; content:"/seguro.php"; startswith; fast_pattern; http.host; content:"bancolombiacupoaumento.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008898; classtype:social-engineering; sid:6008898; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (laleler.com/assets.adobe/file/)"; flow:established,to_server; http.uri; content:"/assets.adobe/file/"; startswith; fast_pattern; http.host; content:"laleler.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008899; classtype:social-engineering; sid:6008899; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5a6a3b.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"5a6a3b.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008900; classtype:social-engineering; sid:6008900; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (waxysbobcat.com/wetrsa/redocevalteredocsfilesx/index.html?email=a.b@c)"; flow:established,to_server; http.uri; content:"/wetrsa/redocevalteredocsfilesx/index.html?email=a.b@c"; startswith; fast_pattern; http.host; content:"waxysbobcat.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008901; classtype:social-engineering; sid:6008901; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (htps-www-roblox.co/login?returnUrl=1789978322)"; flow:established,to_server; http.uri; content:"/login?returnUrl=1789978322"; startswith; fast_pattern; http.host; content:"htps-www-roblox.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008902; classtype:social-engineering; sid:6008902; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c8dea0.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c8dea0.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008903; classtype:social-engineering; sid:6008903; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4a1ab8.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4a1ab8.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008904; classtype:social-engineering; sid:6008904; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee5155.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.shopee5155.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008905; classtype:social-engineering; sid:6008905; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4c7ab6.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4c7ab6.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008906; classtype:social-engineering; sid:6008906; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cb759f.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cb759f.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008907; classtype:social-engineering; sid:6008907; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityconnectxxx.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinityconnectxxx.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008908; classtype:social-engineering; sid:6008908; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-claude-infra-2904-okx-evm-only-solana-uniswap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-claude-infra-2904-okx-evm-only-solana-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008909; classtype:social-engineering; sid:6008909; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1767e5.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1767e5.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008910; classtype:social-engineering; sid:6008910; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fcss54lkwg-zbyrk65spli-3ce41c-zby9q.pages.dev/appeals/submit-appeal-form/return)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-form/return"; startswith; fast_pattern; http.host; content:"fcss54lkwg-zbyrk65spli-3ce41c-zby9q.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008911; classtype:social-engineering; sid:6008911; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (60f918.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"60f918.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008912; classtype:social-engineering; sid:6008912; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17570.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17570.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008913; classtype:social-engineering; sid:6008913; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hbkpt7agpxo-xlbdwmja-2e7f3b-hbk96c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hbkpt7agpxo-xlbdwmja-2e7f3b-hbk96c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008914; classtype:social-engineering; sid:6008914; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.88417.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.88417.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008915; classtype:social-engineering; sid:6008915; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (449d14.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"449d14.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008916; classtype:social-engineering; sid:6008916; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee857.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.shopee857.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008917; classtype:social-engineering; sid:6008917; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (project-token-shakre.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"project-token-shakre.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008918; classtype:social-engineering; sid:6008918; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (researchsquare.cfd/kr/dmlkorea.html)"; flow:established,to_server; http.uri; content:"/kr/dmlkorea.html"; startswith; fast_pattern; http.host; content:"researchsquare.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008919; classtype:social-engineering; sid:6008919; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8131cc.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8131cc.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008920; classtype:social-engineering; sid:6008920; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (680184.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"680184.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008921; classtype:social-engineering; sid:6008921; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.insta-clone-page.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.insta-clone-page.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008922; classtype:social-engineering; sid:6008922; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (helm.tekmob.com/pim/attmyaccount)"; flow:established,to_server; http.uri; content:"/pim/attmyaccount"; startswith; fast_pattern; http.host; content:"helm.tekmob.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008923; classtype:social-engineering; sid:6008923; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pranavraj0562.github.io/Alfido_Tech_Task3/)"; flow:established,to_server; http.uri; content:"/Alfido_Tech_Task3/"; startswith; fast_pattern; http.host; content:"pranavraj0562.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008924; classtype:social-engineering; sid:6008924; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (surcursalvirtualcolombia.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"surcursalvirtualcolombia.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008925; classtype:social-engineering; sid:6008925; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3a2a3e.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3a2a3e.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008926; classtype:social-engineering; sid:6008926; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a46964.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a46964.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008927; classtype:social-engineering; sid:6008927; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c90ef3.arcadejafet.cl/rcrvuga7ytcPgKX94psoRzfKPHGYXV306sZgrXzvcRONZ8Sip74oA0AG7CPbWhk7/?rotated=1)"; flow:established,to_server; http.uri; content:"/rcrvuga7ytcPgKX94psoRzfKPHGYXV306sZgrXzvcRONZ8Sip74oA0AG7CPbWhk7/?rotated=1"; startswith; fast_pattern; http.host; content:"c90ef3.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008928; classtype:social-engineering; sid:6008928; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ez33z3z3z3.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ez33z3z3z3.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008929; classtype:social-engineering; sid:6008929; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-auto-liker.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-auto-liker.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008930; classtype:social-engineering; sid:6008930; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (joshyyyjoel.github.io/phishing/)"; flow:established,to_server; http.uri; content:"/phishing/"; startswith; fast_pattern; http.host; content:"joshyyyjoel.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008931; classtype:social-engineering; sid:6008931; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiture-menupay-id.gredfu.hair/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fiture-menupay-id.gredfu.hair"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008932; classtype:social-engineering; sid:6008932; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (326968.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"326968.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008933; classtype:social-engineering; sid:6008933; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bankofamerica.qpon/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bankofamerica.qpon"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008934; classtype:social-engineering; sid:6008934; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accounts.relayauth.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"accounts.relayauth.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008935; classtype:social-engineering; sid:6008935; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d80921.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d80921.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008936; classtype:social-engineering; sid:6008936; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (insta-clone-page.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"insta-clone-page.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008937; classtype:social-engineering; sid:6008937; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steamcommummity.cam/tradeoffer/new/partner=LD287431942tokenKnMD5012351317)"; flow:established,to_server; http.uri; content:"/tradeoffer/new/partner=LD287431942tokenKnMD5012351317"; startswith; fast_pattern; http.host; content:"steamcommummity.cam"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008938; classtype:social-engineering; sid:6008938; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bvcuh.wasmer.app/?entity=1994173)"; flow:established,to_server; http.uri; content:"/?entity=1994173"; startswith; fast_pattern; http.host; content:"bvcuh.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008939; classtype:social-engineering; sid:6008939; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (financialhealthsupport.com/6197094-oH1faBZb-PKS9Q)"; flow:established,to_server; http.uri; content:"/6197094-oH1faBZb-PKS9Q"; startswith; fast_pattern; http.host; content:"financialhealthsupport.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008940; classtype:social-engineering; sid:6008940; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0784c5.arcadejafet.cl/zHQ90fN5Ggnhz3U8LHZ2nDeGcTZct0kX8XemGz9fS1eAklXsKmMwUMqSCOAtRatz/?rotated=1)"; flow:established,to_server; http.uri; content:"/zHQ90fN5Ggnhz3U8LHZ2nDeGcTZct0kX8XemGz9fS1eAklXsKmMwUMqSCOAtRatz/?rotated=1"; startswith; fast_pattern; http.host; content:"0784c5.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008941; classtype:social-engineering; sid:6008941; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (am.wegae.best/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"am.wegae.best"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008942; classtype:social-engineering; sid:6008942; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (umaimazainab02.github.io/whatsapp)"; flow:established,to_server; http.uri; content:"/whatsapp"; startswith; fast_pattern; http.host; content:"umaimazainab02.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008943; classtype:social-engineering; sid:6008943; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6c42b9.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6c42b9.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008944; classtype:social-engineering; sid:6008944; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (capability-ledger-dashboard-eii.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"capability-ledger-dashboard-eii.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008945; classtype:social-engineering; sid:6008945; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (88bdc7.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"88bdc7.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008946; classtype:social-engineering; sid:6008946; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinb534534.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coinb534534.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008947; classtype:social-engineering; sid:6008947; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lasmejoresmxfla.mx/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lasmejoresmxfla.mx"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008948; classtype:social-engineering; sid:6008948; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7309cd.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7309cd.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008949; classtype:social-engineering; sid:6008949; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee857.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopee857.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008950; classtype:social-engineering; sid:6008950; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ff6aa7.arcadejafet.cl/JgRaow0Pf1KlfaPYuyc3UXdj6MGzvd4ylmBGxWhq3zP8hyC6b2uCcq8mki1BAXCc/?rotated=1)"; flow:established,to_server; http.uri; content:"/JgRaow0Pf1KlfaPYuyc3UXdj6MGzvd4ylmBGxWhq3zP8hyC6b2uCcq8mki1BAXCc/?rotated=1"; startswith; fast_pattern; http.host; content:"ff6aa7.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008951; classtype:social-engineering; sid:6008951; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f7a353.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f7a353.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008952; classtype:social-engineering; sid:6008952; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2acf00.arcadejafet.cl/eAaxNbi1F7Dpt0AxIzp4RGhFlS9by2AWN5ee0ukDxqWITVstiJAm0Cif4W3XGDbH/?rotated=1)"; flow:established,to_server; http.uri; content:"/eAaxNbi1F7Dpt0AxIzp4RGhFlS9by2AWN5ee0ukDxqWITVstiJAm0Cif4W3XGDbH/?rotated=1"; startswith; fast_pattern; http.host; content:"2acf00.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008953; classtype:social-engineering; sid:6008953; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8635f6.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8635f6.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008954; classtype:social-engineering; sid:6008954; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.grandprize97.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.grandprize97.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008955; classtype:social-engineering; sid:6008955; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vcbnxbmn.b-cdn.net/all1.html)"; flow:established,to_server; http.uri; content:"/all1.html"; startswith; fast_pattern; http.host; content:"vcbnxbmn.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008956; classtype:social-engineering; sid:6008956; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (626981.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"626981.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008957; classtype:social-engineering; sid:6008957; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (42336f.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"42336f.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008958; classtype:social-engineering; sid:6008958; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a039e7.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a039e7.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008959; classtype:social-engineering; sid:6008959; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (67cb53.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"67cb53.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008960; classtype:social-engineering; sid:6008960; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bgrnd1ekq-phvjn98plos-2c4d9a-zby7w.pages.dev/appeals/submit-appeal-form/return)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-form/return"; startswith; fast_pattern; http.host; content:"bgrnd1ekq-phvjn98plos-2c4d9a-zby7w.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008961; classtype:social-engineering; sid:6008961; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.nodoespacio.com/MSND/)"; flow:established,to_server; http.uri; content:"/MSND/"; startswith; fast_pattern; http.host; content:"www.nodoespacio.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008962; classtype:social-engineering; sid:6008962; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (370113.arcadejafet.cl/dkwM6FVJ3ZCXCG9OjQR6gCfTgAdCFggXw7goJGutUvanfU0V6nNiC2x34wzYarMV/?rotated=1)"; flow:established,to_server; http.uri; content:"/dkwM6FVJ3ZCXCG9OjQR6gCfTgAdCFggXw7goJGutUvanfU0V6nNiC2x34wzYarMV/?rotated=1"; startswith; fast_pattern; http.host; content:"370113.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008963; classtype:social-engineering; sid:6008963; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a6c19a.arcadejafet.cl/qzjTcgkNiBNw92RBRGGT6I5p9ze7OirwxdKfJxlR9NbDhPoUe0VgBsvJWs3t9sb0/?rotated=1)"; flow:established,to_server; http.uri; content:"/qzjTcgkNiBNw92RBRGGT6I5p9ze7OirwxdKfJxlR9NbDhPoUe0VgBsvJWs3t9sb0/?rotated=1"; startswith; fast_pattern; http.host; content:"a6c19a.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008964; classtype:social-engineering; sid:6008964; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (25a290.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"25a290.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008965; classtype:social-engineering; sid:6008965; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (820443.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"820443.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008966; classtype:social-engineering; sid:6008966; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (312c2c.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"312c2c.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008967; classtype:social-engineering; sid:6008967; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sucrsalpersonastdc.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sucrsalpersonastdc.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008968; classtype:social-engineering; sid:6008968; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (140bc1.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"140bc1.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008969; classtype:social-engineering; sid:6008969; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (26c2bf.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"26c2bf.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008970; classtype:social-engineering; sid:6008970; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamask-docs-l8lvh00ol-consensys-ddffed67.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"metamask-docs-l8lvh00ol-consensys-ddffed67.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008971; classtype:social-engineering; sid:6008971; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a12a99.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a12a99.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008972; classtype:social-engineering; sid:6008972; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (messenger-security-notification-ads.one/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"messenger-security-notification-ads.one"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008973; classtype:social-engineering; sid:6008973; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portalrodoviassp.online/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portalrodoviassp.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008974; classtype:social-engineering; sid:6008974; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b8a47a.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b8a47a.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008975; classtype:social-engineering; sid:6008975; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (84c567.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"84c567.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008976; classtype:social-engineering; sid:6008976; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ntanu5942-eng200.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"ntanu5942-eng200.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008977; classtype:social-engineering; sid:6008977; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d4fdf8.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d4fdf8.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008978; classtype:social-engineering; sid:6008978; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp25ct7-kervok-biz-zemlen-palsik.pages.dev/appeals/submit-appeal-form/return)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-form/return"; startswith; fast_pattern; http.host; content:"sp25ct7-kervok-biz-zemlen-palsik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008979; classtype:social-engineering; sid:6008979; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adityakumar1241.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"adityakumar1241.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008980; classtype:social-engineering; sid:6008980; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cxqhsyzql.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cxqhsyzql.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008981; classtype:social-engineering; sid:6008981; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfiniityupdates.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfiniityupdates.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008982; classtype:social-engineering; sid:6008982; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (garantilihall.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"garantilihall.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008983; classtype:social-engineering; sid:6008983; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktifkanxz-fromnpaylter.lifesstylenew.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktifkanxz-fromnpaylter.lifesstylenew.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008984; classtype:social-engineering; sid:6008984; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b91946.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b91946.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008985; classtype:social-engineering; sid:6008985; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p2pbybit-audit.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p2pbybit-audit.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008986; classtype:social-engineering; sid:6008986; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (feb6cd.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"feb6cd.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008987; classtype:social-engineering; sid:6008987; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (df6b59.arcadejafet.cl/62fVycBPSc49oVuNKhOHJfmFGgBynmVy7gSbeI9xfFIrSrDyO7QtB07CzyPBkk5g/?rotated=1)"; flow:established,to_server; http.uri; content:"/62fVycBPSc49oVuNKhOHJfmFGgBynmVy7gSbeI9xfFIrSrDyO7QtB07CzyPBkk5g/?rotated=1"; startswith; fast_pattern; http.host; content:"df6b59.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008988; classtype:social-engineering; sid:6008988; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (626984.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"626984.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008989; classtype:social-engineering; sid:6008989; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (undian-shopee536.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"undian-shopee536.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008990; classtype:social-engineering; sid:6008990; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1a030c.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1a030c.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008991; classtype:social-engineering; sid:6008991; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7fc5e3.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7fc5e3.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008992; classtype:social-engineering; sid:6008992; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (23c32c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"23c32c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008993; classtype:social-engineering; sid:6008993; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dfa9f8.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dfa9f8.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008994; classtype:social-engineering; sid:6008994; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (asifdental.com/metalworkservice/index.php)"; flow:established,to_server; http.uri; content:"/metalworkservice/index.php"; startswith; fast_pattern; http.host; content:"asifdental.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008995; classtype:social-engineering; sid:6008995; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (99fbc9.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"99fbc9.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008996; classtype:social-engineering; sid:6008996; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.trezor.my/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.trezor.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008997; classtype:social-engineering; sid:6008997; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dd32a7.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dd32a7.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008998; classtype:social-engineering; sid:6008998; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (malienterprises.com/exe/app)"; flow:established,to_server; http.uri; content:"/exe/app"; startswith; fast_pattern; http.host; content:"malienterprises.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008999; classtype:social-engineering; sid:6008999; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (firststepfloors.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"firststepfloors.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009000; classtype:social-engineering; sid:6009000; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (31e2f6.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"31e2f6.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009001; classtype:social-engineering; sid:6009001; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso-security.com/E.NW9c9LFSH59KJwLj?/aG94aHVudA)"; flow:established,to_server; http.uri; content:"/E.NW9c9LFSH59KJwLj?/aG94aHVudA"; startswith; fast_pattern; http.host; content:"sso-security.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009002; classtype:social-engineering; sid:6009002; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (095a33.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"095a33.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009003; classtype:social-engineering; sid:6009003; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2c74f3.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2c74f3.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009004; classtype:social-engineering; sid:6009004; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6efc9f.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6efc9f.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009005; classtype:social-engineering; sid:6009005; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (59f990.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"59f990.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009006; classtype:social-engineering; sid:6009006; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fiturrr-menuupayz.gredfu.hair/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fiturrr-menuupayz.gredfu.hair"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009007; classtype:social-engineering; sid:6009007; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.0ffice365qrcodeconfirmation.un-cnd.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.0ffice365qrcodeconfirmation.un-cnd.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009008; classtype:social-engineering; sid:6009008; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seulimiteturbolivre.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"seulimiteturbolivre.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009009; classtype:social-engineering; sid:6009009; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mnmusichalloffame.org/wp-admin/admin/dev/resolveproj/adobpage.html)"; flow:established,to_server; http.uri; content:"/wp-admin/admin/dev/resolveproj/adobpage.html"; startswith; fast_pattern; http.host; content:"mnmusichalloffame.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009010; classtype:social-engineering; sid:6009010; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (delivery.ce.classplus.co/DRBVAFYVFJT?id=178324=dxpUVVQKAVNQTQIEV1UGBQABBgYGAQkDD1BRBlVQAVhXX1BSBgNTVVBVUFIFA1JSAQBPV1tSVlJRAEdDUglUFHQBCQUKXhwCC1wYV1MJAAUIBAIEBwYNAAZXAgZLDUwVRFxLSwdXXggSVBYfSlJTGFtZUkBBQ1RCRU9XWBghaiNiJyI9NXR4NVtYABoSAg==&fl=XBIQFBAIHU4UQw0LARxAX1xQXB1TQ0g=&ext=dG9rZW49MzFhYWVjYWQ=)"; flow:established,to_server; http.uri; content:"/DRBVAFYVFJT?id=178324=dxpUVVQKAVNQTQIEV1UGBQABBgYGAQkDD1BRBlVQAVhXX1BSBgNTVVBVUFIFA1JSAQBPV1tSVlJRAEdDUglUFHQBCQUKXhwCC1wYV1MJAAUIBAIEBwYNAAZXAgZLDUwVRFxLSwdXXggSVBYfSlJTGFtZUkBBQ1RCRU9XWBghaiNiJyI9NXR4NVtYABoSAg==&fl=XBIQFBAIHU4UQw0LARxAX1xQXB1TQ0g=&ext=dG9rZW49MzFhYWVjYWQ="; startswith; fast_pattern; http.host; content:"delivery.ce.classplus.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009011; classtype:social-engineering; sid:6009011; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f0f3bf.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f0f3bf.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009012; classtype:social-engineering; sid:6009012; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ef3748.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ef3748.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009013; classtype:social-engineering; sid:6009013; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (grandprize97.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"grandprize97.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009014; classtype:social-engineering; sid:6009014; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (78u03i-heq-tbt-65sg-2co6vb.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"78u03i-heq-tbt-65sg-2co6vb.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009015; classtype:social-engineering; sid:6009015; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinity-signon.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinity-signon.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009016; classtype:social-engineering; sid:6009016; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6f6a12.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6f6a12.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009017; classtype:social-engineering; sid:6009017; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (speectrummailreal.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"speectrummailreal.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009018; classtype:social-engineering; sid:6009018; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (buyghar.com/js/dhl-new.html)"; flow:established,to_server; http.uri; content:"/js/dhl-new.html"; startswith; fast_pattern; http.host; content:"buyghar.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009019; classtype:social-engineering; sid:6009019; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc7298.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dc7298.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009020; classtype:social-engineering; sid:6009020; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (036def.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"036def.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009021; classtype:social-engineering; sid:6009021; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5a9f05.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"5a9f05.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009022; classtype:social-engineering; sid:6009022; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3a8567.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3a8567.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009023; classtype:social-engineering; sid:6009023; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (220de2.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"220de2.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009024; classtype:social-engineering; sid:6009024; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (302555.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"302555.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009025; classtype:social-engineering; sid:6009025; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (38dfc0.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"38dfc0.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009026; classtype:social-engineering; sid:6009026; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f179ed.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f179ed.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009027; classtype:social-engineering; sid:6009027; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7756cb.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7756cb.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009028; classtype:social-engineering; sid:6009028; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fc2dd7.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fc2dd7.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009029; classtype:social-engineering; sid:6009029; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c0ec32.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c0ec32.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009030; classtype:social-engineering; sid:6009030; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bybltxeu.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bybltxeu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009031; classtype:social-engineering; sid:6009031; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c37a22.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c37a22.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009032; classtype:social-engineering; sid:6009032; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (58eba4.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"58eba4.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009033; classtype:social-engineering; sid:6009033; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-att-com-9161be.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"account-att-com-9161be.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009034; classtype:social-engineering; sid:6009034; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sedeagencbe.yoga/ES)"; flow:established,to_server; http.uri; content:"/ES"; startswith; fast_pattern; http.host; content:"sedeagencbe.yoga"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009035; classtype:social-engineering; sid:6009035; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (my-site-101371-101178.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"my-site-101371-101178.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009036; classtype:social-engineering; sid:6009036; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comacastnet.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comacastnet.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009037; classtype:social-engineering; sid:6009037; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (approval58.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"approval58.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009038; classtype:social-engineering; sid:6009038; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eeeeappisecom.flazio.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eeeeappisecom.flazio.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009039; classtype:social-engineering; sid:6009039; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e0f53d.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e0f53d.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009040; classtype:social-engineering; sid:6009040; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6e87d7.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6e87d7.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009041; classtype:social-engineering; sid:6009041; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastwebmailinternet.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastwebmailinternet.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009042; classtype:social-engineering; sid:6009042; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9616b8.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9616b8.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009043; classtype:social-engineering; sid:6009043; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitycomservice.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitycomservice.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009044; classtype:social-engineering; sid:6009044; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7bd1e2.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7bd1e2.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009045; classtype:social-engineering; sid:6009045; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1faf5d.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1faf5d.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009046; classtype:social-engineering; sid:6009046; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3247fd.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3247fd.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009047; classtype:social-engineering; sid:6009047; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (monespace-primefamily.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"monespace-primefamily.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009048; classtype:social-engineering; sid:6009048; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (86dd83.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"86dd83.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009049; classtype:social-engineering; sid:6009049; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0bc483.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0bc483.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009050; classtype:social-engineering; sid:6009050; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastinternetserver.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastinternetserver.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009051; classtype:social-engineering; sid:6009051; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8bcf53.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8bcf53.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009052; classtype:social-engineering; sid:6009052; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (farshid.ali-azizi2672.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"farshid.ali-azizi2672.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009053; classtype:social-engineering; sid:6009053; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (431a55.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"431a55.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009054; classtype:social-engineering; sid:6009054; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ba876b.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ba876b.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009055; classtype:social-engineering; sid:6009055; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (38364f.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"38364f.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009056; classtype:social-engineering; sid:6009056; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (44926a.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"44926a.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009057; classtype:social-engineering; sid:6009057; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (48ff19.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"48ff19.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009058; classtype:social-engineering; sid:6009058; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4f8b5b.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4f8b5b.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009059; classtype:social-engineering; sid:6009059; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comacastnet.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comacastnet.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009060; classtype:social-engineering; sid:6009060; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (13cb4e.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"13cb4e.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009061; classtype:social-engineering; sid:6009061; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tcaconnect.ac-page.com/toronto-construction-association-inc/)"; flow:established,to_server; http.uri; content:"/toronto-construction-association-inc/"; startswith; fast_pattern; http.host; content:"tcaconnect.ac-page.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009062; classtype:social-engineering; sid:6009062; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee8083.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"shopee8083.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009063; classtype:social-engineering; sid:6009063; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (af7b1e.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"af7b1e.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009064; classtype:social-engineering; sid:6009064; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1ec0a1.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1ec0a1.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009065; classtype:social-engineering; sid:6009065; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f371ab.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f371ab.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009066; classtype:social-engineering; sid:6009066; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (da22fb.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"da22fb.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009067; classtype:social-engineering; sid:6009067; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3677e0.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3677e0.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009068; classtype:social-engineering; sid:6009068; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6e074b.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6e074b.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009069; classtype:social-engineering; sid:6009069; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5f319d.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"5f319d.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009070; classtype:social-engineering; sid:6009070; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (494a21.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"494a21.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009071; classtype:social-engineering; sid:6009071; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8ba778.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8ba778.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009072; classtype:social-engineering; sid:6009072; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (326955.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"326955.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009073; classtype:social-engineering; sid:6009073; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (34e7d6.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"34e7d6.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009074; classtype:social-engineering; sid:6009074; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (exoduusweb3-wallets.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"exoduusweb3-wallets.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009075; classtype:social-engineering; sid:6009075; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kikisandwich.com/feder.php)"; flow:established,to_server; http.uri; content:"/feder.php"; startswith; fast_pattern; http.host; content:"kikisandwich.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009076; classtype:social-engineering; sid:6009076; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7ebd80.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7ebd80.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009077; classtype:social-engineering; sid:6009077; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c267cf.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c267cf.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009078; classtype:social-engineering; sid:6009078; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (82bab7.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"82bab7.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009079; classtype:social-engineering; sid:6009079; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc.crsorgi.gov.in-crs.org/CRS/verifyCertificate.php)"; flow:established,to_server; http.uri; content:"/CRS/verifyCertificate.php"; startswith; fast_pattern; http.host; content:"dc.crsorgi.gov.in-crs.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009080; classtype:social-engineering; sid:6009080; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (satwika.id/KVSgT)"; flow:established,to_server; http.uri; content:"/KVSgT"; startswith; fast_pattern; http.host; content:"satwika.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009081; classtype:social-engineering; sid:6009081; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lootlist.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lootlist.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009082; classtype:social-engineering; sid:6009082; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b981c4.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b981c4.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009083; classtype:social-engineering; sid:6009083; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (473e4a.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"473e4a.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009084; classtype:social-engineering; sid:6009084; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f7c495.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f7c495.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009085; classtype:social-engineering; sid:6009085; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e1a894.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e1a894.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009086; classtype:social-engineering; sid:6009086; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (51d1de.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"51d1de.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009087; classtype:social-engineering; sid:6009087; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityorglo.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinityorglo.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009088; classtype:social-engineering; sid:6009088; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.x11.pw/bVayq/)"; flow:established,to_server; http.uri; content:"/bVayq/"; startswith; fast_pattern; http.host; content:"www.x11.pw"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009089; classtype:social-engineering; sid:6009089; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (39397e.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"39397e.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009090; classtype:social-engineering; sid:6009090; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mrxqnbet3com.5tx9q2zb7j.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mrxqnbet3com.5tx9q2zb7j.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009091; classtype:social-engineering; sid:6009091; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9a3c94.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9a3c94.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009092; classtype:social-engineering; sid:6009092; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0c6b45.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0c6b45.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009093; classtype:social-engineering; sid:6009093; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gemini-balance.fly2me.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gemini-balance.fly2me.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009094; classtype:social-engineering; sid:6009094; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (72888f.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"72888f.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009095; classtype:social-engineering; sid:6009095; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (662d06.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"662d06.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009096; classtype:social-engineering; sid:6009096; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (16368d.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"16368d.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009097; classtype:social-engineering; sid:6009097; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c7a724.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c7a724.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009098; classtype:social-engineering; sid:6009098; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (839c0a.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"839c0a.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009099; classtype:social-engineering; sid:6009099; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mkgnh.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mkgnh.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009100; classtype:social-engineering; sid:6009100; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e9604c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e9604c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009101; classtype:social-engineering; sid:6009101; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e3f23f.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e3f23f.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009102; classtype:social-engineering; sid:6009102; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (862464.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"862464.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009103; classtype:social-engineering; sid:6009103; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bc80a8.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bc80a8.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009104; classtype:social-engineering; sid:6009104; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e4bfa9.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e4bfa9.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009105; classtype:social-engineering; sid:6009105; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (160698.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"160698.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009106; classtype:social-engineering; sid:6009106; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (licksquest071.onrender.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"licksquest071.onrender.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009107; classtype:social-engineering; sid:6009107; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityemailconnect.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinityemailconnect.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009108; classtype:social-engineering; sid:6009108; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (827ab1.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"827ab1.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009109; classtype:social-engineering; sid:6009109; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t0w9q3y8r8m3c7x1saf9d2l0px9t2qf7l0w8s3iy9py9t7q2f1l8w0v7m2r.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"t0w9q3y8r8m3c7x1saf9d2l0px9t2qf7l0w8s3iy9py9t7q2f1l8w0v7m2r.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009110; classtype:social-engineering; sid:6009110; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c16332.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c16332.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009111; classtype:social-engineering; sid:6009111; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a9e486.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a9e486.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009112; classtype:social-engineering; sid:6009112; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (64618654-checkout.renewplan.click/checkout?token=69eeb548114e2b4da7209316b8f86743&token=69eeb548114e2b4da7209316b8f86743)"; flow:established,to_server; http.uri; content:"/checkout?token=69eeb548114e2b4da7209316b8f86743&token=69eeb548114e2b4da7209316b8f86743"; startswith; fast_pattern; http.host; content:"64618654-checkout.renewplan.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009113; classtype:social-engineering; sid:6009113; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xlbdw620low-hbkpthb-8a7c4f-xlq07c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xlbdw620low-hbkpthb-8a7c4f-xlq07c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009114; classtype:social-engineering; sid:6009114; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (access-trzorsuite.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"access-trzorsuite.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009115; classtype:social-engineering; sid:6009115; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (koredanespice.com/sada/function/c/)"; flow:established,to_server; http.uri; content:"/sada/function/c/"; startswith; fast_pattern; http.host; content:"koredanespice.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009116; classtype:social-engineering; sid:6009116; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0a88a7.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0a88a7.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009117; classtype:social-engineering; sid:6009117; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cfd907.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cfd907.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009118; classtype:social-engineering; sid:6009118; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (096072.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"096072.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009119; classtype:social-engineering; sid:6009119; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ternuevatu.lat/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ternuevatu.lat"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009120; classtype:social-engineering; sid:6009120; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a939e9.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a939e9.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009121; classtype:social-engineering; sid:6009121; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (223784.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"223784.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009122; classtype:social-engineering; sid:6009122; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6a28c3.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6a28c3.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009123; classtype:social-engineering; sid:6009123; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (77a14d.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"77a14d.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009124; classtype:social-engineering; sid:6009124; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e302b9.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e302b9.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009125; classtype:social-engineering; sid:6009125; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezorsdevices.support/a/)"; flow:established,to_server; http.uri; content:"/a/"; startswith; fast_pattern; http.host; content:"trezorsdevices.support"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009126; classtype:social-engineering; sid:6009126; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brave-tan-h4doupvw.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"brave-tan-h4doupvw.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009127; classtype:social-engineering; sid:6009127; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5b5f88.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"5b5f88.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009128; classtype:social-engineering; sid:6009128; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (52f801.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"52f801.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009129; classtype:social-engineering; sid:6009129; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (328315906745954326.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"328315906745954326.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009130; classtype:social-engineering; sid:6009130; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.done4you.tv/following/disclosures.html)"; flow:established,to_server; http.uri; content:"/following/disclosures.html"; startswith; fast_pattern; http.host; content:"www.done4you.tv"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009131; classtype:social-engineering; sid:6009131; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (30cb0d.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"30cb0d.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009132; classtype:social-engineering; sid:6009132; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roelliroelli.shieldednetworks.de/qpxCz)"; flow:established,to_server; http.uri; content:"/qpxCz"; startswith; fast_pattern; http.host; content:"roelliroelli.shieldednetworks.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009133; classtype:social-engineering; sid:6009133; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aed61c.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aed61c.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009134; classtype:social-engineering; sid:6009134; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9153a6.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9153a6.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009135; classtype:social-engineering; sid:6009135; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6e5467.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6e5467.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009136; classtype:social-engineering; sid:6009136; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (38c6af.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"38c6af.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009137; classtype:social-engineering; sid:6009137; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (53fbdd.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"53fbdd.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009138; classtype:social-engineering; sid:6009138; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d40eec.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d40eec.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009139; classtype:social-engineering; sid:6009139; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sedeagenclr.click/ES)"; flow:established,to_server; http.uri; content:"/ES"; startswith; fast_pattern; http.host; content:"sedeagenclr.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009140; classtype:social-engineering; sid:6009140; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9983f2.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9983f2.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009141; classtype:social-engineering; sid:6009141; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (626948.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"626948.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009142; classtype:social-engineering; sid:6009142; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (626945.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"626945.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009143; classtype:social-engineering; sid:6009143; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9dd214.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9dd214.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009144; classtype:social-engineering; sid:6009144; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9c14a0.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9c14a0.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009145; classtype:social-engineering; sid:6009145; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (94b0b0.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"94b0b0.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009146; classtype:social-engineering; sid:6009146; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a0eb38.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a0eb38.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009147; classtype:social-engineering; sid:6009147; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (697ed3.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"697ed3.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009148; classtype:social-engineering; sid:6009148; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (68a262.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"68a262.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009149; classtype:social-engineering; sid:6009149; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (focused-ivory-owl.31-22-7-7.cpanel.site/alt/in/)"; flow:established,to_server; http.uri; content:"/alt/in/"; startswith; fast_pattern; http.host; content:"focused-ivory-owl.31-22-7-7.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009150; classtype:social-engineering; sid:6009150; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e704d5.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e704d5.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009151; classtype:social-engineering; sid:6009151; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (74ed60.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"74ed60.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009152; classtype:social-engineering; sid:6009152; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c48c27.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c48c27.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009153; classtype:social-engineering; sid:6009153; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (06fe0a.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"06fe0a.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009154; classtype:social-engineering; sid:6009154; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcsat.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcsat.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009155; classtype:social-engineering; sid:6009155; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jesuiseonlineserpplsuiseonlmiredamanokbrosre.shn-host.ru/wp/wp-includes/assets/vbv/app/login.php)"; flow:established,to_server; http.uri; content:"/wp/wp-includes/assets/vbv/app/login.php"; startswith; fast_pattern; http.host; content:"jesuiseonlineserpplsuiseonlmiredamanokbrosre.shn-host.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009156; classtype:social-engineering; sid:6009156; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b0b112.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b0b112.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009157; classtype:social-engineering; sid:6009157; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastmailin.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastmailin.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009158; classtype:social-engineering; sid:6009158; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (solopn-dpoan627b9dy.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"solopn-dpoan627b9dy.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009159; classtype:social-engineering; sid:6009159; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (digitech.pk/dhl/dhl/)"; flow:established,to_server; http.uri; content:"/dhl/dhl/"; startswith; fast_pattern; http.host; content:"digitech.pk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009160; classtype:social-engineering; sid:6009160; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f968b5.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f968b5.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009161; classtype:social-engineering; sid:6009161; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e18cb9.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e18cb9.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009162; classtype:social-engineering; sid:6009162; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cf0702.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cf0702.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009163; classtype:social-engineering; sid:6009163; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-meqwhjdof.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-meqwhjdof.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009164; classtype:social-engineering; sid:6009164; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (87cd53.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"87cd53.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009165; classtype:social-engineering; sid:6009165; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c35fba.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c35fba.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009166; classtype:social-engineering; sid:6009166; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfiinityupdates.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfiinityupdates.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009167; classtype:social-engineering; sid:6009167; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danaaa-paaylaateerr.twaz.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danaaa-paaylaateerr.twaz.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009168; classtype:social-engineering; sid:6009168; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.zuendzuerich.ch/#0754)"; flow:established,to_server; http.uri; content:"/#0754"; startswith; fast_pattern; http.host; content:"www.zuendzuerich.ch"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009169; classtype:social-engineering; sid:6009169; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (287d41.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"287d41.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009170; classtype:social-engineering; sid:6009170; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e8fcd6.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e8fcd6.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009171; classtype:social-engineering; sid:6009171; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f4967f.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f4967f.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009172; classtype:social-engineering; sid:6009172; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (69737c.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"69737c.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009173; classtype:social-engineering; sid:6009173; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9aeef0.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9aeef0.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009174; classtype:social-engineering; sid:6009174; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4e2a38.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4e2a38.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009175; classtype:social-engineering; sid:6009175; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bfa508.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bfa508.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009176; classtype:social-engineering; sid:6009176; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (70f2b8.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"70f2b8.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009177; classtype:social-engineering; sid:6009177; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cea6c5.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cea6c5.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009178; classtype:social-engineering; sid:6009178; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0a3348.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0a3348.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009179; classtype:social-engineering; sid:6009179; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (92881f.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"92881f.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009180; classtype:social-engineering; sid:6009180; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.noticeofpleadings.net/lumma/domainseizurenotice.htm)"; flow:established,to_server; http.uri; content:"/lumma/domainseizurenotice.htm"; startswith; fast_pattern; http.host; content:"www.noticeofpleadings.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009181; classtype:social-engineering; sid:6009181; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f93d1f.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f93d1f.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009182; classtype:social-engineering; sid:6009182; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6a048b.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6a048b.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009183; classtype:social-engineering; sid:6009183; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6635e6.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6635e6.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009184; classtype:social-engineering; sid:6009184; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (374701.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"374701.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009185; classtype:social-engineering; sid:6009185; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (26297e.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"26297e.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009186; classtype:social-engineering; sid:6009186; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8e8527.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8e8527.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009187; classtype:social-engineering; sid:6009187; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b96b66.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b96b66.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009188; classtype:social-engineering; sid:6009188; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (89da5c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"89da5c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009189; classtype:social-engineering; sid:6009189; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e0122b.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e0122b.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009190; classtype:social-engineering; sid:6009190; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcsat.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcsat.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009191; classtype:social-engineering; sid:6009191; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (45ecdb.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"45ecdb.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009192; classtype:social-engineering; sid:6009192; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cf74eb.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cf74eb.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009193; classtype:social-engineering; sid:6009193; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fc1b14.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fc1b14.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009194; classtype:social-engineering; sid:6009194; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cca42f.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cca42f.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009195; classtype:social-engineering; sid:6009195; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1c0fe1.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1c0fe1.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009196; classtype:social-engineering; sid:6009196; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (807621.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"807621.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009197; classtype:social-engineering; sid:6009197; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (neuujdj83euu.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"neuujdj83euu.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009198; classtype:social-engineering; sid:6009198; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (resplendent-lamington-ac2b23.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"resplendent-lamington-ac2b23.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009199; classtype:social-engineering; sid:6009199; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (msprq420kf-ycgfnpdr-0e1a4b-vnz32n.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"msprq420kf-ycgfnpdr-0e1a4b-vnz32n.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009200; classtype:social-engineering; sid:6009200; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (landing-0300.visionbloom.info/Y2gtZmVkZXgtMjAyNg/?u=161C1655&e=edy.wachter%40bluewin.ch&s3=Edy&s4=Wachter&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/Y2gtZmVkZXgtMjAyNg/?u=161C1655&e=edy.wachter%40bluewin.ch&s3=Edy&s4=Wachter&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"landing-0300.visionbloom.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009201; classtype:social-engineering; sid:6009201; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (af1d90.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"af1d90.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009202; classtype:social-engineering; sid:6009202; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d8c66e.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d8c66e.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009203; classtype:social-engineering; sid:6009203; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eee22f.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eee22f.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009204; classtype:social-engineering; sid:6009204; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (596373.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"596373.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009205; classtype:social-engineering; sid:6009205; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (30d93c.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"30d93c.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009206; classtype:social-engineering; sid:6009206; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6b0826.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6b0826.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009207; classtype:social-engineering; sid:6009207; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (955486.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"955486.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009208; classtype:social-engineering; sid:6009208; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ef4ebd.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ef4ebd.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009209; classtype:social-engineering; sid:6009209; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e4e784.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e4e784.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009210; classtype:social-engineering; sid:6009210; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (10aaae.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"10aaae.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009211; classtype:social-engineering; sid:6009211; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0b2e98.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0b2e98.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009212; classtype:social-engineering; sid:6009212; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (456a73.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"456a73.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009213; classtype:social-engineering; sid:6009213; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (98aea4.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"98aea4.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009214; classtype:social-engineering; sid:6009214; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (923823.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"923823.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009215; classtype:social-engineering; sid:6009215; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d2771e.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d2771e.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009216; classtype:social-engineering; sid:6009216; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ac3c2d.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ac3c2d.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009217; classtype:social-engineering; sid:6009217; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e6a5eb.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e6a5eb.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009218; classtype:social-engineering; sid:6009218; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (85cfde.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"85cfde.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009219; classtype:social-engineering; sid:6009219; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a54f00.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a54f00.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009220; classtype:social-engineering; sid:6009220; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c6996a.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c6996a.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009221; classtype:social-engineering; sid:6009221; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (betlink46.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"betlink46.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009222; classtype:social-engineering; sid:6009222; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (billing-ch.oeletricista.me/p/)"; flow:established,to_server; http.uri; content:"/p/"; startswith; fast_pattern; http.host; content:"billing-ch.oeletricista.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009223; classtype:social-engineering; sid:6009223; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (45a6ab.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"45a6ab.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009224; classtype:social-engineering; sid:6009224; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (00191c.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"00191c.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009225; classtype:social-engineering; sid:6009225; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitymailin.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitymailin.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009226; classtype:social-engineering; sid:6009226; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bahislink11.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bahislink11.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009227; classtype:social-engineering; sid:6009227; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (909aff.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"909aff.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009228; classtype:social-engineering; sid:6009228; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (transcript.arcuspolicyreview.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"transcript.arcuspolicyreview.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009229; classtype:social-engineering; sid:6009229; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c8a755.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c8a755.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009230; classtype:social-engineering; sid:6009230; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitymailupdate-100813.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitymailupdate-100813.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009231; classtype:social-engineering; sid:6009231; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (61599f.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"61599f.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009232; classtype:social-engineering; sid:6009232; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sign-in-to-xfinity-100289.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sign-in-to-xfinity-100289.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009233; classtype:social-engineering; sid:6009233; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cn.memxzf.com/home/register?code=49434)"; flow:established,to_server; http.uri; content:"/home/register?code=49434"; startswith; fast_pattern; http.host; content:"cn.memxzf.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009234; classtype:social-engineering; sid:6009234; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (walletconnect0.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"walletconnect0.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009235; classtype:social-engineering; sid:6009235; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (18fc18.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"18fc18.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009236; classtype:social-engineering; sid:6009236; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitycomservice.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitycomservice.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009237; classtype:social-engineering; sid:6009237; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a60789.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a60789.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009238; classtype:social-engineering; sid:6009238; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e086de.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e086de.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009239; classtype:social-engineering; sid:6009239; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mayo2.infocitypinamar.com/Admin/cssGORR/karten.html)"; flow:established,to_server; http.uri; content:"/Admin/cssGORR/karten.html"; startswith; fast_pattern; http.host; content:"mayo2.infocitypinamar.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009240; classtype:social-engineering; sid:6009240; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (89983d.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"89983d.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009241; classtype:social-engineering; sid:6009241; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eqcqecqe.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eqcqecqe.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009242; classtype:social-engineering; sid:6009242; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f728f3.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f728f3.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009243; classtype:social-engineering; sid:6009243; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (weaponswh.run/gnogasz)"; flow:established,to_server; http.uri; content:"/gnogasz"; startswith; fast_pattern; http.host; content:"weaponswh.run"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009244; classtype:social-engineering; sid:6009244; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e3f90a.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e3f90a.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009245; classtype:social-engineering; sid:6009245; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (edu-live-ledger.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"edu-live-ledger.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009246; classtype:social-engineering; sid:6009246; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (206882.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"206882.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009247; classtype:social-engineering; sid:6009247; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0882f2.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0882f2.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009248; classtype:social-engineering; sid:6009248; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dghdjsgdafas.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dghdjsgdafas.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009249; classtype:social-engineering; sid:6009249; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-web-gateway-env-picker-uniswap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-web-gateway-env-picker-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009250; classtype:social-engineering; sid:6009250; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6a38c3.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6a38c3.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009251; classtype:social-engineering; sid:6009251; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6dd057.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6dd057.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009252; classtype:social-engineering; sid:6009252; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityservices.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinityservices.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009253; classtype:social-engineering; sid:6009253; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sedeagencow.click/ES)"; flow:established,to_server; http.uri; content:"/ES"; startswith; fast_pattern; http.host; content:"sedeagencow.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009254; classtype:social-engineering; sid:6009254; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f9bca6.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f9bca6.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009255; classtype:social-engineering; sid:6009255; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hollykim.com/bbs_/f9ebaa/hvsjhhvs33/)"; flow:established,to_server; http.uri; content:"/bbs_/f9ebaa/hvsjhhvs33/"; startswith; fast_pattern; http.host; content:"www.hollykim.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009256; classtype:social-engineering; sid:6009256; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1423a9.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1423a9.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009257; classtype:social-engineering; sid:6009257; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (efe708.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"efe708.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009258; classtype:social-engineering; sid:6009258; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5ded59.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"5ded59.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009259; classtype:social-engineering; sid:6009259; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (002417.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"002417.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009260; classtype:social-engineering; sid:6009260; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (brintofhaus-vexclowp39471.com/58841938)"; flow:established,to_server; http.uri; content:"/58841938"; startswith; fast_pattern; http.host; content:"brintofhaus-vexclowp39471.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009261; classtype:social-engineering; sid:6009261; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (viewdetail1108qznwkt.srvflowcenter.com/public/index?ref=business-support-center-DASDFDSYUYEE43FJDSHFSDFsetting%25popup?client_id=889943718806-ual26tplnot2ea8b7n5t4p77keo8eb)"; flow:established,to_server; http.uri; content:"/public/index?ref=business-support-center-DASDFDSYUYEE43FJDSHFSDFsetting%25popup?client_id=889943718806-ual26tplnot2ea8b7n5t4p77keo8eb"; startswith; fast_pattern; http.host; content:"viewdetail1108qznwkt.srvflowcenter.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009262; classtype:social-engineering; sid:6009262; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trackingservice.monday.com/tracker/link?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvcmlnaW5hbFVybCI6Imh0dHBzOi8vZXhwcmVzcy1kaGwtZHBlMzEwM2QybWdhLmVkZ2VvbmUuZGV2IiwiZW1haWxJZCI6IjgyYmFkZWIzLTc0ZWQtNGQ0OS1iOTgxLWVkMmE3ZmQ4MTkyNCIsImlhdCI6MTc4NjMzNzk2MX0.C8ni-Wv_L5lEn0g8oAgpzJZq49hsIbpZFILKJ47HMCA&)"; flow:established,to_server; http.uri; content:"/tracker/link?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvcmlnaW5hbFVybCI6Imh0dHBzOi8vZXhwcmVzcy1kaGwtZHBlMzEwM2QybWdhLmVkZ2VvbmUuZGV2IiwiZW1haWxJZCI6IjgyYmFkZWIzLTc0ZWQtNGQ0OS1iOTgxLWVkMmE3ZmQ4MTkyNCIsImlhdCI6MTc4NjMzNzk2MX0.C8ni-Wv_L5lEn0g8oAgpzJZq49hsIbpZFILKJ47HMCA&"; startswith; fast_pattern; http.host; content:"trackingservice.monday.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009263; classtype:social-engineering; sid:6009263; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ff6bad.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ff6bad.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009264; classtype:social-engineering; sid:6009264; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (afdd5e.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"afdd5e.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009265; classtype:social-engineering; sid:6009265; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xn--valider-lesbotes-auxlettres-outlook-sid.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xn--valider-lesbotes-auxlettres-outlook-sid.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009266; classtype:social-engineering; sid:6009266; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-lwqy9808d.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-lwqy9808d.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009267; classtype:social-engineering; sid:6009267; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c44abe-trc-redirect-39b80f.vercel.app/checkout/69eeb548114e2b4da7209316b8f86743/checkout)"; flow:established,to_server; http.uri; content:"/checkout/69eeb548114e2b4da7209316b8f86743/checkout"; startswith; fast_pattern; http.host; content:"c44abe-trc-redirect-39b80f.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009268; classtype:social-engineering; sid:6009268; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (16157d.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"16157d.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009269; classtype:social-engineering; sid:6009269; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9c057f.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9c057f.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009270; classtype:social-engineering; sid:6009270; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (deskstop-ledger-live.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"deskstop-ledger-live.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009271; classtype:social-engineering; sid:6009271; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ca0347.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ca0347.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009272; classtype:social-engineering; sid:6009272; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sitebul4.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sitebul4.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009273; classtype:social-engineering; sid:6009273; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (660edf.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"660edf.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009274; classtype:social-engineering; sid:6009274; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c4b9d5.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c4b9d5.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009275; classtype:social-engineering; sid:6009275; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (be8731.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"be8731.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009276; classtype:social-engineering; sid:6009276; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a1ea52.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a1ea52.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009277; classtype:social-engineering; sid:6009277; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sterychnace07.onrender.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sterychnace07.onrender.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009278; classtype:social-engineering; sid:6009278; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.filmistanstudios.com/mails/c/alibaba/)"; flow:established,to_server; http.uri; content:"/mails/c/alibaba/"; startswith; fast_pattern; http.host; content:"www.filmistanstudios.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009279; classtype:social-engineering; sid:6009279; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9772f9.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9772f9.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009280; classtype:social-engineering; sid:6009280; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (966f93.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"966f93.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009281; classtype:social-engineering; sid:6009281; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7edc59.arcadejafet.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7edc59.arcadejafet.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009282; classtype:social-engineering; sid:6009282; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (content-dpcbrw03871s.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"content-dpcbrw03871s.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009283; classtype:social-engineering; sid:6009283; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-voting-page.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook-voting-page.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009284; classtype:social-engineering; sid:6009284; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4a6d54.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4a6d54.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009285; classtype:social-engineering; sid:6009285; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9b85eb.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9b85eb.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009286; classtype:social-engineering; sid:6009286; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (idelivery-bebidasze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"idelivery-bebidasze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009287; classtype:social-engineering; sid:6009287; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bookinapp.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bookinapp.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009288; classtype:social-engineering; sid:6009288; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (10a958.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"10a958.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009289; classtype:social-engineering; sid:6009289; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (27d4c0.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"27d4c0.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009290; classtype:social-engineering; sid:6009290; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bmktp6agpxo-pjlgzmja-7h8g0c-bmk61c.pages.dev/send_appeal_request)"; flow:established,to_server; http.uri; content:"/send_appeal_request"; startswith; fast_pattern; http.host; content:"bmktp6agpxo-pjlgzmja-7h8g0c-bmk61c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009291; classtype:social-engineering; sid:6009291; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trueaimportant64-d7bdancyaqdxcjg6.z03.azurefd.net/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"trueaimportant64-d7bdancyaqdxcjg6.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009292; classtype:social-engineering; sid:6009292; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4b3183.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4b3183.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009293; classtype:social-engineering; sid:6009293; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-us.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.facebook-us.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009294; classtype:social-engineering; sid:6009294; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mailbox-validatinggg-outlook-00433.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mailbox-validatinggg-outlook-00433.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009295; classtype:social-engineering; sid:6009295; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c88696.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c88696.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009296; classtype:social-engineering; sid:6009296; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m-facebooks.vn/httpswwwfacebookcomdovanduc2020)"; flow:established,to_server; http.uri; content:"/httpswwwfacebookcomdovanduc2020"; startswith; fast_pattern; http.host; content:"m-facebooks.vn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009297; classtype:social-engineering; sid:6009297; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steamcomunnmity.com/tradeoffer/new/partner=783662133token=l4hhebGA93621)"; flow:established,to_server; http.uri; content:"/tradeoffer/new/partner=783662133token=l4hhebGA93621"; startswith; fast_pattern; http.host; content:"steamcomunnmity.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009298; classtype:social-engineering; sid:6009298; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-www.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.facebook-www.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009299; classtype:social-engineering; sid:6009299; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f66d01.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f66d01.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009300; classtype:social-engineering; sid:6009300; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (da631e.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"da631e.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009301; classtype:social-engineering; sid:6009301; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (campsofice.vercel.app/exit/)"; flow:established,to_server; http.uri; content:"/exit/"; startswith; fast_pattern; http.host; content:"campsofice.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009302; classtype:social-engineering; sid:6009302; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bancolombiacupoaumento.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bancolombiacupoaumento.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009303; classtype:social-engineering; sid:6009303; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f62399.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f62399.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009304; classtype:social-engineering; sid:6009304; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (platinumdeluxeshoppingapartments.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"platinumdeluxeshoppingapartments.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009305; classtype:social-engineering; sid:6009305; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.vons.ma/wpadmin/salf/)"; flow:established,to_server; http.uri; content:"/wpadmin/salf/"; startswith; fast_pattern; http.host; content:"www.vons.ma"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009306; classtype:social-engineering; sid:6009306; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (preethadalish-creator.github.io/netflixclone/)"; flow:established,to_server; http.uri; content:"/netflixclone/"; startswith; fast_pattern; http.host; content:"preethadalish-creator.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009307; classtype:social-engineering; sid:6009307; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amz0p3.eu.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amz0p3.eu.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009308; classtype:social-engineering; sid:6009308; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-mobxevnt.xzvtec.my.id/en-en/new/events/)"; flow:established,to_server; http.uri; content:"/en-en/new/events/"; startswith; fast_pattern; http.host; content:"en-mobxevnt.xzvtec.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009309; classtype:social-engineering; sid:6009309; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (atividadesdosttk2026.com/proximo)"; flow:established,to_server; http.uri; content:"/proximo"; startswith; fast_pattern; http.host; content:"atividadesdosttk2026.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009310; classtype:social-engineering; sid:6009310; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (andres-uribe55.github.io/alkosto/)"; flow:established,to_server; http.uri; content:"/alkosto/"; startswith; fast_pattern; http.host; content:"andres-uribe55.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009311; classtype:social-engineering; sid:6009311; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facilities-communications.com/2513501.doc/18a80a/fad0f483-81b2-45c6-ad47-7272058d9cb6/)"; flow:established,to_server; http.uri; content:"/2513501.doc/18a80a/fad0f483-81b2-45c6-ad47-7272058d9cb6/"; startswith; fast_pattern; http.host; content:"facilities-communications.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009312; classtype:social-engineering; sid:6009312; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcastmailin.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcastmailin.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009313; classtype:social-engineering; sid:6009313; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freqz.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"freqz.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009314; classtype:social-engineering; sid:6009314; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mnneammnskklogon.gitbook.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mnneammnskklogon.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009315; classtype:social-engineering; sid:6009315; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365safeoffice.com/AccountSelectionPage/c)"; flow:established,to_server; http.uri; content:"/AccountSelectionPage/c"; startswith; fast_pattern; http.host; content:"www.365safeoffice.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009316; classtype:social-engineering; sid:6009316; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pay.paykmc.com/paypal/8xgzenct.html)"; flow:established,to_server; http.uri; content:"/paypal/8xgzenct.html"; startswith; fast_pattern; http.host; content:"pay.paykmc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009317; classtype:social-engineering; sid:6009317; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.giscsvopsip.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.giscsvopsip.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009318; classtype:social-engineering; sid:6009318; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aivk.eu.cc/dhl/)"; flow:established,to_server; http.uri; content:"/dhl/"; startswith; fast_pattern; http.host; content:"aivk.eu.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009319; classtype:social-engineering; sid:6009319; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eager-river-255.packagesdirectorysub.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eager-river-255.packagesdirectorysub.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009320; classtype:social-engineering; sid:6009320; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paynejp.link/login/)"; flow:established,to_server; http.uri; content:"/login/"; startswith; fast_pattern; http.host; content:"paynejp.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009321; classtype:social-engineering; sid:6009321; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.y.hn/drc8h/)"; flow:established,to_server; http.uri; content:"/drc8h/"; startswith; fast_pattern; http.host; content:"www.y.hn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009322; classtype:social-engineering; sid:6009322; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (expansaodeseulimiteinfinite.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"expansaodeseulimiteinfinite.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009323; classtype:social-engineering; sid:6009323; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (skygift.digitalcontest.it/buoni/verify/)"; flow:established,to_server; http.uri; content:"/buoni/verify/"; startswith; fast_pattern; http.host; content:"skygift.digitalcontest.it"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009324; classtype:social-engineering; sid:6009324; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d34c0c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d34c0c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009325; classtype:social-engineering; sid:6009325; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4x3x34x.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4x3x34x.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009326; classtype:social-engineering; sid:6009326; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cutt.ly/Uyuqdgc9/)"; flow:established,to_server; http.uri; content:"/Uyuqdgc9/"; startswith; fast_pattern; http.host; content:"www.cutt.ly"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009327; classtype:social-engineering; sid:6009327; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ianaguirre1.github.io/alkosto/)"; flow:established,to_server; http.uri; content:"/alkosto/"; startswith; fast_pattern; http.host; content:"ianaguirre1.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009328; classtype:social-engineering; sid:6009328; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ghxtccvonc6awwwfeenlgy1cpt0vw9nfesf21-h11v.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ghxtccvonc6awwwfeenlgy1cpt0vw9nfesf21-h11v.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009329; classtype:social-engineering; sid:6009329; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sharepoint3883-4388eral-a8qi.bolt.host/common/oauth2/v2.0/authorize)"; flow:established,to_server; http.uri; content:"/common/oauth2/v2.0/authorize"; startswith; fast_pattern; http.host; content:"sharepoint3883-4388eral-a8qi.bolt.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009330; classtype:social-engineering; sid:6009330; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rosaldomalucelli1783861087198.2030312.meusitehostgator.com.br/index.php)"; flow:established,to_server; http.uri; content:"/index.php"; startswith; fast_pattern; http.host; content:"rosaldomalucelli1783861087198.2030312.meusitehostgator.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009331; classtype:social-engineering; sid:6009331; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vikassingh-dev.github.io/amazon-frontend/)"; flow:established,to_server; http.uri; content:"/amazon-frontend/"; startswith; fast_pattern; http.host; content:"vikassingh-dev.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009332; classtype:social-engineering; sid:6009332; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (solisitudcupoecuador-2026--solisitudecuado.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"solisitudcupoecuador-2026--solisitudecuado.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009333; classtype:social-engineering; sid:6009333; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dbs-secure.vercel.app/?entity=31321)"; flow:established,to_server; http.uri; content:"/?entity=31321"; startswith; fast_pattern; http.host; content:"dbs-secure.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009334; classtype:social-engineering; sid:6009334; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6d4bb2.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6d4bb2.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009335; classtype:social-engineering; sid:6009335; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dpdpaket.py3o6.cyou/QrCdf/)"; flow:established,to_server; http.uri; content:"/QrCdf/"; startswith; fast_pattern; http.host; content:"dpdpaket.py3o6.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009336; classtype:social-engineering; sid:6009336; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (revisaodisponibilidade.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"revisaodisponibilidade.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009337; classtype:social-engineering; sid:6009337; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9202cf.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9202cf.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009338; classtype:social-engineering; sid:6009338; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rcb.cuj.temporary.site/bnlit/loginit/)"; flow:established,to_server; http.uri; content:"/bnlit/loginit/"; startswith; fast_pattern; http.host; content:"rcb.cuj.temporary.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009339; classtype:social-engineering; sid:6009339; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cuddly-disco-alpha.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cuddly-disco-alpha.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009340; classtype:social-engineering; sid:6009340; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hakunamatata.hostel.town/de/)"; flow:established,to_server; http.uri; content:"/de/"; startswith; fast_pattern; http.host; content:"hakunamatata.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009341; classtype:social-engineering; sid:6009341; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-wallet.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-wallet.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009342; classtype:social-engineering; sid:6009342; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hbkpt19vnz-msprq31ycg-7f8a-xlb82q.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hbkpt19vnz-msprq31ycg-7f8a-xlb82q.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009343; classtype:social-engineering; sid:6009343; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhd-clientes-activar-2026.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bhd-clientes-activar-2026.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009344; classtype:social-engineering; sid:6009344; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (biichoios133.on-forge.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"biichoios133.on-forge.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009345; classtype:social-engineering; sid:6009345; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.team-bn.com/p/sst-cgj/masdkgf/)"; flow:established,to_server; http.uri; content:"/p/sst-cgj/masdkgf/"; startswith; fast_pattern; http.host; content:"s.team-bn.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009346; classtype:social-engineering; sid:6009346; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (php-web-server--soportemex.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"php-web-server--soportemex.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009347; classtype:social-engineering; sid:6009347; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (status-o2uk.spatialbuzz.net/loginmobile/)"; flow:established,to_server; http.uri; content:"/loginmobile/"; startswith; fast_pattern; http.host; content:"status-o2uk.spatialbuzz.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009348; classtype:social-engineering; sid:6009348; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loginxfinitycom.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"loginxfinitycom.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009349; classtype:social-engineering; sid:6009349; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kontosicherheitsdienst.com/unavailable)"; flow:established,to_server; http.uri; content:"/unavailable"; startswith; fast_pattern; http.host; content:"kontosicherheitsdienst.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009350; classtype:social-engineering; sid:6009350; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (centralhouselisbonbaixa.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"centralhouselisbonbaixa.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009351; classtype:social-engineering; sid:6009351; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (main.d1m0ow86j91yrd.amplifyapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"main.d1m0ow86j91yrd.amplifyapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009352; classtype:social-engineering; sid:6009352; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mkamaluddin838380.github.io/Assignment_9/)"; flow:established,to_server; http.uri; content:"/Assignment_9/"; startswith; fast_pattern; http.host; content:"mkamaluddin838380.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009353; classtype:social-engineering; sid:6009353; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telqumi-kxt-felmora-a3x8hk79.pages.dev/thn-yjm-uio-lkh?welcome=2043158912592196&stt=2043158912592196&name_stt=Riverdale%20Ridge%20Ravens%20HS%20Baseball)"; flow:established,to_server; http.uri; content:"/thn-yjm-uio-lkh?welcome=2043158912592196&stt=2043158912592196&name_stt=Riverdale%20Ridge%20Ravens%20HS%20Baseball"; startswith; fast_pattern; http.host; content:"telqumi-kxt-felmora-a3x8hk79.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009354; classtype:social-engineering; sid:6009354; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tmas.org.nz/newww/)"; flow:established,to_server; http.uri; content:"/newww/"; startswith; fast_pattern; http.host; content:"www.tmas.org.nz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009355; classtype:social-engineering; sid:6009355; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (company-prod-limits-data.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"company-prod-limits-data.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009356; classtype:social-engineering; sid:6009356; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bellverify-9cc4cd.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bellverify-9cc4cd.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009357; classtype:social-engineering; sid:6009357; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure.dhlguestmanagement.com/events2/credapp.cfm)"; flow:established,to_server; http.uri; content:"/events2/credapp.cfm"; startswith; fast_pattern; http.host; content:"secure.dhlguestmanagement.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009358; classtype:social-engineering; sid:6009358; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.honestybig.com/paypal/ai4u2bjz.html)"; flow:established,to_server; http.uri; content:"/paypal/ai4u2bjz.html"; startswith; fast_pattern; http.host; content:"m.honestybig.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009359; classtype:social-engineering; sid:6009359; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.urgensy.com/redirect.html)"; flow:established,to_server; http.uri; content:"/redirect.html"; startswith; fast_pattern; http.host; content:"www.urgensy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009360; classtype:social-engineering; sid:6009360; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portal.roviasdigitaisblog.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portal.roviasdigitaisblog.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009361; classtype:social-engineering; sid:6009361; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metamzklgen.gitbook.io/us)"; flow:established,to_server; http.uri; content:"/us"; startswith; fast_pattern; http.host; content:"metamzklgen.gitbook.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009362; classtype:social-engineering; sid:6009362; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (company-prod-usage-limits.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"company-prod-usage-limits.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009363; classtype:social-engineering; sid:6009363; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (redirect7361.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"redirect7361.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009364; classtype:social-engineering; sid:6009364; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (190c90.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"190c90.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009365; classtype:social-engineering; sid:6009365; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365456.net/dh/index.html)"; flow:established,to_server; http.uri; content:"/dh/index.html"; startswith; fast_pattern; http.host; content:"365456.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009366; classtype:social-engineering; sid:6009366; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (armankumar-01.github.io/Amazon-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-Clone"; startswith; fast_pattern; http.host; content:"armankumar-01.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009367; classtype:social-engineering; sid:6009367; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store.communitystudionsarts.shop/workshop/AWP-AncientHeritage/)"; flow:established,to_server; http.uri; content:"/workshop/AWP-AncientHeritage/"; startswith; fast_pattern; http.host; content:"store.communitystudionsarts.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009368; classtype:social-engineering; sid:6009368; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.northcrestdigital.life/inicio/)"; flow:established,to_server; http.uri; content:"/inicio/"; startswith; fast_pattern; http.host; content:"www.northcrestdigital.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009369; classtype:social-engineering; sid:6009369; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spring-violet-a55d.caresamullenjhy4ct27cm.workers.dev/verification-center)"; flow:established,to_server; http.uri; content:"/verification-center"; startswith; fast_pattern; http.host; content:"spring-violet-a55d.caresamullenjhy4ct27cm.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009370; classtype:social-engineering; sid:6009370; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hhelllaioss1333.on-forge.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hhelllaioss1333.on-forge.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009371; classtype:social-engineering; sid:6009371; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2017-facebook.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2017-facebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009372; classtype:social-engineering; sid:6009372; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcastlogininfo.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcastlogininfo.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009373; classtype:social-engineering; sid:6009373; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (02048c89-d542-4483-b098-2584604559db-00-28szhkg9w5s54.worf.replit.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"02048c89-d542-4483-b098-2584604559db-00-28szhkg9w5s54.worf.replit.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009374; classtype:social-engineering; sid:6009374; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vo.la/gW2o3md)"; flow:established,to_server; http.uri; content:"/gW2o3md"; startswith; fast_pattern; http.host; content:"vo.la"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009375; classtype:social-engineering; sid:6009375; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (137662coinbase.com/account/review)"; flow:established,to_server; http.uri; content:"/account/review"; startswith; fast_pattern; http.host; content:"137662coinbase.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009376; classtype:social-engineering; sid:6009376; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inflation-programs-twiki-express.trycloudflare.com/ec8efc7fd1f1f3dedf8580a31102b7a426a9833e7d67751b4cecd327005fadea/networksolutions/index.html)"; flow:established,to_server; http.uri; content:"/ec8efc7fd1f1f3dedf8580a31102b7a426a9833e7d67751b4cecd327005fadea/networksolutions/index.html"; startswith; fast_pattern; http.host; content:"inflation-programs-twiki-express.trycloudflare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009377; classtype:social-engineering; sid:6009377; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tra-ebon.vercel.app/pdf-update/success.html)"; flow:established,to_server; http.uri; content:"/pdf-update/success.html"; startswith; fast_pattern; http.host; content:"tra-ebon.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009378; classtype:social-engineering; sid:6009378; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f6081e.icefactory.cl/TPs6kbk2KXyzBRq9pAwgsLbRylGCoO3pgd4L79hDMb8xlsQdrFi0VT7ddX4t7HG4/?rotated=1)"; flow:established,to_server; http.uri; content:"/TPs6kbk2KXyzBRq9pAwgsLbRylGCoO3pgd4L79hDMb8xlsQdrFi0VT7ddX4t7HG4/?rotated=1"; startswith; fast_pattern; http.host; content:"f6081e.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009379; classtype:social-engineering; sid:6009379; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.calvexisdigital.life/resgatar/)"; flow:established,to_server; http.uri; content:"/resgatar/"; startswith; fast_pattern; http.host; content:"www.calvexisdigital.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009380; classtype:social-engineering; sid:6009380; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.vartelondigital.life/resgatar/)"; flow:established,to_server; http.uri; content:"/resgatar/"; startswith; fast_pattern; http.host; content:"www.vartelondigital.life"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009381; classtype:social-engineering; sid:6009381; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myxfinitycom.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"myxfinitycom.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009382; classtype:social-engineering; sid:6009382; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ssl-ff3a69f1-36ce-441a-8de8-eae84d28ed1e.velasoft.cz/sin/auth/login.php)"; flow:established,to_server; http.uri; content:"/sin/auth/login.php"; startswith; fast_pattern; http.host; content:"ssl-ff3a69f1-36ce-441a-8de8-eae84d28ed1e.velasoft.cz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009383; classtype:social-engineering; sid:6009383; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kanzbladi.com/tuti/)"; flow:established,to_server; http.uri; content:"/tuti/"; startswith; fast_pattern; http.host; content:"kanzbladi.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009384; classtype:social-engineering; sid:6009384; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (actualizacionmicros.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"actualizacionmicros.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009385; classtype:social-engineering; sid:6009385; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.teams-ko.com/p/fjbd-cbcr/iefduejm/)"; flow:established,to_server; http.uri; content:"/p/fjbd-cbcr/iefduejm/"; startswith; fast_pattern; http.host; content:"s.teams-ko.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009386; classtype:social-engineering; sid:6009386; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roviasdigitaisblog.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"roviasdigitaisblog.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009387; classtype:social-engineering; sid:6009387; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fa2e9b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fa2e9b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009388; classtype:social-engineering; sid:6009388; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login.daysinnsuiteswaterloo.info/FlSXbMuj?error=interaction_required&error_description=Session+information+is+not+sufficient+for+single-sign-on.&state=u)"; flow:established,to_server; http.uri; content:"/FlSXbMuj?error=interaction_required&error_description=Session+information+is+not+sufficient+for+single-sign-on.&state=u"; startswith; fast_pattern; http.host; content:"login.daysinnsuiteswaterloo.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009389; classtype:social-engineering; sid:6009389; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adventure-workscycles.com/login/)"; flow:established,to_server; http.uri; content:"/login/"; startswith; fast_pattern; http.host; content:"adventure-workscycles.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009390; classtype:social-engineering; sid:6009390; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metapay.facebook-online.world/order/13793879)"; flow:established,to_server; http.uri; content:"/order/13793879"; startswith; fast_pattern; http.host; content:"metapay.facebook-online.world"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009391; classtype:social-engineering; sid:6009391; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1f2d0f.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1f2d0f.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009392; classtype:social-engineering; sid:6009392; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santander-dev-week.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"santander-dev-week.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009393; classtype:social-engineering; sid:6009393; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cornerstarnamibia.com/Ou3lIY.htm)"; flow:established,to_server; http.uri; content:"/Ou3lIY.htm"; startswith; fast_pattern; http.host; content:"www.cornerstarnamibia.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009394; classtype:social-engineering; sid:6009394; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (harshita-shukla9026.github.io/CLONE1/)"; flow:established,to_server; http.uri; content:"/CLONE1/"; startswith; fast_pattern; http.host; content:"harshita-shukla9026.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009395; classtype:social-engineering; sid:6009395; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fc7601.icefactory.cl/FJe7zJg0pyQEoelWQOQ0ajG4frG92rydIAbFqqLWnJqKsvIQNqJNztfRp0yZUFPX/?rotated=1)"; flow:established,to_server; http.uri; content:"/FJe7zJg0pyQEoelWQOQ0ajG4frG92rydIAbFqqLWnJqKsvIQNqJNztfRp0yZUFPX/?rotated=1"; startswith; fast_pattern; http.host; content:"fc7601.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009396; classtype:social-engineering; sid:6009396; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fy.uqxiug.net/vosbohio/vosbohio.html)"; flow:established,to_server; http.uri; content:"/vosbohio/vosbohio.html"; startswith; fast_pattern; http.host; content:"fy.uqxiug.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009397; classtype:social-engineering; sid:6009397; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.wrproducoes.com.br/adobe_Installer.html)"; flow:established,to_server; http.uri; content:"/adobe_Installer.html"; startswith; fast_pattern; http.host; content:"www.wrproducoes.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009398; classtype:social-engineering; sid:6009398; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2646a4.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2646a4.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009399; classtype:social-engineering; sid:6009399; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jsons.pk/innovativeplastics/DocumentAccessVerification.html)"; flow:established,to_server; http.uri; content:"/innovativeplastics/DocumentAccessVerification.html"; startswith; fast_pattern; http.host; content:"jsons.pk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009400; classtype:social-engineering; sid:6009400; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-us.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"facebook-us.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009401; classtype:social-engineering; sid:6009401; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fernjaipurseriesbymarriott-rajasthan.spahotel.guru/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fernjaipurseriesbymarriott-rajasthan.spahotel.guru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009402; classtype:social-engineering; sid:6009402; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jjhernandez17.github.io/alkosto/)"; flow:established,to_server; http.uri; content:"/alkosto/"; startswith; fast_pattern; http.host; content:"jjhernandez17.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009403; classtype:social-engineering; sid:6009403; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (exotic-lime-olunrtbr.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"exotic-lime-olunrtbr.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009404; classtype:social-engineering; sid:6009404; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook.market-34545647656.club/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"facebook.market-34545647656.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009405; classtype:social-engineering; sid:6009405; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cardiffsegurogrupoamigo360.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cardiffsegurogrupoamigo360.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009406; classtype:social-engineering; sid:6009406; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (osaldooperacionalaceleracartao.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"osaldooperacionalaceleracartao.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009407; classtype:social-engineering; sid:6009407; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (poczta-onet.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"poczta-onet.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009408; classtype:social-engineering; sid:6009408; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.328315906745954326.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.328315906745954326.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009409; classtype:social-engineering; sid:6009409; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.globalonline2026.shop/en/up1/)"; flow:established,to_server; http.uri; content:"/en/up1/"; startswith; fast_pattern; http.host; content:"www.globalonline2026.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009410; classtype:social-engineering; sid:6009410; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bradesco.sistema-seguro.co/inicio.php)"; flow:established,to_server; http.uri; content:"/inicio.php"; startswith; fast_pattern; http.host; content:"bradesco.sistema-seguro.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009411; classtype:social-engineering; sid:6009411; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (grishmacd.github.io/Netflix_Clone_Frontend/)"; flow:established,to_server; http.uri; content:"/Netflix_Clone_Frontend/"; startswith; fast_pattern; http.host; content:"grishmacd.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009412; classtype:social-engineering; sid:6009412; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (growtok.us.cc/register/)"; flow:established,to_server; http.uri; content:"/register/"; startswith; fast_pattern; http.host; content:"growtok.us.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009413; classtype:social-engineering; sid:6009413; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.hg4310.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.hg4310.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009414; classtype:social-engineering; sid:6009414; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (worldinfoeua-zeta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"worldinfoeua-zeta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009415; classtype:social-engineering; sid:6009415; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gazw-ru.web.app/main.html)"; flow:established,to_server; http.uri; content:"/main.html"; startswith; fast_pattern; http.host; content:"gazw-ru.web.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009416; classtype:social-engineering; sid:6009416; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bhdactivarusuario-validaracceso.hstn.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bhdactivarusuario-validaracceso.hstn.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009417; classtype:social-engineering; sid:6009417; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b44a6b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b44a6b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009418; classtype:social-engineering; sid:6009418; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gerenciador-gov.online/faleconosco/?auth=7d5fa2b0fd38194db)"; flow:established,to_server; http.uri; content:"/faleconosco/?auth=7d5fa2b0fd38194db"; startswith; fast_pattern; http.host; content:"www.gerenciador-gov.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009419; classtype:social-engineering; sid:6009419; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a51842.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a51842.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009420; classtype:social-engineering; sid:6009420; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sign-in-to-xfinitycom.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sign-in-to-xfinitycom.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009421; classtype:social-engineering; sid:6009421; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-www.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"facebook-www.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009422; classtype:social-engineering; sid:6009422; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-id-spectrum-net-login.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-id-spectrum-net-login.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009423; classtype:social-engineering; sid:6009423; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e41ed0.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e41ed0.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009424; classtype:social-engineering; sid:6009424; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dalerewardd.co/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dalerewardd.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009425; classtype:social-engineering; sid:6009425; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.team-wd.com/p/sst-cgj/lctwghft/)"; flow:established,to_server; http.uri; content:"/p/sst-cgj/lctwghft/"; startswith; fast_pattern; http.host; content:"s.team-wd.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009426; classtype:social-engineering; sid:6009426; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (50f91a.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"50f91a.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009427; classtype:social-engineering; sid:6009427; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (baccredomatico.icu/hn)"; flow:established,to_server; http.uri; content:"/hn"; startswith; fast_pattern; http.host; content:"baccredomatico.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009428; classtype:social-engineering; sid:6009428; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robloxoficial1.github.io/Roblo/)"; flow:established,to_server; http.uri; content:"/Roblo/"; startswith; fast_pattern; http.host; content:"robloxoficial1.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009429; classtype:social-engineering; sid:6009429; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.thsugargliders.com/llogin/preload-centered-backup.html)"; flow:established,to_server; http.uri; content:"/llogin/preload-centered-backup.html"; startswith; fast_pattern; http.host; content:"www.thsugargliders.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009430; classtype:social-engineering; sid:6009430; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comacstnew.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comacstnew.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009431; classtype:social-engineering; sid:6009431; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clientebhdactivar2026.zya.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"clientebhdactivar2026.zya.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009432; classtype:social-engineering; sid:6009432; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.binance-global-investment.com/trading/)"; flow:established,to_server; http.uri; content:"/trading/"; startswith; fast_pattern; http.host; content:"www.binance-global-investment.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009433; classtype:social-engineering; sid:6009433; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kenhoward.com/wp-incIudes/ive24meet/)"; flow:established,to_server; http.uri; content:"/wp-incIudes/ive24meet/"; startswith; fast_pattern; http.host; content:"www.kenhoward.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009434; classtype:social-engineering; sid:6009434; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.centroesteticodahianastaitrysas.com/auth/)"; flow:established,to_server; http.uri; content:"/auth/"; startswith; fast_pattern; http.host; content:"www.centroesteticodahianastaitrysas.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009435; classtype:social-engineering; sid:6009435; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.2017-facebook.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.2017-facebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009436; classtype:social-engineering; sid:6009436; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (encrypted-login.com/?keyname=aMe9ATG)"; flow:established,to_server; http.uri; content:"/?keyname=aMe9ATG"; startswith; fast_pattern; http.host; content:"encrypted-login.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009437; classtype:social-engineering; sid:6009437; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kemtechinternational.com/simmonscap/07simmonscap-secure-verify.html)"; flow:established,to_server; http.uri; content:"/simmonscap/07simmonscap-secure-verify.html"; startswith; fast_pattern; http.host; content:"www.kemtechinternational.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009438; classtype:social-engineering; sid:6009438; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tanmaypatel1410-debug.github.io/Amazon-clone-/)"; flow:established,to_server; http.uri; content:"/Amazon-clone-/"; startswith; fast_pattern; http.host; content:"tanmaypatel1410-debug.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009439; classtype:social-engineering; sid:6009439; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sign-in-to-xfinitycom.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sign-in-to-xfinitycom.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009440; classtype:social-engineering; sid:6009440; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sock-zizifn-us.ludea-lau.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sock-zizifn-us.ludea-lau.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009441; classtype:social-engineering; sid:6009441; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitylog-in.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitylog-in.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009442; classtype:social-engineering; sid:6009442; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.viewdetail1108qznwkt.srvflowcenter.com/public/index?ref=business-support-center-DASDFDSYUYEE43FJDSHFSDFsetting%25popup%3fclient_id=889943718806-ual26tplnot2ea8b7n5t4p77keo8eb)"; flow:established,to_server; http.uri; content:"/public/index?ref=business-support-center-DASDFDSYUYEE43FJDSHFSDFsetting%25popup%3fclient_id=889943718806-ual26tplnot2ea8b7n5t4p77keo8eb"; startswith; fast_pattern; http.host; content:"www.viewdetail1108qznwkt.srvflowcenter.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009443; classtype:social-engineering; sid:6009443; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (326989.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"326989.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009444; classtype:social-engineering; sid:6009444; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (almistranaya.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"almistranaya.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009445; classtype:social-engineering; sid:6009445; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.steamcommunitly-glock18.shop/catalog/design/balance/)"; flow:established,to_server; http.uri; content:"/catalog/design/balance/"; startswith; fast_pattern; http.host; content:"www.steamcommunitly-glock18.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009446; classtype:social-engineering; sid:6009446; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ibebidas-zeexpress.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ibebidas-zeexpress.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009447; classtype:social-engineering; sid:6009447; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (devhamadkhan.github.io/cssassignment5Netflix)"; flow:established,to_server; http.uri; content:"/cssassignment5Netflix"; startswith; fast_pattern; http.host; content:"devhamadkhan.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009448; classtype:social-engineering; sid:6009448; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (paypalsecure.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"paypalsecure.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009449; classtype:social-engineering; sid:6009449; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tkacess.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tkacess.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009450; classtype:social-engineering; sid:6009450; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (company-prod-system-limits.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"company-prod-system-limits.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009451; classtype:social-engineering; sid:6009451; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wispy-wood-42f0.juliantrevinofaw37258hol95490.workers.dev/verification-center)"; flow:established,to_server; http.uri; content:"/verification-center"; startswith; fast_pattern; http.host; content:"wispy-wood-42f0.juliantrevinofaw37258hol95490.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009452; classtype:social-engineering; sid:6009452; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store.workshopcommunitymodshare.com/sharedfiles/filesdetails/id=3625750162/)"; flow:established,to_server; http.uri; content:"/sharedfiles/filesdetails/id=3625750162/"; startswith; fast_pattern; http.host; content:"store.workshopcommunitymodshare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009453; classtype:social-engineering; sid:6009453; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (feminist-peach-thq3u1dk.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"feminist-peach-thq3u1dk.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009454; classtype:social-engineering; sid:6009454; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tiktok-shop.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tiktok-shop.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009455; classtype:social-engineering; sid:6009455; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (delorestopliff.com/Adobesharefile/)"; flow:established,to_server; http.uri; content:"/Adobesharefile/"; startswith; fast_pattern; http.host; content:"delorestopliff.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009456; classtype:social-engineering; sid:6009456; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sigininxfinity.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sigininxfinity.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009457; classtype:social-engineering; sid:6009457; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arzye5dvcii49g4vei8hhhuqf13xehhr5sf17-h12.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"arzye5dvcii49g4vei8hhhuqf13xehhr5sf17-h12.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009458; classtype:social-engineering; sid:6009458; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (av7q2pl698di.swipepages.net/isksid)"; flow:established,to_server; http.uri; content:"/isksid"; startswith; fast_pattern; http.host; content:"av7q2pl698di.swipepages.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009459; classtype:social-engineering; sid:6009459; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9682bc.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9682bc.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009460; classtype:social-engineering; sid:6009460; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ibt.dhlevripremium.com/Account/Login.aspx)"; flow:established,to_server; http.uri; content:"/Account/Login.aspx"; startswith; fast_pattern; http.host; content:"ibt.dhlevripremium.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009461; classtype:social-engineering; sid:6009461; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (560532.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"560532.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009462; classtype:social-engineering; sid:6009462; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-monitor.co.uk/concluded.php?k=52a7e9a969cab5410dc28fb4df75bebd103b961b)"; flow:established,to_server; http.uri; content:"/concluded.php?k=52a7e9a969cab5410dc28fb4df75bebd103b961b"; startswith; fast_pattern; http.host; content:"secure-monitor.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009463; classtype:social-engineering; sid:6009463; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (express-zedeliverys.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"express-zedeliverys.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009464; classtype:social-engineering; sid:6009464; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (main.d1xk6yfxdxtpzr.amplifyapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"main.d1xk6yfxdxtpzr.amplifyapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009465; classtype:social-engineering; sid:6009465; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (39932a.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"39932a.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009466; classtype:social-engineering; sid:6009466; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kuccoinlogein.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kuccoinlogein.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009467; classtype:social-engineering; sid:6009467; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ig.collnect.com/#0754)"; flow:established,to_server; http.uri; content:"/#0754"; startswith; fast_pattern; http.host; content:"ig.collnect.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009468; classtype:social-engineering; sid:6009468; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b736f1.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b736f1.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009469; classtype:social-engineering; sid:6009469; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bfc66c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bfc66c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009470; classtype:social-engineering; sid:6009470; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (biyhv.com/uiehaopm/)"; flow:established,to_server; http.uri; content:"/uiehaopm/"; startswith; fast_pattern; http.host; content:"biyhv.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009471; classtype:social-engineering; sid:6009471; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dempiremanagement.com/owa.auth.logo.aspx)"; flow:established,to_server; http.uri; content:"/owa.auth.logo.aspx"; startswith; fast_pattern; http.host; content:"dempiremanagement.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009472; classtype:social-engineering; sid:6009472; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qwwqqw.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qwwqqw.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009473; classtype:social-engineering; sid:6009473; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cdf807.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cdf807.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009474; classtype:social-engineering; sid:6009474; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (18c23b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"18c23b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009475; classtype:social-engineering; sid:6009475; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (express-bebidasze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"express-bebidasze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009476; classtype:social-engineering; sid:6009476; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee-vn.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee-vn.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009477; classtype:social-engineering; sid:6009477; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.en-login-apps.de/2000/cloud.ai/0X6W71KO/)"; flow:established,to_server; http.uri; content:"/2000/cloud.ai/0X6W71KO/"; startswith; fast_pattern; http.host; content:"www.en-login-apps.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009478; classtype:social-engineering; sid:6009478; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wn.wxmbiu.com/verifiedsafeandsecured/)"; flow:established,to_server; http.uri; content:"/verifiedsafeandsecured/"; startswith; fast_pattern; http.host; content:"wn.wxmbiu.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009479; classtype:social-engineering; sid:6009479; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (26c30d.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"26c30d.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009480; classtype:social-engineering; sid:6009480; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (unicrane.com/clientemailsetup/clientemailsetup/clientemailsetup.html)"; flow:established,to_server; http.uri; content:"/clientemailsetup/clientemailsetup/clientemailsetup.html"; startswith; fast_pattern; http.host; content:"unicrane.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009481; classtype:social-engineering; sid:6009481; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d09c18.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d09c18.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009482; classtype:social-engineering; sid:6009482; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c1e3b2.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c1e3b2.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009483; classtype:social-engineering; sid:6009483; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (57da70.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"57da70.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009484; classtype:social-engineering; sid:6009484; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bukuds.s3.eu-west-2.amazonaws.com/buks.html)"; flow:established,to_server; http.uri; content:"/buks.html"; startswith; fast_pattern; http.host; content:"bukuds.s3.eu-west-2.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009485; classtype:social-engineering; sid:6009485; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.surcursalvirtualcolombia.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.surcursalvirtualcolombia.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009486; classtype:social-engineering; sid:6009486; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0754f5.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0754f5.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009487; classtype:social-engineering; sid:6009487; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gorgeous-decisions-760402.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gorgeous-decisions-760402.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009488; classtype:social-engineering; sid:6009488; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (37b67b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"37b67b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009489; classtype:social-engineering; sid:6009489; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.rfrain.com/wpadmin/dio/adv/)"; flow:established,to_server; http.uri; content:"/wpadmin/dio/adv/"; startswith; fast_pattern; http.host; content:"www.rfrain.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009490; classtype:social-engineering; sid:6009490; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitycomhelp.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitycomhelp.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009491; classtype:social-engineering; sid:6009491; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (28c9c5.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"28c9c5.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009492; classtype:social-engineering; sid:6009492; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcastwebmailinternet.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcastwebmailinternet.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009493; classtype:social-engineering; sid:6009493; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcastinternetserver.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcastinternetserver.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009494; classtype:social-engineering; sid:6009494; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.invited-company.pro/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.invited-company.pro"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009495; classtype:social-engineering; sid:6009495; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iii.tkteam.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"iii.tkteam.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009496; classtype:social-engineering; sid:6009496; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.fingo-itau-development.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app.fingo-itau-development.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009497; classtype:social-engineering; sid:6009497; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xcarrett.bond/faleconosco/?auth=3eb7571bea8788d7eb0366db8530cf)"; flow:established,to_server; http.uri; content:"/faleconosco/?auth=3eb7571bea8788d7eb0366db8530cf"; startswith; fast_pattern; http.host; content:"xcarrett.bond"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009498; classtype:social-engineering; sid:6009498; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iexpress-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"iexpress-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009499; classtype:social-engineering; sid:6009499; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (546235.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"546235.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009500; classtype:social-engineering; sid:6009500; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (courtsummons.b-cdn.net/High%20Court%20Summons%20(1).html)"; flow:established,to_server; http.uri; content:"/High%20Court%20Summons%20(1).html"; startswith; fast_pattern; http.host; content:"courtsummons.b-cdn.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009501; classtype:social-engineering; sid:6009501; rev:1; metadata: signature_severity Major, created_et 2026_08_12;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dance-epinions-hybrid-arrival.trycloudflare.com/?code=85c739b32ac4d3b4#google@google.com)"; flow:established,to_server; http.uri; content:"/?code=85c739b32ac4d3b4#google@google.com"; startswith; fast_pattern; http.host; content:"dance-epinions-hybrid-arrival.trycloudflare.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009502; classtype:social-engineering; sid:6009502; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (store1801.com/wp-admin/mn/index.php#x)"; flow:established,to_server; http.uri; content:"/wp-admin/mn/index.php#x"; startswith; fast_pattern; http.host; content:"store1801.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009503; classtype:social-engineering; sid:6009503; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tysars.cam/H1N3T/hinet/index.php#hinet@hinet.net)"; flow:established,to_server; http.uri; content:"/H1N3T/hinet/index.php#hinet@hinet.net"; startswith; fast_pattern; http.host; content:"tysars.cam"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009504; classtype:social-engineering; sid:6009504; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a2zenvironmentalsolutions.com/wpadmin/dhl.php)"; flow:established,to_server; http.uri; content:"/wpadmin/dhl.php"; startswith; fast_pattern; http.host; content:"a2zenvironmentalsolutions.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6009505; classtype:social-engineering; sid:6009505; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp15ct7-lentor-biz-varnik-dresol.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp15ct7-lentor-biz-varnik-dresol.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009506; classtype:social-engineering; sid:6009506; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (funkelixo.net.br/123te123.html)"; flow:established,to_server; http.uri; content:"/123te123.html"; startswith; fast_pattern; http.host; content:"funkelixo.net.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009507; classtype:social-engineering; sid:6009507; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.profile-lemon-three.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.profile-lemon-three.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009508; classtype:social-engineering; sid:6009508; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct-qelnex-biz-lorqax-farnok.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct-qelnex-biz-lorqax-farnok.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009509; classtype:social-engineering; sid:6009509; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.memberservices-backupcentre-exodus.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.memberservices-backupcentre-exodus.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009510; classtype:social-engineering; sid:6009510; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (morvik-clenda-b7d204-rgtt-ponvek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"morvik-clenda-b7d204-rgtt-ponvek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009511; classtype:social-engineering; sid:6009511; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-login-conect-sso-us.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-login-conect-sso-us.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009512; classtype:social-engineering; sid:6009512; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.spotify-clone-tau-gold.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.spotify-clone-tau-gold.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009513; classtype:social-engineering; sid:6009513; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp15ct7-grasik-biz-forlen-haskel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp15ct7-grasik-biz-forlen-haskel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009514; classtype:social-engineering; sid:6009514; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6c0fd9.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6c0fd9.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009515; classtype:social-engineering; sid:6009515; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rqi-i26-rkh9-lq4o-8xr9-n9p.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rqi-i26-rkh9-lq4o-8xr9-n9p.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009516; classtype:social-engineering; sid:6009516; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (40b5e9.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"40b5e9.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009517; classtype:social-engineering; sid:6009517; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4533ff.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4533ff.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009518; classtype:social-engineering; sid:6009518; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (delicate-scone-10639b.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"delicate-scone-10639b.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009519; classtype:social-engineering; sid:6009519; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp15ct7-rastel-biz-kolnar-fimvek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp15ct7-rastel-biz-kolnar-fimvek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009520; classtype:social-engineering; sid:6009520; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp15ct7-horvik-biz-zansel-kruton.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp15ct7-horvik-biz-zansel-kruton.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009521; classtype:social-engineering; sid:6009521; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (orehgnox-f2ilda-d5c4r71-shrr-0307rgd.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"orehgnox-f2ilda-d5c4r71-shrr-0307rgd.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009522; classtype:social-engineering; sid:6009522; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp15ct7-kurzel-biz-monrik-falven.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp15ct7-kurzel-biz-monrik-falven.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009523; classtype:social-engineering; sid:6009523; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (90tf2-tkt-h83-oyj-tmld6e.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"90tf2-tkt-h83-oyj-tmld6e.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009524; classtype:social-engineering; sid:6009524; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gorvanel-biz-zormutera-a1m9pc63.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gorvanel-biz-zormutera-a1m9pc63.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009525; classtype:social-engineering; sid:6009525; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (admah.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"admah.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009526; classtype:social-engineering; sid:6009526; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7c1741.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7c1741.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009527; classtype:social-engineering; sid:6009527; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e23859.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e23859.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009528; classtype:social-engineering; sid:6009528; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-usman-haider.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-usman-haider.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009529; classtype:social-engineering; sid:6009529; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.big-shopee997.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.big-shopee997.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009530; classtype:social-engineering; sid:6009530; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gemini.1shine.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gemini.1shine.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009531; classtype:social-engineering; sid:6009531; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (expense-eight-weld.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"expense-eight-weld.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009532; classtype:social-engineering; sid:6009532; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp15ct7-prelvik-biz-torsen-kumral.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp15ct7-prelvik-biz-torsen-kumral.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009533; classtype:social-engineering; sid:6009533; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1c5197.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1c5197.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009534; classtype:social-engineering; sid:6009534; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fa6942.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fa6942.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009535; classtype:social-engineering; sid:6009535; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (63b182.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"63b182.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009536; classtype:social-engineering; sid:6009536; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inquisitive-medovik-8955c4.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"inquisitive-medovik-8955c4.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009537; classtype:social-engineering; sid:6009537; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apps-apple-com-ledger-crypto-us.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"apps-apple-com-ledger-crypto-us.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009538; classtype:social-engineering; sid:6009538; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-usman-haider.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-usman-haider.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009539; classtype:social-engineering; sid:6009539; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shopee8083.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shopee8083.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009540; classtype:social-engineering; sid:6009540; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17d725.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"17d725.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009541; classtype:social-engineering; sid:6009541; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.actualizacionmicros.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.actualizacionmicros.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009542; classtype:social-engineering; sid:6009542; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c02009.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c02009.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009543; classtype:social-engineering; sid:6009543; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (neon-choux-edf3ed.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"neon-choux-edf3ed.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009544; classtype:social-engineering; sid:6009544; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (i2s-uoinm-xp1e-k89itv-j7bhb.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"i2s-uoinm-xp1e-k89itv-j7bhb.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009545; classtype:social-engineering; sid:6009545; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinity365.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinity365.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009546; classtype:social-engineering; sid:6009546; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp15ct7-helmon-biz-kravel-sintor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp15ct7-helmon-biz-kravel-sintor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009547; classtype:social-engineering; sid:6009547; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fluzefy-torvcne-82407e-b-b1204bfe-2406qhe.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fluzefy-torvcne-82407e-b-b1204bfe-2406qhe.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009548; classtype:social-engineering; sid:6009548; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp29ct-kastik-biz-zormel-vanqor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp29ct-kastik-biz-zormel-vanqor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009549; classtype:social-engineering; sid:6009549; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (21182d.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"21182d.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009550; classtype:social-engineering; sid:6009550; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1adb37.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1adb37.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009551; classtype:social-engineering; sid:6009551; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spotify-clone-beta-two.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"spotify-clone-beta-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009552; classtype:social-engineering; sid:6009552; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (keen-liger-2bf69b.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"keen-liger-2bf69b.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009553; classtype:social-engineering; sid:6009553; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (logowanie-facebook.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"logowanie-facebook.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009554; classtype:social-engineering; sid:6009554; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verifyxfinityconnect.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"verifyxfinityconnect.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009555; classtype:social-engineering; sid:6009555; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3d831e.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3d831e.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009556; classtype:social-engineering; sid:6009556; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7b6297.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7b6297.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009557; classtype:social-engineering; sid:6009557; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4fb-x7jw1o-u69p-ctqzfi-dvsbds.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4fb-x7jw1o-u69p-ctqzfi-dvsbds.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009558; classtype:social-engineering; sid:6009558; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (backupiau.direct.quickconnect.to/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"backupiau.direct.quickconnect.to"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009559; classtype:social-engineering; sid:6009559; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kymnp-vvlhkp-7wj-qw9-xojqm.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kymnp-vvlhkp-7wj-qw9-xojqm.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009560; classtype:social-engineering; sid:6009560; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marnix-qustek-a18ce4-ggrbn-t2406aee.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"marnix-qustek-a18ce4-ggrbn-t2406aee.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009561; classtype:social-engineering; sid:6009561; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (transcendent-quokka-c4c95c.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"transcendent-quokka-c4c95c.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009562; classtype:social-engineering; sid:6009562; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp15ct7-ronvek-biz-helsar-kemvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp15ct7-ronvek-biz-helsar-kemvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009563; classtype:social-engineering; sid:6009563; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0953f8.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0953f8.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009564; classtype:social-engineering; sid:6009564; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7f49b1.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7f49b1.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009565; classtype:social-engineering; sid:6009565; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp29ct-zavlor-biz-hensik-qempar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp29ct-zavlor-biz-hensik-qempar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009566; classtype:social-engineering; sid:6009566; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.store.communitystudionsarts.shop/workshop/AWP-AncientHeritage/)"; flow:established,to_server; http.uri; content:"/workshop/AWP-AncientHeritage/"; startswith; fast_pattern; http.host; content:"www.store.communitystudionsarts.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009567; classtype:social-engineering; sid:6009567; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (85d0c9.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"85d0c9.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009568; classtype:social-engineering; sid:6009568; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.discordclone-smoky.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.discordclone-smoky.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009569; classtype:social-engineering; sid:6009569; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-jennifer.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-jennifer.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009570; classtype:social-engineering; sid:6009570; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0cf639.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0cf639.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009571; classtype:social-engineering; sid:6009571; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4cad71.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4cad71.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009572; classtype:social-engineering; sid:6009572; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0c13a2.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0c13a2.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009573; classtype:social-engineering; sid:6009573; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (htqx-mu9hg-aqhpz-rfjaw-paoe.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"htqx-mu9hg-aqhpz-rfjaw-paoe.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009574; classtype:social-engineering; sid:6009574; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (securebcolombiadiff.com/inicio-banco.php)"; flow:established,to_server; http.uri; content:"/inicio-banco.php"; startswith; fast_pattern; http.host; content:"securebcolombiadiff.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009575; classtype:social-engineering; sid:6009575; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b1fc29.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b1fc29.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009576; classtype:social-engineering; sid:6009576; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nshsdfsi.us.cc/4g/home.html)"; flow:established,to_server; http.uri; content:"/4g/home.html"; startswith; fast_pattern; http.host; content:"nshsdfsi.us.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009577; classtype:social-engineering; sid:6009577; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lambent-marzipan-07d722.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lambent-marzipan-07d722.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009578; classtype:social-engineering; sid:6009578; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dlavor-bintel-3b82fc-mrkt-grendal.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dlavor-bintel-3b82fc-mrkt-grendal.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009579; classtype:social-engineering; sid:6009579; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sea-turtle-app-jzwpn.ondigitalocean.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sea-turtle-app-jzwpn.ondigitalocean.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009580; classtype:social-engineering; sid:6009580; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (heartfelt-semifreddo-aab0fa-gez1204-g-2406qxo.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"heartfelt-semifreddo-aab0fa-gez1204-g-2406qxo.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009581; classtype:social-engineering; sid:6009581; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (melodic-cranachan-837c34-bn1204n-gh-2406gmd.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"melodic-cranachan-837c34-bn1204n-gh-2406gmd.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009582; classtype:social-engineering; sid:6009582; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (orenox-filda-d5c471-shrr-thrr.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"orenox-filda-d5c471-shrr-thrr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009583; classtype:social-engineering; sid:6009583; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robloxr.com.es/login?returlUrl=1179291790)"; flow:established,to_server; http.uri; content:"/login?returlUrl=1179291790"; startswith; fast_pattern; http.host; content:"robloxr.com.es"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009584; classtype:social-engineering; sid:6009584; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.claim-robux-here34.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.claim-robux-here34.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009585; classtype:social-engineering; sid:6009585; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h9phj-rqq-060f1-256n-onii.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"h9phj-rqq-060f1-256n-onii.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009586; classtype:social-engineering; sid:6009586; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (12f198.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"12f198.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009587; classtype:social-engineering; sid:6009587; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jaz-sunaeae-05041b-gr1204gr-gg-2406tlf.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jaz-sunaeae-05041b-gr1204gr-gg-2406tlf.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009588; classtype:social-engineering; sid:6009588; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-live-wallet-start-conect-us-en.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-live-wallet-start-conect-us-en.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009589; classtype:social-engineering; sid:6009589; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp15ct7-delvak-biz-mornik-frasel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp15ct7-delvak-biz-mornik-frasel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009590; classtype:social-engineering; sid:6009590; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (benevolt-cheesecake-1ea9ce-gf1204-gff-2406mjr.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"benevolt-cheesecake-1ea9ce-gf1204-gff-2406mjr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009591; classtype:social-engineering; sid:6009591; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.grand-prize60.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.grand-prize60.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009592; classtype:social-engineering; sid:6009592; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lunmori-gld-felquta-r1t5dk47.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lunmori-gld-felquta-r1t5dk47.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009593; classtype:social-engineering; sid:6009593; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (proj002mintinglive.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"proj002mintinglive.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009594; classtype:social-engineering; sid:6009594; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp18ct-zelvo-biz-ravex-nulri.pages.dev/rtyu-iopj-qewr-thjm?welcome=553286641387973&idnp=553286641387973&name_idnp=EcologyWise%20%D7%92%D7%99%D7%90%20%D7%A8%D7%95%D7%AA%D7%9D%20%20%20%D7%90%D7%A7%D7%95%D7%9C%D7%95%D7%92%D7%99%D7%94.%D7%A1%D7%91%D7%99%D7%91%D7%94.%D7%9E%D7%A8%D7%97%D7%91)"; flow:established,to_server; http.uri; content:"/rtyu-iopj-qewr-thjm?welcome=553286641387973&idnp=553286641387973&name_idnp=EcologyWise%20%D7%92%D7%99%D7%90%20%D7%A8%D7%95%D7%AA%D7%9D%20%20%20%D7%90%D7%A7%D7%95%D7%9C%D7%95%D7%92%D7%99%D7%94.%D7%A1%D7%91%D7%99%D7%91%D7%94.%D7%9E%D7%A8%D7%97%D7%91"; startswith; fast_pattern; http.host; content:"sp18ct-zelvo-biz-ravex-nulri.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009595; classtype:social-engineering; sid:6009595; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a61f41.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a61f41.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009596; classtype:social-engineering; sid:6009596; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ad0a60.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ad0a60.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009597; classtype:social-engineering; sid:6009597; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (39b54d.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"39b54d.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009598; classtype:social-engineering; sid:6009598; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgerlive-eng.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgerlive-eng.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009599; classtype:social-engineering; sid:6009599; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp15ct7-dolvik-biz-prasten-horlek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp15ct7-dolvik-biz-prasten-horlek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009600; classtype:social-engineering; sid:6009600; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct-relvix-biz-morqem-gelnax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct-relvix-biz-morqem-gelnax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009601; classtype:social-engineering; sid:6009601; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylaterzz.urr.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylaterzz.urr.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009602; classtype:social-engineering; sid:6009602; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trelvo-samrik-46f29d-br1504bn-ny2406pax.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trelvo-samrik-46f29d-br1504bn-ny2406pax.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009603; classtype:social-engineering; sid:6009603; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4cb485.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4cb485.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009604; classtype:social-engineering; sid:6009604; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (57bdb7.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"57bdb7.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009605; classtype:social-engineering; sid:6009605; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.acnabskin.com/m/register/)"; flow:established,to_server; http.uri; content:"/m/register/"; startswith; fast_pattern; http.host; content:"www.acnabskin.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009606; classtype:social-engineering; sid:6009606; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a1f830.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a1f830.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009607; classtype:social-engineering; sid:6009607; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c79eb7.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c79eb7.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009608; classtype:social-engineering; sid:6009608; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (silly-gid-druid-75279c-btr1004qfg-2406bqw.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"silly-gid-druid-75279c-btr1004qfg-2406bqw.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009609; classtype:social-engineering; sid:6009609; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imaginative-klepon-32cfee.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"imaginative-klepon-32cfee.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009610; classtype:social-engineering; sid:6009610; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cdbf0d.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cdbf0d.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009611; classtype:social-engineering; sid:6009611; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jazzyt.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jazzyt.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009612; classtype:social-engineering; sid:6009612; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (732ebc.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"732ebc.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009613; classtype:social-engineering; sid:6009613; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (150253.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"150253.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009614; classtype:social-engineering; sid:6009614; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct-belrem-biz-delqok-lorvix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct-belrem-biz-delqok-lorvix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009615; classtype:social-engineering; sid:6009615; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (swarnaskyla.github.io/Netflix_clone)"; flow:established,to_server; http.uri; content:"/Netflix_clone"; startswith; fast_pattern; http.host; content:"swarnaskyla.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009616; classtype:social-engineering; sid:6009616; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sock-zizifn-kr.ludea-liu.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sock-zizifn-kr.ludea-liu.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009617; classtype:social-engineering; sid:6009617; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp29ct-lensok-biz-karmik-favtor.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp29ct-lensok-biz-karmik-favtor.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009618; classtype:social-engineering; sid:6009618; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1zb-ltbqku-i8guer-hs1yw8.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1zb-ltbqku-i8guer-hs1yw8.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009619; classtype:social-engineering; sid:6009619; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1108ppusxkxlolxxisdforxxllp2-endpoint-cvbgavf7agdzc6eb.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1108ppusxkxlolxxisdforxxllp2-endpoint-cvbgavf7agdzc6eb.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009620; classtype:social-engineering; sid:6009620; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (27p-sddo-up2-zcwe25-9i92.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"27p-sddo-up2-zcwe25-9i92.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009621; classtype:social-engineering; sid:6009621; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lambent-snickerdoodle-40fd2d.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lambent-snickerdoodle-40fd2d.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009622; classtype:social-engineering; sid:6009622; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (merry-maamoul-33ac49.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"merry-maamoul-33ac49.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009623; classtype:social-engineering; sid:6009623; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pt-shopee4777.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pt-shopee4777.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009624; classtype:social-engineering; sid:6009624; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dravon-kelrix-c607b4-ggr1504bn-n2406pta.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dravon-kelrix-c607b4-ggr1504bn-n2406pta.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009625; classtype:social-engineering; sid:6009625; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e43482.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e43482.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009626; classtype:social-engineering; sid:6009626; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mudeerxdev-hue.github.io/CSS-LAST-ASSIGNMENT-NO-05-NETFLIX-CLONE/)"; flow:established,to_server; http.uri; content:"/CSS-LAST-ASSIGNMENT-NO-05-NETFLIX-CLONE/"; startswith; fast_pattern; http.host; content:"mudeerxdev-hue.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009627; classtype:social-engineering; sid:6009627; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.m.6442.win/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.m.6442.win"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009628; classtype:social-engineering; sid:6009628; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.worldinfoeua-zeta.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.worldinfoeua-zeta.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009629; classtype:social-engineering; sid:6009629; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (binancewallett.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"binancewallett.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009630; classtype:social-engineering; sid:6009630; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danaindonesia-n.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danaindonesia-n.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009631; classtype:social-engineering; sid:6009631; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (159c0f.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"159c0f.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009632; classtype:social-engineering; sid:6009632; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (frequent-industry-913696.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"frequent-industry-913696.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009633; classtype:social-engineering; sid:6009633; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (18d1f4.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"18d1f4.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009634; classtype:social-engineering; sid:6009634; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (plorik-vensha-0ae7c1-nyhh-hf2406vro.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"plorik-vensha-0ae7c1-nyhh-hf2406vro.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009635; classtype:social-engineering; sid:6009635; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dnivok-lrelna-9fj50a-cjbyh-3di489.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dnivok-lrelna-9fj50a-cjbyh-3di489.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009636; classtype:social-engineering; sid:6009636; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inset-liveledger-en.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"inset-liveledger-en.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009637; classtype:social-engineering; sid:6009637; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinitycomhelp.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinitycomhelp.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009638; classtype:social-engineering; sid:6009638; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sigininxfinity.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.sigininxfinity.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009639; classtype:social-engineering; sid:6009639; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (26a92f.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"26a92f.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009640; classtype:social-engineering; sid:6009640; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (memberservices-backupcentre-exodus.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"memberservices-backupcentre-exodus.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009641; classtype:social-engineering; sid:6009641; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dcae2d.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dcae2d.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009642; classtype:social-engineering; sid:6009642; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (549bd3.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"549bd3.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009643; classtype:social-engineering; sid:6009643; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (39c034.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"39c034.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009644; classtype:social-engineering; sid:6009644; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.spotify-clone-beta-two.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.spotify-clone-beta-two.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009645; classtype:social-engineering; sid:6009645; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhariwalumang.github.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dhariwalumang.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009646; classtype:social-engineering; sid:6009646; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.expense-eight-weld.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.expense-eight-weld.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009647; classtype:social-engineering; sid:6009647; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-clone-54j2bplvs-excell-09.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-clone-54j2bplvs-excell-09.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009648; classtype:social-engineering; sid:6009648; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ee7ca9.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ee7ca9.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009649; classtype:social-engineering; sid:6009649; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (learn-start-io-trezor-us.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"learn-start-io-trezor-us.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009650; classtype:social-engineering; sid:6009650; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct0-curnex-biz-koltra-jemqi.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct0-curnex-biz-koltra-jemqi.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009651; classtype:social-engineering; sid:6009651; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pt-shopee4777.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pt-shopee4777.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009652; classtype:social-engineering; sid:6009652; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (llavor-pintel-4m93eb-crkt-lrendal.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"llavor-pintel-4m93eb-crkt-lrendal.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009653; classtype:social-engineering; sid:6009653; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3xu1-mw7vw-gby-bn75wg-hne.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3xu1-mw7vw-gby-bn75wg-hne.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009654; classtype:social-engineering; sid:6009654; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.tinyurl-blox-web.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.tinyurl-blox-web.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009655; classtype:social-engineering; sid:6009655; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nexari-blimor-1a63ef-hr1504jj-gn2406xut.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nexari-blimor-1a63ef-hr1504jj-gn2406xut.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009656; classtype:social-engineering; sid:6009656; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (i2r6od-aks-prjsms-63na0-kix572.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"i2r6od-aks-prjsms-63na0-kix572.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009657; classtype:social-engineering; sid:6009657; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (helpry.jp/clxj-blockchain-rqdd-helpry-pgkzw-blockchain-wzojvh)"; flow:established,to_server; http.uri; content:"/clxj-blockchain-rqdd-helpry-pgkzw-blockchain-wzojvh"; startswith; fast_pattern; http.host; content:"helpry.jp"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009658; classtype:social-engineering; sid:6009658; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7de24b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7de24b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009659; classtype:social-engineering; sid:6009659; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (benevolent-valkyrie-89c0d6-2406pdl.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"benevolent-valkyrie-89c0d6-2406pdl.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009660; classtype:social-engineering; sid:6009660; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (160c75.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"160c75.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009661; classtype:social-engineering; sid:6009661; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ef23b5.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ef23b5.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009662; classtype:social-engineering; sid:6009662; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (quarnix-vomtek-c8a521-hn1504jj-g2406mru.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"quarnix-vomtek-c8a521-hn1504jj-g2406mru.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009663; classtype:social-engineering; sid:6009663; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kedaigroup.cyou/ww/dmlkorea.html)"; flow:established,to_server; http.uri; content:"/ww/dmlkorea.html"; startswith; fast_pattern; http.host; content:"kedaigroup.cyou"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009664; classtype:social-engineering; sid:6009664; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c25aa2.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c25aa2.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009665; classtype:social-engineering; sid:6009665; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (odbieramy-polaczenie.online/payu/bank/millenium/)"; flow:established,to_server; http.uri; content:"/payu/bank/millenium/"; startswith; fast_pattern; http.host; content:"odbieramy-polaczenie.online"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009666; classtype:social-engineering; sid:6009666; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp15ct7-kelvor-biz-drasen-lumvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp15ct7-kelvor-biz-drasen-lumvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009667; classtype:social-engineering; sid:6009667; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mantener1wht1.webcindario.com/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"mantener1wht1.webcindario.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009668; classtype:social-engineering; sid:6009668; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (22cef7.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"22cef7.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009669; classtype:social-engineering; sid:6009669; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1ab521.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1ab521.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009670; classtype:social-engineering; sid:6009670; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.outlook-fastseed-validate-75484.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.outlook-fastseed-validate-75484.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009671; classtype:social-engineering; sid:6009671; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appl-replica-bootstrap-zena.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"appl-replica-bootstrap-zena.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009672; classtype:social-engineering; sid:6009672; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m5zi-5nyu2g-ec3-2dn9-vt3gf.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m5zi-5nyu2g-ec3-2dn9-vt3gf.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009673; classtype:social-engineering; sid:6009673; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp15ct7-hurnel-biz-fostek-ravnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp15ct7-hurnel-biz-fostek-ravnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009674; classtype:social-engineering; sid:6009674; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (loginbelll.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"loginbelll.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009675; classtype:social-engineering; sid:6009675; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2tywdr-ovc0j-yp7-enx8w-qa0u0u.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2tywdr-ovc0j-yp7-enx8w-qa0u0u.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009676; classtype:social-engineering; sid:6009676; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8e256f.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8e256f.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009677; classtype:social-engineering; sid:6009677; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (grand-prize60.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"grand-prize60.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009678; classtype:social-engineering; sid:6009678; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.programundian-shopee1010.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.programundian-shopee1010.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009679; classtype:social-engineering; sid:6009679; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tf.xybcffqlc.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tf.xybcffqlc.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009680; classtype:social-engineering; sid:6009680; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinity-upgrade2.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinity-upgrade2.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009681; classtype:social-engineering; sid:6009681; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abc62a.icefactory.cl/WUp1VBczW1HZ2hn9kTS134SQ602K1ufmXVeW3Jhyof13ZbURTPRJwqNT7I2TBCY9/?rotated=1)"; flow:established,to_server; http.uri; content:"/WUp1VBczW1HZ2hn9kTS134SQ602K1ufmXVeW3Jhyof13ZbURTPRJwqNT7I2TBCY9/?rotated=1"; startswith; fast_pattern; http.host; content:"abc62a.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009682; classtype:social-engineering; sid:6009682; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (discordclone-smoky.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"discordclone-smoky.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009683; classtype:social-engineering; sid:6009683; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (programundian-shopee1010.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"programundian-shopee1010.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009684; classtype:social-engineering; sid:6009684; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp15ct7-havrek-biz-pronik-fulsen.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp15ct7-havrek-biz-pronik-fulsen.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009685; classtype:social-engineering; sid:6009685; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dw7-eumhv-g1k5-k8gb-gqc1a0.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dw7-eumhv-g1k5-k8gb-gqc1a0.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009686; classtype:social-engineering; sid:6009686; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ddacbc.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ddacbc.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009687; classtype:social-engineering; sid:6009687; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a2fcc6.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a2fcc6.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009688; classtype:social-engineering; sid:6009688; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b4b15a.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b4b15a.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009689; classtype:social-engineering; sid:6009689; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (glemizng-parfait-a763e6-kl1204lk-n-2406uxj.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"glemizng-parfait-a763e6-kl1204lk-n-2406uxj.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009690; classtype:social-engineering; sid:6009690; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (876fdd.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"876fdd.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009691; classtype:social-engineering; sid:6009691; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hlonex-fursa-a7c109-wplm-grw0307rw.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hlonex-fursa-a7c109-wplm-grw0307rw.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009692; classtype:social-engineering; sid:6009692; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bnc-flb.firebaseapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bnc-flb.firebaseapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009693; classtype:social-engineering; sid:6009693; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6c21d1.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6c21d1.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009694; classtype:social-engineering; sid:6009694; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-live-download-sso-conect.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-live-download-sso-conect.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009695; classtype:social-engineering; sid:6009695; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nimble-cendol-ed4dde.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nimble-cendol-ed4dde.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009696; classtype:social-engineering; sid:6009696; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e364ff.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e364ff.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009697; classtype:social-engineering; sid:6009697; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lebrunsa.com/bid/index.html)"; flow:established,to_server; http.uri; content:"/bid/index.html"; startswith; fast_pattern; http.host; content:"lebrunsa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009698; classtype:social-engineering; sid:6009698; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.license-keys.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.license-keys.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009699; classtype:social-engineering; sid:6009699; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp15ct7-pravik-biz-holsen-kurmel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp15ct7-pravik-biz-holsen-kurmel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009700; classtype:social-engineering; sid:6009700; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b0664c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b0664c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009701; classtype:social-engineering; sid:6009701; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (imtoken-download.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"imtoken-download.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009702; classtype:social-engineering; sid:6009702; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flourishing-marzipan-b0969f.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"flourishing-marzipan-b0969f.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009703; classtype:social-engineering; sid:6009703; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a6e897.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a6e897.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009704; classtype:social-engineering; sid:6009704; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (72e520.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"72e520.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009705; classtype:social-engineering; sid:6009705; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinity-customer-care.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinity-customer-care.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009706; classtype:social-engineering; sid:6009706; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2a75ff.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2a75ff.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009707; classtype:social-engineering; sid:6009707; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinity-upgrade2.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinity-upgrade2.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009708; classtype:social-engineering; sid:6009708; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4fd09f.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4fd09f.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009709; classtype:social-engineering; sid:6009709; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f8d4a7.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f8d4a7.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009710; classtype:social-engineering; sid:6009710; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (leboncoin-auths.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"leboncoin-auths.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009711; classtype:social-engineering; sid:6009711; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8fa1c0.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8fa1c0.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009712; classtype:social-engineering; sid:6009712; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tloi-kdi-6csf7-s6q28w-r5d.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tloi-kdi-6csf7-s6q28w-r5d.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009713; classtype:social-engineering; sid:6009713; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6b48e8.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6b48e8.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009714; classtype:social-engineering; sid:6009714; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rectifymanual.live/app)"; flow:established,to_server; http.uri; content:"/app"; startswith; fast_pattern; http.host; content:"rectifymanual.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009715; classtype:social-engineering; sid:6009715; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jelvik-pronda-8f9a33-njyhh-g2406xra.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jelvik-pronda-8f9a33-njyhh-g2406xra.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009716; classtype:social-engineering; sid:6009716; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f52d26.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f52d26.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009717; classtype:social-engineering; sid:6009717; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (emivok-trelna-2ed83f-vjbyh-6cb712.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"emivok-trelna-2ed83f-vjbyh-6cb712.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009718; classtype:social-engineering; sid:6009718; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sujan125ghosh-125.github.io/netflix-site/)"; flow:established,to_server; http.uri; content:"/netflix-site/"; startswith; fast_pattern; http.host; content:"sujan125ghosh-125.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009719; classtype:social-engineering; sid:6009719; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (travik-vormel-c35ad2-njyrr-x2406adt.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"travik-vormel-c35ad2-njyrr-x2406adt.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009720; classtype:social-engineering; sid:6009720; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ea6327.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ea6327.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009721; classtype:social-engineering; sid:6009721; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4c8ede.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4c8ede.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009722; classtype:social-engineering; sid:6009722; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (139543.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"139543.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009723; classtype:social-engineering; sid:6009723; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tokeimng.fit/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tokeimng.fit"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009724; classtype:social-engineering; sid:6009724; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cheerful-rose-tkryjfc0.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cheerful-rose-tkryjfc0.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009725; classtype:social-engineering; sid:6009725; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (big-shopee997.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"big-shopee997.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009726; classtype:social-engineering; sid:6009726; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3c0354.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3c0354.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009727; classtype:social-engineering; sid:6009727; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comacastnet.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comacastnet.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009728; classtype:social-engineering; sid:6009728; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (autoscout24opt.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"autoscout24opt.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009729; classtype:social-engineering; sid:6009729; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (msjihzx.us.cc/5g/home.html)"; flow:established,to_server; http.uri; content:"/5g/home.html"; startswith; fast_pattern; http.host; content:"msjihzx.us.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009730; classtype:social-engineering; sid:6009730; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (84b85a.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"84b85a.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009731; classtype:social-engineering; sid:6009731; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0188f6.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0188f6.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009732; classtype:social-engineering; sid:6009732; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp15ct7-gresor-biz-fantik-lurmon.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp15ct7-gresor-biz-fantik-lurmon.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009733; classtype:social-engineering; sid:6009733; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.myxfinitycom.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.myxfinitycom.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009734; classtype:social-engineering; sid:6009734; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (549fcf.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"549fcf.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009735; classtype:social-engineering; sid:6009735; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abumusan.icu/JamesTate4840)"; flow:established,to_server; http.uri; content:"/JamesTate4840"; startswith; fast_pattern; http.host; content:"abumusan.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009736; classtype:social-engineering; sid:6009736; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (64fb29.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"64fb29.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009737; classtype:social-engineering; sid:6009737; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bc4f19.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bc4f19.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009738; classtype:social-engineering; sid:6009738; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-io-start-treezer.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"help-io-start-treezer.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009739; classtype:social-engineering; sid:6009739; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oyster-app-sy22t.ondigitalocean.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"oyster-app-sy22t.ondigitalocean.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009740; classtype:social-engineering; sid:6009740; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinity-customer-care.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinity-customer-care.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009741; classtype:social-engineering; sid:6009741; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (564894.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"564894.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009742; classtype:social-engineering; sid:6009742; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp29ct-kamlor-biz-vensik-fartel.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp29ct-kamlor-biz-vensik-fartel.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009743; classtype:social-engineering; sid:6009743; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e875a4.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e875a4.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009744; classtype:social-engineering; sid:6009744; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0b94f5.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0b94f5.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009745; classtype:social-engineering; sid:6009745; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (crenox-filda-d5c471-shrr-ponvek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"crenox-filda-d5c471-shrr-ponvek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009746; classtype:social-engineering; sid:6009746; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (foit-k7v1m9-kvc4b-ciyox-tcgu.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"foit-k7v1m9-kvc4b-ciyox-tcgu.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009747; classtype:social-engineering; sid:6009747; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcast-help-home.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcast-help-home.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009748; classtype:social-engineering; sid:6009748; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portal-us-ledgercom-cdn.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portal-us-ledgercom-cdn.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009749; classtype:social-engineering; sid:6009749; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-ledger-eng-start.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"help-ledger-eng-start.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009750; classtype:social-engineering; sid:6009750; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-login-ledger-us-en.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-login-ledger-us-en.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009751; classtype:social-engineering; sid:6009751; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-n8o57frwy.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-n8o57frwy.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009752; classtype:social-engineering; sid:6009752; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp15ct7-borvik-biz-rensal-mudrek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp15ct7-borvik-biz-rensal-mudrek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009753; classtype:social-engineering; sid:6009753; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5fe17c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"5fe17c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009754; classtype:social-engineering; sid:6009754; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (youtube-viral-link-share.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"youtube-viral-link-share.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009755; classtype:social-engineering; sid:6009755; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lraxil-komber-4e91ac-kthn-dravik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lraxil-komber-4e91ac-kthn-dravik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009756; classtype:social-engineering; sid:6009756; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2eaeb7.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2eaeb7.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009757; classtype:social-engineering; sid:6009757; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arencia-vitaminc-booster-amazon.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"arencia-vitaminc-booster-amazon.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009758; classtype:social-engineering; sid:6009758; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (t9m3-h18-i0vqr-5k33-zki-os4x.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"t9m3-h18-i0vqr-5k33-zki-os4x.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009759; classtype:social-engineering; sid:6009759; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (14539e.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"14539e.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009760; classtype:social-engineering; sid:6009760; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.comcsat.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.comcsat.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009761; classtype:social-engineering; sid:6009761; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-eng-begin.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-eng-begin.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009762; classtype:social-engineering; sid:6009762; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cuddly-disco-alpha.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cuddly-disco-alpha.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009763; classtype:social-engineering; sid:6009763; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.campsofice.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.campsofice.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009764; classtype:social-engineering; sid:6009764; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9a0513.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9a0513.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009765; classtype:social-engineering; sid:6009765; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (draxil-zomber-1e91ac-kthn-dravik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"draxil-zomber-1e91ac-kthn-dravik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009766; classtype:social-engineering; sid:6009766; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (statuesque-buttercream-70ab03-ht1504h-2406cwp.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"statuesque-buttercream-70ab03-ht1504h-2406cwp.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009767; classtype:social-engineering; sid:6009767; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-login-web-conect-web-sso-in.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-login-web-conect-web-sso-in.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009768; classtype:social-engineering; sid:6009768; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (plaxor-dremik-2cb715-hf1504rr-br2406mqa.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"plaxor-dremik-2cb715-hf1504rr-br2406mqa.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009769; classtype:social-engineering; sid:6009769; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp15ct7-haskor-biz-lurten-savnik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp15ct7-haskor-biz-lurten-savnik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009770; classtype:social-engineering; sid:6009770; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8a7d39.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8a7d39.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009771; classtype:social-engineering; sid:6009771; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (729fc8.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"729fc8.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009772; classtype:social-engineering; sid:6009772; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (auth-netcoins-com-x-auth.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"auth-netcoins-com-x-auth.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009773; classtype:social-engineering; sid:6009773; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp15ct7-nolrek-biz-prastor-furvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp15ct7-nolrek-biz-prastor-furvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009774; classtype:social-engineering; sid:6009774; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (381901.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"381901.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009775; classtype:social-engineering; sid:6009775; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgrelivapp--crome.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgrelivapp--crome.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009776; classtype:social-engineering; sid:6009776; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.web-trezor-io-start-us.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.web-trezor-io-start-us.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009777; classtype:social-engineering; sid:6009777; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (go-to-accounts-dashboards.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"go-to-accounts-dashboards.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009778; classtype:social-engineering; sid:6009778; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (160e87.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"160e87.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009779; classtype:social-engineering; sid:6009779; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezoorr-suitee.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezoorr-suitee.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009780; classtype:social-engineering; sid:6009780; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp0ct-korqax-biz-felnex-yorvik.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp0ct-korqax-biz-felnex-yorvik.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009781; classtype:social-engineering; sid:6009781; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hl8w-c0jq-fip-xy2l-n4yq-6lsk7i.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hl8w-c0jq-fip-xy2l-n4yq-6lsk7i.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009782; classtype:social-engineering; sid:6009782; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (editpanel.iceiy.com/indexupdted.html)"; flow:established,to_server; http.uri; content:"/indexupdted.html"; startswith; fast_pattern; http.host; content:"editpanel.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009783; classtype:social-engineering; sid:6009783; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6bf172.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6bf172.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009784; classtype:social-engineering; sid:6009784; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp15ct7-korzan-biz-desvik-lormek.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp15ct7-korzan-biz-desvik-lormek.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009785; classtype:social-engineering; sid:6009785; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinity365.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinity365.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009786; classtype:social-engineering; sid:6009786; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6f4ea1.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6f4ea1.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009787; classtype:social-engineering; sid:6009787; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-clone-snowy.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-clone-snowy.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009788; classtype:social-engineering; sid:6009788; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d34352.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d34352.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009789; classtype:social-engineering; sid:6009789; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f56119.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f56119.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009790; classtype:social-engineering; sid:6009790; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1f607f.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1f607f.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009791; classtype:social-engineering; sid:6009791; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (83e7dc.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"83e7dc.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009792; classtype:social-engineering; sid:6009792; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9b4541.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9b4541.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009793; classtype:social-engineering; sid:6009793; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.lsioeh.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.lsioeh.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009794; classtype:social-engineering; sid:6009794; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (773e23.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"773e23.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009795; classtype:social-engineering; sid:6009795; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d2db5c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d2db5c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009796; classtype:social-engineering; sid:6009796; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (82541a.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"82541a.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009797; classtype:social-engineering; sid:6009797; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9754e0.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9754e0.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009798; classtype:social-engineering; sid:6009798; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.lsoehd.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.lsoehd.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009799; classtype:social-engineering; sid:6009799; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5a5402.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"5a5402.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009800; classtype:social-engineering; sid:6009800; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0f57d5.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0f57d5.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009801; classtype:social-engineering; sid:6009801; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cyberblow.onrender.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cyberblow.onrender.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009802; classtype:social-engineering; sid:6009802; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (58a1fc.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"58a1fc.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009803; classtype:social-engineering; sid:6009803; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rooms.davidkarpay.com/cgi-bin/home.ha)"; flow:established,to_server; http.uri; content:"/cgi-bin/home.ha"; startswith; fast_pattern; http.host; content:"rooms.davidkarpay.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009804; classtype:social-engineering; sid:6009804; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cornerstarnamibia.com/Se85df8ab7d8bf3d6d85e.htm?key=8f4K9mQ2Xx7)"; flow:established,to_server; http.uri; content:"/Se85df8ab7d8bf3d6d85e.htm?key=8f4K9mQ2Xx7"; startswith; fast_pattern; http.host; content:"cornerstarnamibia.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009805; classtype:social-engineering; sid:6009805; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (256ced.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"256ced.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009806; classtype:social-engineering; sid:6009806; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinityemailloginauthentication.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinityemailloginauthentication.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009807; classtype:social-engineering; sid:6009807; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vh18413.vh.net.pl/TD/TD-ZE5KIzX0UW4&oauth_key_signature=eyJraWQOiJrUFVqdlNhT25GWUVDakpjMmV1MXJvNGxnb2VFeXJJb2tCbU1X3BiZXN/app.php)"; flow:established,to_server; http.uri; content:"/TD/TD-ZE5KIzX0UW4&oauth_key_signature=eyJraWQOiJrUFVqdlNhT25GWUVDakpjMmV1MXJvNGxnb2VFeXJJb2tCbU1X3BiZXN/app.php"; startswith; fast_pattern; http.host; content:"vh18413.vh.net.pl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009808; classtype:social-engineering; sid:6009808; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.www-connect.secure.werllsfargo.com.jmvlogistics.in/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.www-connect.secure.werllsfargo.com.jmvlogistics.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009809; classtype:social-engineering; sid:6009809; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web3eoxdus.zapier.app/nav-en)"; flow:established,to_server; http.uri; content:"/nav-en"; startswith; fast_pattern; http.host; content:"web3eoxdus.zapier.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009810; classtype:social-engineering; sid:6009810; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazonaspe.com/samazonaspes/statement/index.html)"; flow:established,to_server; http.uri; content:"/samazonaspes/statement/index.html"; startswith; fast_pattern; http.host; content:"amazonaspe.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009811; classtype:social-engineering; sid:6009811; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.lsoiehrf.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.lsoiehrf.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009812; classtype:social-engineering; sid:6009812; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ffp.rjg.temporary.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ffp.rjg.temporary.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009813; classtype:social-engineering; sid:6009813; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (458127.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"458127.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009814; classtype:social-engineering; sid:6009814; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (76a240.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"76a240.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009815; classtype:social-engineering; sid:6009815; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meta-game.pages.dev/appeals/submit-appeal-form/return)"; flow:established,to_server; http.uri; content:"/appeals/submit-appeal-form/return"; startswith; fast_pattern; http.host; content:"meta-game.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009816; classtype:social-engineering; sid:6009816; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (promptspark.net/stmaryofpahokee/onedrive-verify-obf.html)"; flow:established,to_server; http.uri; content:"/stmaryofpahokee/onedrive-verify-obf.html"; startswith; fast_pattern; http.host; content:"promptspark.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009817; classtype:social-engineering; sid:6009817; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (09a050.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"09a050.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009818; classtype:social-engineering; sid:6009818; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newcomcastserver.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"newcomcastserver.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009819; classtype:social-engineering; sid:6009819; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.site-n8o57frwy.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.site-n8o57frwy.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009820; classtype:social-engineering; sid:6009820; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a4d524.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a4d524.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009821; classtype:social-engineering; sid:6009821; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (express-deliverys24h.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"express-deliverys24h.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009822; classtype:social-engineering; sid:6009822; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify77183.web.id/whitepage)"; flow:established,to_server; http.uri; content:"/whitepage"; startswith; fast_pattern; http.host; content:"verify77183.web.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009823; classtype:social-engineering; sid:6009823; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (249956.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"249956.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009824; classtype:social-engineering; sid:6009824; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1ea875.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1ea875.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009825; classtype:social-engineering; sid:6009825; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (45e6b0.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"45e6b0.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009826; classtype:social-engineering; sid:6009826; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (done4you.tv/complete/nda-agreement.html)"; flow:established,to_server; http.uri; content:"/complete/nda-agreement.html"; startswith; fast_pattern; http.host; content:"done4you.tv"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009827; classtype:social-engineering; sid:6009827; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3a77ef.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3a77ef.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009828; classtype:social-engineering; sid:6009828; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (meiline02.github.io/insta_clone)"; flow:established,to_server; http.uri; content:"/insta_clone"; startswith; fast_pattern; http.host; content:"meiline02.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009829; classtype:social-engineering; sid:6009829; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lawoccjd0cbhonysmyi12vtlnbn8jtmjdsf45-h12v.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lawoccjd0cbhonysmyi12vtlnbn8jtmjdsf45-h12v.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009830; classtype:social-engineering; sid:6009830; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7c6f05.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7c6f05.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009831; classtype:social-engineering; sid:6009831; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (19d9cf.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"19d9cf.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009832; classtype:social-engineering; sid:6009832; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2292a6.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2292a6.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009833; classtype:social-engineering; sid:6009833; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (572955.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"572955.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009834; classtype:social-engineering; sid:6009834; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2a73f7.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2a73f7.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009835; classtype:social-engineering; sid:6009835; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qtwiz-skrunt-vlypx-a7c109-zplv-blidex.pages.dev/send_appeal_request)"; flow:established,to_server; http.uri; content:"/send_appeal_request"; startswith; fast_pattern; http.host; content:"qtwiz-skrunt-vlypx-a7c109-zplv-blidex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009836; classtype:social-engineering; sid:6009836; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (180a4b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"180a4b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009837; classtype:social-engineering; sid:6009837; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sbc-verifier-sign-in-85c1f5.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sbc-verifier-sign-in-85c1f5.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009838; classtype:social-engineering; sid:6009838; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1a7513.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1a7513.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009839; classtype:social-engineering; sid:6009839; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8ba6c9.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8ba6c9.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009840; classtype:social-engineering; sid:6009840; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.shop88.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.shop88.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009841; classtype:social-engineering; sid:6009841; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (def812.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"def812.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009842; classtype:social-engineering; sid:6009842; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (85b5f0bd-395e-421b-b9cd-2b4e9d3f81ca-00-l1n3ptxdg5t8.kirk.replit.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"85b5f0bd-395e-421b-b9cd-2b4e9d3f81ca-00-l1n3ptxdg5t8.kirk.replit.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009843; classtype:social-engineering; sid:6009843; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (teulimiteourodisponivel.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"teulimiteourodisponivel.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009844; classtype:social-engineering; sid:6009844; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yoursigninplusupdate.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yoursigninplusupdate.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009845; classtype:social-engineering; sid:6009845; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (11117f.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"11117f.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009846; classtype:social-engineering; sid:6009846; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (166b29.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"166b29.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009847; classtype:social-engineering; sid:6009847; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (samratitinstitute.com/pcfsfywu82m/page.html)"; flow:established,to_server; http.uri; content:"/pcfsfywu82m/page.html"; startswith; fast_pattern; http.host; content:"samratitinstitute.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009848; classtype:social-engineering; sid:6009848; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xxfinitywebnotify.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xxfinitywebnotify.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009849; classtype:social-engineering; sid:6009849; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (62efb8.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"62efb8.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009850; classtype:social-engineering; sid:6009850; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (697b33.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"697b33.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009851; classtype:social-engineering; sid:6009851; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8d83e6.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8d83e6.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009852; classtype:social-engineering; sid:6009852; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4c099f.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4c099f.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009853; classtype:social-engineering; sid:6009853; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-0f360892ee1545f6960ccb1afa74f2b6.r2.dev/us-enhomeexpressNotify.html)"; flow:established,to_server; http.uri; content:"/us-enhomeexpressNotify.html"; startswith; fast_pattern; http.host; content:"pub-0f360892ee1545f6960ccb1afa74f2b6.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009854; classtype:social-engineering; sid:6009854; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1ce9b1.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1ce9b1.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009855; classtype:social-engineering; sid:6009855; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (40b1e9.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"40b1e9.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009856; classtype:social-engineering; sid:6009856; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8b189b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8b189b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009857; classtype:social-engineering; sid:6009857; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (72f8ee.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"72f8ee.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009858; classtype:social-engineering; sid:6009858; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tkshp.dyincihna.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tkshp.dyincihna.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009859; classtype:social-engineering; sid:6009859; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c67830.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c67830.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009860; classtype:social-engineering; sid:6009860; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflixcasinocanada.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflixcasinocanada.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009861; classtype:social-engineering; sid:6009861; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e56f01.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e56f01.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009862; classtype:social-engineering; sid:6009862; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (preaprovvecol.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"preaprovvecol.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009863; classtype:social-engineering; sid:6009863; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d49b51.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d49b51.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009864; classtype:social-engineering; sid:6009864; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (641436.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"641436.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009865; classtype:social-engineering; sid:6009865; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6f3c1a.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6f3c1a.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009866; classtype:social-engineering; sid:6009866; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (135461223.site/1779/55b96590-d5e3-45a1-8b3a-f574fd0b68aa/752821/x)"; flow:established,to_server; http.uri; content:"/1779/55b96590-d5e3-45a1-8b3a-f574fd0b68aa/752821/x"; startswith; fast_pattern; http.host; content:"135461223.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009867; classtype:social-engineering; sid:6009867; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (359fd4.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"359fd4.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009868; classtype:social-engineering; sid:6009868; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gtlk.link/ah5WgwQC?ykl=N7AEBu)"; flow:established,to_server; http.uri; content:"/ah5WgwQC?ykl=N7AEBu"; startswith; fast_pattern; http.host; content:"gtlk.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009869; classtype:social-engineering; sid:6009869; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dd2b89.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dd2b89.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009870; classtype:social-engineering; sid:6009870; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nurendoesmenco90.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nurendoesmenco90.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009871; classtype:social-engineering; sid:6009871; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gift.steampowered.ink/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gift.steampowered.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009872; classtype:social-engineering; sid:6009872; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inemssgecert10c06.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"inemssgecert10c06.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009873; classtype:social-engineering; sid:6009873; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9812fa.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9812fa.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009874; classtype:social-engineering; sid:6009874; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-clone-snowy.vercel.app/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"instagram-clone-snowy.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009875; classtype:social-engineering; sid:6009875; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (279c15.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"279c15.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009876; classtype:social-engineering; sid:6009876; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dfgddgd7.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dfgddgd7.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009877; classtype:social-engineering; sid:6009877; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (37a546.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"37a546.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009878; classtype:social-engineering; sid:6009878; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rs73-removals.fastserver.club/verifiedsafeandsecured/preload-centered-obfuscated.html)"; flow:established,to_server; http.uri; content:"/verifiedsafeandsecured/preload-centered-obfuscated.html"; startswith; fast_pattern; http.host; content:"rs73-removals.fastserver.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009879; classtype:social-engineering; sid:6009879; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suporteitauweb.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"suporteitauweb.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009880; classtype:social-engineering; sid:6009880; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app.trezors-suites.com/?verified=1)"; flow:established,to_server; http.uri; content:"/?verified=1"; startswith; fast_pattern; http.host; content:"app.trezors-suites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009881; classtype:social-engineering; sid:6009881; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tk.ercajchain.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tk.ercajchain.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009882; classtype:social-engineering; sid:6009882; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4f8da9.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4f8da9.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009883; classtype:social-engineering; sid:6009883; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a615d3.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a615d3.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009884; classtype:social-engineering; sid:6009884; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5t3ct34vt.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"5t3ct34vt.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009885; classtype:social-engineering; sid:6009885; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bs9151.craftum.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bs9151.craftum.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009886; classtype:social-engineering; sid:6009886; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xmailinctrrses.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xmailinctrrses.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009887; classtype:social-engineering; sid:6009887; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (980c38.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"980c38.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009888; classtype:social-engineering; sid:6009888; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (home-exo-x-en.github.io/en)"; flow:established,to_server; http.uri; content:"/en"; startswith; fast_pattern; http.host; content:"home-exo-x-en.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009889; classtype:social-engineering; sid:6009889; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6fa37b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6fa37b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009890; classtype:social-engineering; sid:6009890; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gbinsta.cc/download-gb-insta-apk)"; flow:established,to_server; http.uri; content:"/download-gb-insta-apk"; startswith; fast_pattern; http.host; content:"gbinsta.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009891; classtype:social-engineering; sid:6009891; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (388fa8.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"388fa8.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009892; classtype:social-engineering; sid:6009892; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (intuitqbassistcenter.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"intuitqbassistcenter.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009893; classtype:social-engineering; sid:6009893; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (peinmereedmeriansed.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"peinmereedmeriansed.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009894; classtype:social-engineering; sid:6009894; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b7a0a9.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b7a0a9.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009895; classtype:social-engineering; sid:6009895; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.go-to-accounts-dashboards.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.go-to-accounts-dashboards.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009896; classtype:social-engineering; sid:6009896; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8e923f.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8e923f.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009897; classtype:social-engineering; sid:6009897; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook-channel.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.facebook-channel.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009898; classtype:social-engineering; sid:6009898; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-chi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-chi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009899; classtype:social-engineering; sid:6009899; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d22f0f.icefactory.cl/0BhByDS11fvD64dug7WDsA7cs1ERnT22tZnP9xHflLe6aj9A0K55Ge1m85jkOLLt/?rotated=1)"; flow:established,to_server; http.uri; content:"/0BhByDS11fvD64dug7WDsA7cs1ERnT22tZnP9xHflLe6aj9A0K55Ge1m85jkOLLt/?rotated=1"; startswith; fast_pattern; http.host; content:"d22f0f.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009900; classtype:social-engineering; sid:6009900; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (41ae90.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"41ae90.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009901; classtype:social-engineering; sid:6009901; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b35fcb.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b35fcb.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009902; classtype:social-engineering; sid:6009902; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (34406e.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"34406e.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009903; classtype:social-engineering; sid:6009903; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (feb832.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"feb832.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009904; classtype:social-engineering; sid:6009904; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5b8431.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"5b8431.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009905; classtype:social-engineering; sid:6009905; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2ddf2c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2ddf2c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009906; classtype:social-engineering; sid:6009906; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ca0d71.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ca0d71.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009907; classtype:social-engineering; sid:6009907; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fcf6b9.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fcf6b9.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009908; classtype:social-engineering; sid:6009908; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (62e66f.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"62e66f.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009909; classtype:social-engineering; sid:6009909; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acessocert.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"acessocert.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009910; classtype:social-engineering; sid:6009910; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (38e223.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"38e223.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009911; classtype:social-engineering; sid:6009911; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spotifymusic.servehalflife.com/invoice/)"; flow:established,to_server; http.uri; content:"/invoice/"; startswith; fast_pattern; http.host; content:"spotifymusic.servehalflife.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009912; classtype:social-engineering; sid:6009912; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mmmyyttsswebmaiii.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mmmyyttsswebmaiii.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009913; classtype:social-engineering; sid:6009913; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (programaflexja.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"programaflexja.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009914; classtype:social-engineering; sid:6009914; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lasucursallvirtual.vercel.app/manager/17)"; flow:established,to_server; http.uri; content:"/manager/17"; startswith; fast_pattern; http.host; content:"lasucursallvirtual.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009915; classtype:social-engineering; sid:6009915; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0245dc.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0245dc.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009916; classtype:social-engineering; sid:6009916; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5993af.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"5993af.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009917; classtype:social-engineering; sid:6009917; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ef568e.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ef568e.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009918; classtype:social-engineering; sid:6009918; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webupgrade394949-dp94sdn9spre.edgeone.cool/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"webupgrade394949-dp94sdn9spre.edgeone.cool"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009919; classtype:social-engineering; sid:6009919; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3d6f51.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3d6f51.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009920; classtype:social-engineering; sid:6009920; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (63289e.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"63289e.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009921; classtype:social-engineering; sid:6009921; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (santander.pt-atendimento.com/seguranca.php)"; flow:established,to_server; http.uri; content:"/seguranca.php"; startswith; fast_pattern; http.host; content:"santander.pt-atendimento.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009922; classtype:social-engineering; sid:6009922; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8eed9e.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8eed9e.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009923; classtype:social-engineering; sid:6009923; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (71d7d2.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"71d7d2.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009924; classtype:social-engineering; sid:6009924; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e9ad2a.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e9ad2a.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009925; classtype:social-engineering; sid:6009925; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (de6e68.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"de6e68.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009926; classtype:social-engineering; sid:6009926; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (197924.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"197924.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009927; classtype:social-engineering; sid:6009927; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1d8eb9.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1d8eb9.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009928; classtype:social-engineering; sid:6009928; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rwrfx2x.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rwrfx2x.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009929; classtype:social-engineering; sid:6009929; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-react-clone.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagram-react-clone.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009930; classtype:social-engineering; sid:6009930; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (menu-aktivasipayc.paylater.buzz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"menu-aktivasipayc.paylater.buzz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009931; classtype:social-engineering; sid:6009931; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (list-serve.com/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380)"; flow:established,to_server; http.uri; content:"/education_redirect_second?8c5781c2-7b1e-4035-b1d7-990e269e5380"; startswith; fast_pattern; http.host; content:"list-serve.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009932; classtype:social-engineering; sid:6009932; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (79c8ef.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"79c8ef.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009933; classtype:social-engineering; sid:6009933; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (226065.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"226065.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009934; classtype:social-engineering; sid:6009934; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f583f8.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f583f8.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009935; classtype:social-engineering; sid:6009935; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0a4282.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0a4282.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009936; classtype:social-engineering; sid:6009936; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fc83a5.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fc83a5.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009937; classtype:social-engineering; sid:6009937; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tzr-jern.maxwell15.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tzr-jern.maxwell15.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009938; classtype:social-engineering; sid:6009938; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b92e4a.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b92e4a.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009939; classtype:social-engineering; sid:6009939; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f95c1d.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f95c1d.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009940; classtype:social-engineering; sid:6009940; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8bcc57.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8bcc57.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009941; classtype:social-engineering; sid:6009941; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (379861.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"379861.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009942; classtype:social-engineering; sid:6009942; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (divyasri-raju.github.io/Spotify-clone/)"; flow:established,to_server; http.uri; content:"/Spotify-clone/"; startswith; fast_pattern; http.host; content:"divyasri-raju.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009943; classtype:social-engineering; sid:6009943; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (08748b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"08748b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009944; classtype:social-engineering; sid:6009944; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cae4b0.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cae4b0.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009945; classtype:social-engineering; sid:6009945; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2dab91.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2dab91.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009946; classtype:social-engineering; sid:6009946; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitypage.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitypage.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009947; classtype:social-engineering; sid:6009947; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-index-editor--loganww1.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-index-editor--loganww1.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009948; classtype:social-engineering; sid:6009948; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acessodhj.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"acessodhj.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009949; classtype:social-engineering; sid:6009949; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (224bb3.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"224bb3.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009950; classtype:social-engineering; sid:6009950; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e8e354.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e8e354.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009951; classtype:social-engineering; sid:6009951; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rent-house-app-phi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rent-house-app-phi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009952; classtype:social-engineering; sid:6009952; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6eefde.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6eefde.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009953; classtype:social-engineering; sid:6009953; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sign-in-to-xfinity-100276.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sign-in-to-xfinity-100276.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009954; classtype:social-engineering; sid:6009954; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (melioniserv.justns.ru/dkb_/login.php)"; flow:established,to_server; http.uri; content:"/dkb_/login.php"; startswith; fast_pattern; http.host; content:"melioniserv.justns.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009955; classtype:social-engineering; sid:6009955; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (34c43c43c4.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"34c43c43c4.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009956; classtype:social-engineering; sid:6009956; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f90a10.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f90a10.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009957; classtype:social-engineering; sid:6009957; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a95dd7.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a95dd7.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009958; classtype:social-engineering; sid:6009958; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trezrr-suite-doc.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trezrr-suite-doc.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009959; classtype:social-engineering; sid:6009959; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steamcomnunuity.ru/id/7656119798487159)"; flow:established,to_server; http.uri; content:"/id/7656119798487159"; startswith; fast_pattern; http.host; content:"steamcomnunuity.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009960; classtype:social-engineering; sid:6009960; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verlineasiguiente2026.iceiy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"verlineasiguiente2026.iceiy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009961; classtype:social-engineering; sid:6009961; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b47467.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b47467.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009962; classtype:social-engineering; sid:6009962; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0f4f3d.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0f4f3d.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009963; classtype:social-engineering; sid:6009963; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (91a408.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"91a408.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009964; classtype:social-engineering; sid:6009964; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8cc648.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8cc648.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009965; classtype:social-engineering; sid:6009965; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b1eb97.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b1eb97.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009966; classtype:social-engineering; sid:6009966; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (065821.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"065821.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009967; classtype:social-engineering; sid:6009967; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (greenroot-bcad3b4b0be4.herokuapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"greenroot-bcad3b4b0be4.herokuapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009968; classtype:social-engineering; sid:6009968; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (850942.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"850942.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009969; classtype:social-engineering; sid:6009969; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (92cd3b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"92cd3b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009970; classtype:social-engineering; sid:6009970; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9b3c5f.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9b3c5f.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009971; classtype:social-engineering; sid:6009971; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e07f00.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e07f00.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009972; classtype:social-engineering; sid:6009972; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (759eae.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"759eae.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009973; classtype:social-engineering; sid:6009973; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e79f48.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e79f48.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009974; classtype:social-engineering; sid:6009974; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c89919.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c89919.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009975; classtype:social-engineering; sid:6009975; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (de5671.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"de5671.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009976; classtype:social-engineering; sid:6009976; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (starviewcinema-a112a76429a8.herokuapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"starviewcinema-a112a76429a8.herokuapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009977; classtype:social-engineering; sid:6009977; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6e540c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6e540c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009978; classtype:social-engineering; sid:6009978; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (71a6be.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"71a6be.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009979; classtype:social-engineering; sid:6009979; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6f9a37.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6f9a37.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009980; classtype:social-engineering; sid:6009980; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ertomaincertewhj89.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ertomaincertewhj89.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009981; classtype:social-engineering; sid:6009981; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f3e873.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f3e873.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009982; classtype:social-engineering; sid:6009982; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cetrumcertifcmeriesc467f.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cetrumcertifcmeriesc467f.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009983; classtype:social-engineering; sid:6009983; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ultralimiteprimedisponivel.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"ultralimiteprimedisponivel.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009984; classtype:social-engineering; sid:6009984; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (84d542.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"84d542.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009985; classtype:social-engineering; sid:6009985; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a705a3.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a705a3.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009986; classtype:social-engineering; sid:6009986; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a4122d.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a4122d.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009987; classtype:social-engineering; sid:6009987; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7c1f4a.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7c1f4a.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009988; classtype:social-engineering; sid:6009988; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d89742.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d89742.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009989; classtype:social-engineering; sid:6009989; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (23ee9e.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"23ee9e.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009990; classtype:social-engineering; sid:6009990; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (79c0d2.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"79c0d2.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009991; classtype:social-engineering; sid:6009991; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookteamhelp.blogspot.com/2015/12/document.html)"; flow:established,to_server; http.uri; content:"/2015/12/document.html"; startswith; fast_pattern; http.host; content:"facebookteamhelp.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009992; classtype:social-engineering; sid:6009992; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (19b997.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"19b997.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009993; classtype:social-engineering; sid:6009993; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b5e786.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b5e786.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009994; classtype:social-engineering; sid:6009994; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2baf58.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2baf58.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009995; classtype:social-engineering; sid:6009995; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (soliciteaquiiseulimiteespecial.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"soliciteaquiiseulimiteespecial.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009996; classtype:social-engineering; sid:6009996; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (18ab53.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"18ab53.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009997; classtype:social-engineering; sid:6009997; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9a4a94.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9a4a94.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009998; classtype:social-engineering; sid:6009998; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ac903e.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ac903e.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6009999; classtype:social-engineering; sid:6009999; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3f1793.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3f1793.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010000; classtype:social-engineering; sid:6010000; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-channel.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"facebook-channel.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010001; classtype:social-engineering; sid:6010001; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0a0611.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0a0611.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010002; classtype:social-engineering; sid:6010002; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aneesurrehmandm.github.io/Netflix-Clone-Project/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone-Project/"; startswith; fast_pattern; http.host; content:"aneesurrehmandm.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010003; classtype:social-engineering; sid:6010003; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (767030.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"767030.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010004; classtype:social-engineering; sid:6010004; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wxexwexex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wxexwexex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010005; classtype:social-engineering; sid:6010005; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-help-io.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-help-io.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010006; classtype:social-engineering; sid:6010006; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (43f4f3.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"43f4f3.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010007; classtype:social-engineering; sid:6010007; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (23c4ff.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"23c4ff.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010008; classtype:social-engineering; sid:6010008; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3f713d.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3f713d.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010009; classtype:social-engineering; sid:6010009; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (revisaodedisponibilidadeja.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"revisaodedisponibilidadeja.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010010; classtype:social-engineering; sid:6010010; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9e1e80.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9e1e80.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010011; classtype:social-engineering; sid:6010011; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ffp.rjg.temporary.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ffp.rjg.temporary.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010012; classtype:social-engineering; sid:6010012; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-be2ea1ef1e754c08b319f7023d8364f9.r2.dev/index.html?ref=secure_redirect&ts=1767342692&v=1.0&ip=03673926&token=2363d1ea)"; flow:established,to_server; http.uri; content:"/index.html?ref=secure_redirect&ts=1767342692&v=1.0&ip=03673926&token=2363d1ea"; startswith; fast_pattern; http.host; content:"pub-be2ea1ef1e754c08b319f7023d8364f9.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010013; classtype:social-engineering; sid:6010013; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dcf68d.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dcf68d.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010014; classtype:social-engineering; sid:6010014; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.registrer-user.com/pages/vbv.php)"; flow:established,to_server; http.uri; content:"/pages/vbv.php"; startswith; fast_pattern; http.host; content:"www.registrer-user.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010015; classtype:social-engineering; sid:6010015; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (64acee.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"64acee.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010016; classtype:social-engineering; sid:6010016; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5e8cbe.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"5e8cbe.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010017; classtype:social-engineering; sid:6010017; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.chennaionlinemarketing.com/image/AMEN/enx.php/)"; flow:established,to_server; http.uri; content:"/image/AMEN/enx.php/"; startswith; fast_pattern; http.host; content:"www.chennaionlinemarketing.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010018; classtype:social-engineering; sid:6010018; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (258c95.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"258c95.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010019; classtype:social-engineering; sid:6010019; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (28b94c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"28b94c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010020; classtype:social-engineering; sid:6010020; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mapaicloud.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mapaicloud.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010021; classtype:social-engineering; sid:6010021; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6ac0e6.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6ac0e6.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010022; classtype:social-engineering; sid:6010022; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1ec4cf.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1ec4cf.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010023; classtype:social-engineering; sid:6010023; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (start-us-ledger-eng.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"start-us-ledger-eng.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010024; classtype:social-engineering; sid:6010024; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d40011.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d40011.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010025; classtype:social-engineering; sid:6010025; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (raiffeisen-gilt.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"raiffeisen-gilt.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010026; classtype:social-engineering; sid:6010026; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ocompany-prod-rate-limits.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"ocompany-prod-rate-limits.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010027; classtype:social-engineering; sid:6010027; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (110239.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"110239.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010028; classtype:social-engineering; sid:6010028; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ledgrliveus.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.ledgrliveus.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010029; classtype:social-engineering; sid:6010029; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgrliveus.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"ledgrliveus.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010030; classtype:social-engineering; sid:6010030; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7ce6b0.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7ce6b0.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010031; classtype:social-engineering; sid:6010031; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (882137.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"882137.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010032; classtype:social-engineering; sid:6010032; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2d6451.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2d6451.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010033; classtype:social-engineering; sid:6010033; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acme-companynubank-transfer-limits.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"acme-companynubank-transfer-limits.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010034; classtype:social-engineering; sid:6010034; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cn.lnmxys.com/home/register?code=49438)"; flow:established,to_server; http.uri; content:"/home/register?code=49438"; startswith; fast_pattern; http.host; content:"cn.lnmxys.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010035; classtype:social-engineering; sid:6010035; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lassucursalvirtual.vercel.app/manager/17)"; flow:established,to_server; http.uri; content:"/manager/17"; startswith; fast_pattern; http.host; content:"lassucursalvirtual.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010036; classtype:social-engineering; sid:6010036; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (digitrans.co.za/digitr/)"; flow:established,to_server; http.uri; content:"/digitr/"; startswith; fast_pattern; http.host; content:"digitrans.co.za"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010037; classtype:social-engineering; sid:6010037; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aktiffkan-paylater.ytt.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aktiffkan-paylater.ytt.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010038; classtype:social-engineering; sid:6010038; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a07121.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a07121.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010039; classtype:social-engineering; sid:6010039; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6dec0a.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6dec0a.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010040; classtype:social-engineering; sid:6010040; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram-chi.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram-chi.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010041; classtype:social-engineering; sid:6010041; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f141ef.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f141ef.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010042; classtype:social-engineering; sid:6010042; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bomevn-adhj.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bomevn-adhj.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010043; classtype:social-engineering; sid:6010043; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steamxcommunity.ru/Id/7656193585673764)"; flow:established,to_server; http.uri; content:"/Id/7656193585673764"; startswith; fast_pattern; http.host; content:"steamxcommunity.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010044; classtype:social-engineering; sid:6010044; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a53d7d.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a53d7d.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010045; classtype:social-engineering; sid:6010045; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.raiffeisen-gilt.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.raiffeisen-gilt.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010046; classtype:social-engineering; sid:6010046; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (connect-ldgrscom-live.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"connect-ldgrscom-live.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010047; classtype:social-engineering; sid:6010047; rev:1; metadata: signature_severity Major, created_et 2026_08_13;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (storage.googleapis.com/jmclddfl/m)"; flow:established,to_server; http.uri; content:"/jmclddfl/m"; startswith; fast_pattern; http.host; content:"storage.googleapis.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010048; classtype:social-engineering; sid:6010048; rev:1; metadata: signature_severity Major, created_et 2026_08_14;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verticainmobiliaria.com/alm/hinet/index.php#x)"; flow:established,to_server; http.uri; content:"/alm/hinet/index.php#x"; startswith; fast_pattern; http.host; content:"verticainmobiliaria.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010049; classtype:social-engineering; sid:6010049; rev:1; metadata: signature_severity Major, created_et 2026_08_14;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (alnazafat.com.pk/dh/hinet/index.php#x)"; flow:established,to_server; http.uri; content:"/dh/hinet/index.php#x"; startswith; fast_pattern; http.host; content:"alnazafat.com.pk"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010050; classtype:social-engineering; sid:6010050; rev:1; metadata: signature_severity Major, created_et 2026_08_14;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (personal-gym-bagus.com/supemaii/mail.html#yahoo@yahoo.com)"; flow:established,to_server; http.uri; content:"/supemaii/mail.html#yahoo@yahoo.com"; startswith; fast_pattern; http.host; content:"personal-gym-bagus.com"; endswith; reference:url,phishstats.info; reference:url,julioliraup.github.io/AT/signature.html?sid=6010051; classtype:social-engineering; sid:6010051; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (genialcorp.cl/allmroproducts/data-entry.html)"; flow:established,to_server; http.uri; content:"/allmroproducts/data-entry.html"; startswith; fast_pattern; http.host; content:"genialcorp.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010052; classtype:social-engineering; sid:6010052; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ksjnha6xx1.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ksjnha6xx1.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010053; classtype:social-engineering; sid:6010053; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nh.caydmc.com/windwardroofing/windwardroofing.html)"; flow:established,to_server; http.uri; content:"/windwardroofing/windwardroofing.html"; startswith; fast_pattern; http.host; content:"nh.caydmc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010054; classtype:social-engineering; sid:6010054; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (odd-illuminate-147571.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"odd-illuminate-147571.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010055; classtype:social-engineering; sid:6010055; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nous-legal.com/wwp/ap-backup.html)"; flow:established,to_server; http.uri; content:"/wwp/ap-backup.html"; startswith; fast_pattern; http.host; content:"nous-legal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010056; classtype:social-engineering; sid:6010056; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vnzkt72cxlb-hbkpt64hbk-2e4f0c-ycg51t.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"vnzkt72cxlb-hbkpt64hbk-2e4f0c-ycg51t.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010057; classtype:social-engineering; sid:6010057; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pintaelsevillano.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pintaelsevillano.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010058; classtype:social-engineering; sid:6010058; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.3011a3011.com/wp-admin/.wp-languages/.wjpl95qv_mlr.php)"; flow:established,to_server; http.uri; content:"/wp-admin/.wp-languages/.wjpl95qv_mlr.php"; startswith; fast_pattern; http.host; content:"m.3011a3011.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010059; classtype:social-engineering; sid:6010059; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (88dc4f.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"88dc4f.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010060; classtype:social-engineering; sid:6010060; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tshopchinese.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tshopchinese.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010061; classtype:social-engineering; sid:6010061; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8d8d9a.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8d8d9a.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010062; classtype:social-engineering; sid:6010062; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (acba01.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"acba01.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010063; classtype:social-engineering; sid:6010063; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a5c33326-c5c4-8159-b0a9-docusign.rajesh-das1010.workers.dev/zx5ysdxtb/vukwp)"; flow:established,to_server; http.uri; content:"/zx5ysdxtb/vukwp"; startswith; fast_pattern; http.host; content:"a5c33326-c5c4-8159-b0a9-docusign.rajesh-das1010.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010064; classtype:social-engineering; sid:6010064; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (site-rtvia0g17.godaddysites.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"site-rtvia0g17.godaddysites.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010065; classtype:social-engineering; sid:6010065; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (37d768.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"37d768.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010066; classtype:social-engineering; sid:6010066; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.nsaildji1298.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.nsaildji1298.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010067; classtype:social-engineering; sid:6010067; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (72f5aa.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"72f5aa.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010068; classtype:social-engineering; sid:6010068; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c8b4db.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c8b4db.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010069; classtype:social-engineering; sid:6010069; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spectrum.hirevue-app.com/guest/ce/foyers/now/Event.aspx?ssid=4832471)"; flow:established,to_server; http.uri; content:"/guest/ce/foyers/now/Event.aspx?ssid=4832471"; startswith; fast_pattern; http.host; content:"spectrum.hirevue-app.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010070; classtype:social-engineering; sid:6010070; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (privacidad365.infy.click/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"privacidad365.infy.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010071; classtype:social-engineering; sid:6010071; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enelgia.club/login/index)"; flow:established,to_server; http.uri; content:"/login/index"; startswith; fast_pattern; http.host; content:"enelgia.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010072; classtype:social-engineering; sid:6010072; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ec5940.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ec5940.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010073; classtype:social-engineering; sid:6010073; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dr.flipme.info/docs/docsign.html)"; flow:established,to_server; http.uri; content:"/docs/docsign.html"; startswith; fast_pattern; http.host; content:"dr.flipme.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010074; classtype:social-engineering; sid:6010074; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fildenford-mq.vercel.app/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"fildenford-mq.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010075; classtype:social-engineering; sid:6010075; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fragrant-smoke-df4efe.phynatu.workers.dev/common/oauth2/v2.0/authorize/)"; flow:established,to_server; http.uri; content:"/common/oauth2/v2.0/authorize/"; startswith; fast_pattern; http.host; content:"fragrant-smoke-df4efe.phynatu.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010076; classtype:social-engineering; sid:6010076; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (limitlessdubai-dp8oxsl60kva.edgeone.dev/wires$inboxPablo.html)"; flow:established,to_server; http.uri; content:"/wires$inboxPablo.html"; startswith; fast_pattern; http.host; content:"limitlessdubai-dp8oxsl60kva.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010077; classtype:social-engineering; sid:6010077; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-alert.click/JT0)"; flow:established,to_server; http.uri; content:"/JT0"; startswith; fast_pattern; http.host; content:"support-alert.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010078; classtype:social-engineering; sid:6010078; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.3011a3011.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.3011a3011.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010079; classtype:social-engineering; sid:6010079; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (23109c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"23109c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010080; classtype:social-engineering; sid:6010080; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (emctheatre.com/docusign/Mac/utility.php)"; flow:established,to_server; http.uri; content:"/docusign/Mac/utility.php"; startswith; fast_pattern; http.host; content:"emctheatre.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010081; classtype:social-engineering; sid:6010081; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.solicitudcancelacionbnp.proceso-digital.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.solicitudcancelacionbnp.proceso-digital.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010082; classtype:social-engineering; sid:6010082; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.lkubao3x1.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.lkubao3x1.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010083; classtype:social-engineering; sid:6010083; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (transcript.coinfundpolicyreview.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"transcript.coinfundpolicyreview.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010084; classtype:social-engineering; sid:6010084; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (codelogs-henna.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"codelogs-henna.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010085; classtype:social-engineering; sid:6010085; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ep-fr-a3xzw2e90g96-feeveudcc4dzehb3.z01.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ep-fr-a3xzw2e90g96-feeveudcc4dzehb3.z01.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010086; classtype:social-engineering; sid:6010086; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.onlineservicetec.com/landingpages/fe996bbf-3dce-487c-acd3-4a69200fa8a0/XHuGh3MwqO61T8IhIRdumoaHrrH_MUNV2zn3bSaL8AQ)"; flow:established,to_server; http.uri; content:"/landingpages/fe996bbf-3dce-487c-acd3-4a69200fa8a0/XHuGh3MwqO61T8IhIRdumoaHrrH_MUNV2zn3bSaL8AQ"; startswith; fast_pattern; http.host; content:"www.onlineservicetec.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010087; classtype:social-engineering; sid:6010087; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (af1981.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"af1981.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010088; classtype:social-engineering; sid:6010088; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (movieslinke.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"movieslinke.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010089; classtype:social-engineering; sid:6010089; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (muskandevpk.github.io/Netflix-Clone)"; flow:established,to_server; http.uri; content:"/Netflix-Clone"; startswith; fast_pattern; http.host; content:"muskandevpk.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010090; classtype:social-engineering; sid:6010090; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f6b873.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f6b873.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010091; classtype:social-engineering; sid:6010091; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bright-tarsier-4d96ff.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bright-tarsier-4d96ff.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010092; classtype:social-engineering; sid:6010092; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (astha-paruluniversity.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"astha-paruluniversity.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010093; classtype:social-engineering; sid:6010093; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lwemuhpbrhwujqu7x-ugk3vphvutaw96z0lcdyzswo.vercel.app/gkjrd6sdgb32dfhnysr5b)"; flow:established,to_server; http.uri; content:"/gkjrd6sdgb32dfhnysr5b"; startswith; fast_pattern; http.host; content:"lwemuhpbrhwujqu7x-ugk3vphvutaw96z0lcdyzswo.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010094; classtype:social-engineering; sid:6010094; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tvb-su9-xm2vox-kz1i3-4dg9.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tvb-su9-xm2vox-kz1i3-4dg9.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010095; classtype:social-engineering; sid:6010095; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (srv1898231.hstgr.cloud/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"srv1898231.hstgr.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010096; classtype:social-engineering; sid:6010096; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2b32d9.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2b32d9.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010097; classtype:social-engineering; sid:6010097; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (satyamkumarsrivastava.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"satyamkumarsrivastava.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010098; classtype:social-engineering; sid:6010098; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (71dbac.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"71dbac.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010099; classtype:social-engineering; sid:6010099; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (90c8d0.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"90c8d0.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010100; classtype:social-engineering; sid:6010100; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2d0bba.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2d0bba.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010101; classtype:social-engineering; sid:6010101; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (82e6ab.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"82e6ab.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010102; classtype:social-engineering; sid:6010102; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d0317e.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d0317e.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010103; classtype:social-engineering; sid:6010103; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-location.co/yZH)"; flow:established,to_server; http.uri; content:"/yZH"; startswith; fast_pattern; http.host; content:"support-location.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010104; classtype:social-engineering; sid:6010104; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1c2c9e.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1c2c9e.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010105; classtype:social-engineering; sid:6010105; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abdul27705.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"abdul27705.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010106; classtype:social-engineering; sid:6010106; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (virginmedia.effective-software.com/login/)"; flow:established,to_server; http.uri; content:"/login/"; startswith; fast_pattern; http.host; content:"virginmedia.effective-software.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010107; classtype:social-engineering; sid:6010107; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docusign-server.github.io/RFP2026/)"; flow:established,to_server; http.uri; content:"/RFP2026/"; startswith; fast_pattern; http.host; content:"docusign-server.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010108; classtype:social-engineering; sid:6010108; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.x13pga-agp31x.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.x13pga-agp31x.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010109; classtype:social-engineering; sid:6010109; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.awscfdns.com/MICHAEL-BLURAY-DIGITAL-STEELBOOK-EXCLUSIVE/dp/B0GVNTYLPJ/ref=zg_bsnr_g_movies-tv_d_sccl_3/133-6697513-4245743)"; flow:established,to_server; http.uri; content:"/MICHAEL-BLURAY-DIGITAL-STEELBOOK-EXCLUSIVE/dp/B0GVNTYLPJ/ref=zg_bsnr_g_movies-tv_d_sccl_3/133-6697513-4245743"; startswith; fast_pattern; http.host; content:"www.awscfdns.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010110; classtype:social-engineering; sid:6010110; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (americasdspkits.com/rewards_login)"; flow:established,to_server; http.uri; content:"/rewards_login"; startswith; fast_pattern; http.host; content:"americasdspkits.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010111; classtype:social-engineering; sid:6010111; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.docusignsetup.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.docusignsetup.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010112; classtype:social-engineering; sid:6010112; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (request-imap.za.com/help?bI2)"; flow:established,to_server; http.uri; content:"/help?bI2"; startswith; fast_pattern; http.host; content:"request-imap.za.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010113; classtype:social-engineering; sid:6010113; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.bwdocusignsetup.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.bwdocusignsetup.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010114; classtype:social-engineering; sid:6010114; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newcheckdiepage2026s.netlify.app/live?Meta/business/help/30897)"; flow:established,to_server; http.uri; content:"/live?Meta/business/help/30897"; startswith; fast_pattern; http.host; content:"newcheckdiepage2026s.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010115; classtype:social-engineering; sid:6010115; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (transcript.bitrefillreviewpolicy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"transcript.bitrefillreviewpolicy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010116; classtype:social-engineering; sid:6010116; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dapper-kelpie-e759ea.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dapper-kelpie-e759ea.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010117; classtype:social-engineering; sid:6010117; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bmwrepairrancho.com/docusign/Windows/utility.php)"; flow:established,to_server; http.uri; content:"/docusign/Windows/utility.php"; startswith; fast_pattern; http.host; content:"bmwrepairrancho.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010118; classtype:social-engineering; sid:6010118; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nobojug.blog/auth/index.html)"; flow:established,to_server; http.uri; content:"/auth/index.html"; startswith; fast_pattern; http.host; content:"nobojug.blog"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010119; classtype:social-engineering; sid:6010119; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (transcript.emurgopolicyreview.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"transcript.emurgopolicyreview.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010120; classtype:social-engineering; sid:6010120; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seguridad-bancol.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"seguridad-bancol.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010121; classtype:social-engineering; sid:6010121; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apptalktalk.mailhelpdesksupport.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"apptalktalk.mailhelpdesksupport.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010122; classtype:social-engineering; sid:6010122; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f174b7.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f174b7.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010123; classtype:social-engineering; sid:6010123; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.baoleuno1x.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.baoleuno1x.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010124; classtype:social-engineering; sid:6010124; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sucursaivlrtualpersonas.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sucursaivlrtualpersonas.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010125; classtype:social-engineering; sid:6010125; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (invite.go2omega.com/go/Mac/utility.php)"; flow:established,to_server; http.uri; content:"/go/Mac/utility.php"; startswith; fast_pattern; http.host; content:"invite.go2omega.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010126; classtype:social-engineering; sid:6010126; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gulabahmad-code.github.io/Assignment_5/)"; flow:established,to_server; http.uri; content:"/Assignment_5/"; startswith; fast_pattern; http.host; content:"gulabahmad-code.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010127; classtype:social-engineering; sid:6010127; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.15lpga-agp1.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.15lpga-agp1.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010128; classtype:social-engineering; sid:6010128; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (orange-unit-8ad1.yvetteeusebio82k968ysa4.workers.dev/meta-account-security)"; flow:established,to_server; http.uri; content:"/meta-account-security"; startswith; fast_pattern; http.host; content:"orange-unit-8ad1.yvetteeusebio82k968ysa4.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010129; classtype:social-engineering; sid:6010129; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ssosigninattcomiloginrw2a84.authcurrentlymailupdate.workers.dev/home.php?usrid=JmALSBVaMrUjsyc57jfTpzwc7Ukz4sgLhbh3rklJu0YRs7oN4kYSTxDm9PSWASwLwXc5E7Cww1FWQK5vHsrRTovedsuezpErXgx4UcxfeA7QUiUjhKZwiBlQc29jYWxlcWZpbmFuY2VAYXR0Lm5ldA==Dwdsex1ipdk0uJIoSaXnVxGrWnoxtYnymOngXK3eSaSZDJJw1y)"; flow:established,to_server; http.uri; content:"/home.php?usrid=JmALSBVaMrUjsyc57jfTpzwc7Ukz4sgLhbh3rklJu0YRs7oN4kYSTxDm9PSWASwLwXc5E7Cww1FWQK5vHsrRTovedsuezpErXgx4UcxfeA7QUiUjhKZwiBlQc29jYWxlcWZpbmFuY2VAYXR0Lm5ldA==Dwdsex1ipdk0uJIoSaXnVxGrWnoxtYnymOngXK3eSaSZDJJw1y"; startswith; fast_pattern; http.host; content:"ssosigninattcomiloginrw2a84.authcurrentlymailupdate.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010130; classtype:social-engineering; sid:6010130; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m-tabish01.github.io/Spotify/)"; flow:established,to_server; http.uri; content:"/Spotify/"; startswith; fast_pattern; http.host; content:"m-tabish01.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010131; classtype:social-engineering; sid:6010131; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (delicate-horse-3bbb09.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"delicate-horse-3bbb09.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010132; classtype:social-engineering; sid:6010132; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreiexrtpkkflfywi6lyfj7zc5bw6zrcvv4dib4wbfjrxnkyxuiohdfm.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreiexrtpkkflfywi6lyfj7zc5bw6zrcvv4dib4wbfjrxnkyxuiohdfm.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010133; classtype:social-engineering; sid:6010133; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9byz24te3c2mzqfde-w0e6ehvefr5cxjawryycct0f.vercel.app/sdgfj6hgkf3bsfdgj8sdfa2d)"; flow:established,to_server; http.uri; content:"/sdgfj6hgkf3bsfdgj8sdfa2d"; startswith; fast_pattern; http.host; content:"9byz24te3c2mzqfde-w0e6ehvefr5cxjawryycct0f.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010134; classtype:social-engineering; sid:6010134; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c93c8d.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c93c8d.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010135; classtype:social-engineering; sid:6010135; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wellsfargo-index-9prz.hostmora.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wellsfargo-index-9prz.hostmora.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010136; classtype:social-engineering; sid:6010136; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4b1c9b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4b1c9b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010137; classtype:social-engineering; sid:6010137; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hudlow.org/2026/practical-antiforgery/demo/1password)"; flow:established,to_server; http.uri; content:"/2026/practical-antiforgery/demo/1password"; startswith; fast_pattern; http.host; content:"hudlow.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010138; classtype:social-engineering; sid:6010138; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.onlineservicetec.com/landingpages/6641da38-5372-40e8-a9f2-f87c7b3b69de/rzx4nb3tdkrbqizgg6gjljbf-t_-fonakqgc6eajee)"; flow:established,to_server; http.uri; content:"/landingpages/6641da38-5372-40e8-a9f2-f87c7b3b69de/rzx4nb3tdkrbqizgg6gjljbf-t_-fonakqgc6eajee"; startswith; fast_pattern; http.host; content:"www.onlineservicetec.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010139; classtype:social-engineering; sid:6010139; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freltek.com/DPHSS/DivisionofPublicWelfare.html)"; flow:established,to_server; http.uri; content:"/DPHSS/DivisionofPublicWelfare.html"; startswith; fast_pattern; http.host; content:"freltek.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010140; classtype:social-engineering; sid:6010140; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bde6ac.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bde6ac.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010141; classtype:social-engineering; sid:6010141; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lwemuhpbrhwujqu7x-ugk3vphvutaw96z0lcdyzswo.vercel.app/gkjrd6sdgb32dfhnysr5b.html)"; flow:established,to_server; http.uri; content:"/gkjrd6sdgb32dfhnysr5b.html"; startswith; fast_pattern; http.host; content:"lwemuhpbrhwujqu7x-ugk3vphvutaw96z0lcdyzswo.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010142; classtype:social-engineering; sid:6010142; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox.com.ge/games/2753915549/Blox-Fruits?privateServerLinkCode=16504950028831899918143196129240)"; flow:established,to_server; http.uri; content:"/games/2753915549/Blox-Fruits?privateServerLinkCode=16504950028831899918143196129240"; startswith; fast_pattern; http.host; content:"roblox.com.ge"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010143; classtype:social-engineering; sid:6010143; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xamanpolicy.live/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xamanpolicy.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010144; classtype:social-engineering; sid:6010144; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (emailvalidaraccountmsn.hstn.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"emailvalidaraccountmsn.hstn.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010145; classtype:social-engineering; sid:6010145; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3f25f4.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3f25f4.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010146; classtype:social-engineering; sid:6010146; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-f040746450704ad9abc7d037f2ba2f445.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pub-f040746450704ad9abc7d037f2ba2f445.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010147; classtype:social-engineering; sid:6010147; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nimbase.github.io/paypal-api)"; flow:established,to_server; http.uri; content:"/paypal-api"; startswith; fast_pattern; http.host; content:"nimbase.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010148; classtype:social-engineering; sid:6010148; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (guiatotalbrasil.com/DocuSign/Mac/utility.php)"; flow:established,to_server; http.uri; content:"/DocuSign/Mac/utility.php"; startswith; fast_pattern; http.host; content:"guiatotalbrasil.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010149; classtype:social-engineering; sid:6010149; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (soporteclave.com/?rid=8KjOYGL)"; flow:established,to_server; http.uri; content:"/?rid=8KjOYGL"; startswith; fast_pattern; http.host; content:"soporteclave.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010150; classtype:social-engineering; sid:6010150; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6c236e.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6c236e.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010151; classtype:social-engineering; sid:6010151; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trustwallet-usdt-loader-card.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trustwallet-usdt-loader-card.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010152; classtype:social-engineering; sid:6010152; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1823bd.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1823bd.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010153; classtype:social-engineering; sid:6010153; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robuxhub.systeme.io/8000-robux-code)"; flow:established,to_server; http.uri; content:"/8000-robux-code"; startswith; fast_pattern; http.host; content:"robuxhub.systeme.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010154; classtype:social-engineering; sid:6010154; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4efd71.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4efd71.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010155; classtype:social-engineering; sid:6010155; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.seguridad-bancol.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.seguridad-bancol.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010156; classtype:social-engineering; sid:6010156; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4f094b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4f094b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010157; classtype:social-engineering; sid:6010157; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.program-shopee13.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.program-shopee13.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010158; classtype:social-engineering; sid:6010158; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook-interface.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebook-interface.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010159; classtype:social-engineering; sid:6010159; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (borderclick.com/bc/media/borderclick/files/robuxx026hstas.html)"; flow:established,to_server; http.uri; content:"/bc/media/borderclick/files/robuxx026hstas.html"; startswith; fast_pattern; http.host; content:"borderclick.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010160; classtype:social-engineering; sid:6010160; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8f1256.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8f1256.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010161; classtype:social-engineering; sid:6010161; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enelgia.club/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"enelgia.club"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010162; classtype:social-engineering; sid:6010162; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (transcript.bnktothefuturepolicyreview.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"transcript.bnktothefuturepolicyreview.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010163; classtype:social-engineering; sid:6010163; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4b3ef5.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4b3ef5.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010164; classtype:social-engineering; sid:6010164; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ghoaspanmacopicv3784648402022727363690303.edgeone.dev/genhrportal234902827273637765092-289776.html)"; flow:established,to_server; http.uri; content:"/genhrportal234902827273637765092-289776.html"; startswith; fast_pattern; http.host; content:"ghoaspanmacopicv3784648402022727363690303.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010165; classtype:social-engineering; sid:6010165; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b8cf3f.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b8cf3f.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010166; classtype:social-engineering; sid:6010166; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kjgmhnetuyut.blogspot.com/p/payment-received-successfully-done_02032495307.html?m=1)"; flow:established,to_server; http.uri; content:"/p/payment-received-successfully-done_02032495307.html?m=1"; startswith; fast_pattern; http.host; content:"kjgmhnetuyut.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010167; classtype:social-engineering; sid:6010167; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bermita-kxt-felquza-p6t3fc82.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bermita-kxt-felquza-p6t3fc82.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010168; classtype:social-engineering; sid:6010168; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e88ba2.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e88ba2.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010169; classtype:social-engineering; sid:6010169; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (send-usdt-01-kappa.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"send-usdt-01-kappa.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010170; classtype:social-engineering; sid:6010170; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (solicitudcancelacionbnp.proceso-digital.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"solicitudcancelacionbnp.proceso-digital.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010171; classtype:social-engineering; sid:6010171; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8a5368.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8a5368.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010172; classtype:social-engineering; sid:6010172; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (507752.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"507752.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010173; classtype:social-engineering; sid:6010173; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (request-imap.za.com/bI2)"; flow:established,to_server; http.uri; content:"/bI2"; startswith; fast_pattern; http.host; content:"request-imap.za.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010174; classtype:social-engineering; sid:6010174; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (firstezkpg.run/riowC)"; flow:established,to_server; http.uri; content:"/riowC"; startswith; fast_pattern; http.host; content:"firstezkpg.run"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010175; classtype:social-engineering; sid:6010175; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pemenangshopee27.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pemenangshopee27.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010176; classtype:social-engineering; sid:6010176; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (exclusivsuanovachance.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"exclusivsuanovachance.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010177; classtype:social-engineering; sid:6010177; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0387ff.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0387ff.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010178; classtype:social-engineering; sid:6010178; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xenvoras.whahoola.info/Y2gtZmVkZXgtMjAyNg/?u=83C1655&e=csamsill%40fleetdirect.net&s3=&s4=&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/Y2gtZmVkZXgtMjAyNg/?u=83C1655&e=csamsill%40fleetdirect.net&s3=&s4=&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"xenvoras.whahoola.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010179; classtype:social-engineering; sid:6010179; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6d3851.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6d3851.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010180; classtype:social-engineering; sid:6010180; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pr-universe.com/s/63bzgfsvbwsfcdx7y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a)"; flow:established,to_server; http.uri; content:"/s/63bzgfsvbwsfcdx7y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a"; startswith; fast_pattern; http.host; content:"pr-universe.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010181; classtype:social-engineering; sid:6010181; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (condicoesdemargem.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"condicoesdemargem.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010182; classtype:social-engineering; sid:6010182; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d996c9.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d996c9.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010183; classtype:social-engineering; sid:6010183; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (043417.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"043417.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010184; classtype:social-engineering; sid:6010184; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (microsoftquarantine.authorised-support.com/login/review/wjy99UrJpywk6FVPPIN_vx51xfx1Jt7X1UEQ=7Bg==1XFhSQ15CXldFbl1eVlhfbkZYRVluQVBCQkZeQ1U=/qVL0fNmNYahdj2smOXWXeggfE1TOi_hb/)"; flow:established,to_server; http.uri; content:"/login/review/wjy99UrJpywk6FVPPIN_vx51xfx1Jt7X1UEQ=7Bg==1XFhSQ15CXldFbl1eVlhfbkZYRVluQVBCQkZeQ1U=/qVL0fNmNYahdj2smOXWXeggfE1TOi_hb/"; startswith; fast_pattern; http.host; content:"microsoftquarantine.authorised-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010185; classtype:social-engineering; sid:6010185; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3cb40c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3cb40c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010186; classtype:social-engineering; sid:6010186; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docusignnet.work/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"docusignnet.work"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010187; classtype:social-engineering; sid:6010187; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gh0stmap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.gh0stmap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010188; classtype:social-engineering; sid:6010188; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kjandiaodaadwd1.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kjandiaodaadwd1.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010189; classtype:social-engineering; sid:6010189; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.send-usdt-01-kappa.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.send-usdt-01-kappa.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010190; classtype:social-engineering; sid:6010190; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.1hotnaix1x.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.1hotnaix1x.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010191; classtype:social-engineering; sid:6010191; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jhenkargr.github.io/amazon--clone/)"; flow:established,to_server; http.uri; content:"/amazon--clone/"; startswith; fast_pattern; http.host; content:"jhenkargr.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010192; classtype:social-engineering; sid:6010192; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.helmaskin.com/m/login/)"; flow:established,to_server; http.uri; content:"/m/login/"; startswith; fast_pattern; http.host; content:"www.helmaskin.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010193; classtype:social-engineering; sid:6010193; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (300483.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"300483.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010194; classtype:social-engineering; sid:6010194; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tvb-su9-xm2vox-kz1i3-4dg9.pages.dev/send_appeal_request)"; flow:established,to_server; http.uri; content:"/send_appeal_request"; startswith; fast_pattern; http.host; content:"tvb-su9-xm2vox-kz1i3-4dg9.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010195; classtype:social-engineering; sid:6010195; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (documentssign.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"documentssign.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010196; classtype:social-engineering; sid:6010196; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.webfun.website/landingpages/a92eca60-2cb8-444d-9623-dfa436879834/aqcqJyL3zBfN-tU3jtg3nRzA7UJQ3vGdfouVTwF155o)"; flow:established,to_server; http.uri; content:"/landingpages/a92eca60-2cb8-444d-9623-dfa436879834/aqcqJyL3zBfN-tU3jtg3nRzA7UJQ3vGdfouVTwF155o"; startswith; fast_pattern; http.host; content:"www.webfun.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010197; classtype:social-engineering; sid:6010197; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (anshikamishra6373-blip.github.io/Amazon/)"; flow:established,to_server; http.uri; content:"/Amazon/"; startswith; fast_pattern; http.host; content:"anshikamishra6373-blip.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010198; classtype:social-engineering; sid:6010198; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zelqori-gld-darnexo-p2x1dk84.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zelqori-gld-darnexo-p2x1dk84.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010199; classtype:social-engineering; sid:6010199; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kjandiaodaadwd1.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kjandiaodaadwd1.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010200; classtype:social-engineering; sid:6010200; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myseattleacupuncture.com/build/57839287208.html)"; flow:established,to_server; http.uri; content:"/build/57839287208.html"; startswith; fast_pattern; http.host; content:"myseattleacupuncture.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010201; classtype:social-engineering; sid:6010201; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login-verifydocusignauthentication.dannatel.com.br/signature/document/)"; flow:established,to_server; http.uri; content:"/signature/document/"; startswith; fast_pattern; http.host; content:"login-verifydocusignauthentication.dannatel.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010202; classtype:social-engineering; sid:6010202; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portaltarifa.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portaltarifa.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010203; classtype:social-engineering; sid:6010203; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4de65b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4de65b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010204; classtype:social-engineering; sid:6010204; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docusign.riberaturisme.es/dc/Windows/utility.php/)"; flow:established,to_server; http.uri; content:"/dc/Windows/utility.php/"; startswith; fast_pattern; http.host; content:"docusign.riberaturisme.es"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010205; classtype:social-engineering; sid:6010205; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0ac7bd.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0ac7bd.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010206; classtype:social-engineering; sid:6010206; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.srv1898231.hstgr.cloud/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.srv1898231.hstgr.cloud"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010207; classtype:social-engineering; sid:6010207; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sacskllkgdcl1k2321kl3123x.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sacskllkgdcl1k2321kl3123x.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010208; classtype:social-engineering; sid:6010208; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eguiluz.es/gov/63938763928.html)"; flow:established,to_server; http.uri; content:"/gov/63938763928.html"; startswith; fast_pattern; http.host; content:"eguiluz.es"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010209; classtype:social-engineering; sid:6010209; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1d5f06.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1d5f06.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010210; classtype:social-engineering; sid:6010210; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.trustwallet-bnb-367987-654864.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.trustwallet-bnb-367987-654864.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010211; classtype:social-engineering; sid:6010211; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f7a673.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f7a673.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010212; classtype:social-engineering; sid:6010212; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (samtast1c.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"samtast1c.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010213; classtype:social-engineering; sid:6010213; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (351254.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"351254.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010214; classtype:social-engineering; sid:6010214; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (519ef0.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"519ef0.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010215; classtype:social-engineering; sid:6010215; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pjlgz42skrp-bmktpbm-3f4g6e-pjq87c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pjlgz42skrp-bmktpbm-3f4g6e-pjq87c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010216; classtype:social-engineering; sid:6010216; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.kawdeioqw.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.kawdeioqw.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010217; classtype:social-engineering; sid:6010217; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nh.caydmc.com/assnsoffice/assnsoffice.html)"; flow:established,to_server; http.uri; content:"/assnsoffice/assnsoffice.html"; startswith; fast_pattern; http.host; content:"nh.caydmc.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010218; classtype:social-engineering; sid:6010218; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nt.efxaxl.com/cignatureenergy/cignatureenergy.html)"; flow:established,to_server; http.uri; content:"/cignatureenergy/cignatureenergy.html"; startswith; fast_pattern; http.host; content:"nt.efxaxl.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010219; classtype:social-engineering; sid:6010219; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.team-bx.com/p/sst-cgj/lctwghft/)"; flow:established,to_server; http.uri; content:"/p/sst-cgj/lctwghft/"; startswith; fast_pattern; http.host; content:"s.team-bx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010220; classtype:social-engineering; sid:6010220; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (db14c5.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"db14c5.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010221; classtype:social-engineering; sid:6010221; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f2a7b9.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f2a7b9.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010222; classtype:social-engineering; sid:6010222; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dc6771.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dc6771.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010223; classtype:social-engineering; sid:6010223; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bafkreihql7542hbekhfae4355pumneesu37jvm2yqy22hi5wahk5pvyoci.ipfs.dweb.link/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bafkreihql7542hbekhfae4355pumneesu37jvm2yqy22hi5wahk5pvyoci.ipfs.dweb.link"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010224; classtype:social-engineering; sid:6010224; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6b46db.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6b46db.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010225; classtype:social-engineering; sid:6010225; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0bd0b0.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0bd0b0.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010226; classtype:social-engineering; sid:6010226; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (get-trust-wallet-card-now.info/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"get-trust-wallet-card-now.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010227; classtype:social-engineering; sid:6010227; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (327aca.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"327aca.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010228; classtype:social-engineering; sid:6010228; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (opensea-session443.onrender.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"opensea-session443.onrender.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010229; classtype:social-engineering; sid:6010229; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (server-static-page--optimumcarasls2.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"server-static-page--optimumcarasls2.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010230; classtype:social-engineering; sid:6010230; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bc1a22.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bc1a22.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010231; classtype:social-engineering; sid:6010231; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.finityvoice.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.finityvoice.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010232; classtype:social-engineering; sid:6010232; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d3a0b2.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d3a0b2.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010233; classtype:social-engineering; sid:6010233; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (matildasbloombox.com/getmedia/62a44f45-ebf3-4956-888b-da3dbb48015b/rbax)"; flow:established,to_server; http.uri; content:"/getmedia/62a44f45-ebf3-4956-888b-da3dbb48015b/rbax"; startswith; fast_pattern; http.host; content:"matildasbloombox.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010234; classtype:social-engineering; sid:6010234; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hihudhdgdidenuamryfrr.pages.dev/public)"; flow:established,to_server; http.uri; content:"/public"; startswith; fast_pattern; http.host; content:"hihudhdgdidenuamryfrr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010235; classtype:social-engineering; sid:6010235; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (463f33.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"463f33.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010236; classtype:social-engineering; sid:6010236; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.codelogs-henna.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.codelogs-henna.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010237; classtype:social-engineering; sid:6010237; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.j110q.vip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.j110q.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010238; classtype:social-engineering; sid:6010238; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7992ff.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7992ff.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010239; classtype:social-engineering; sid:6010239; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2e595f.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2e595f.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010240; classtype:social-engineering; sid:6010240; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3dbbe6.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3dbbe6.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010241; classtype:social-engineering; sid:6010241; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (71f3d8.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"71f3d8.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010242; classtype:social-engineering; sid:6010242; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trenvia.joergjooss.info/ga/click/2-17101341-21-14849-29085-16013-1671608fec-440cb48c16)"; flow:established,to_server; http.uri; content:"/ga/click/2-17101341-21-14849-29085-16013-1671608fec-440cb48c16"; startswith; fast_pattern; http.host; content:"trenvia.joergjooss.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010243; classtype:social-engineering; sid:6010243; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (affluent-copperhead-db9ec0.instawp.site/wp-content/plugins/bakycredit/)"; flow:established,to_server; http.uri; content:"/wp-content/plugins/bakycredit/"; startswith; fast_pattern; http.host; content:"affluent-copperhead-db9ec0.instawp.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010244; classtype:social-engineering; sid:6010244; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (70704b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"70704b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010245; classtype:social-engineering; sid:6010245; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xxccskkdjojomknoibyuv.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xxccskkdjojomknoibyuv.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010246; classtype:social-engineering; sid:6010246; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f7fbbb.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f7fbbb.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010247; classtype:social-engineering; sid:6010247; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trustwallet-bnb-367987-654864.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trustwallet-bnb-367987-654864.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010248; classtype:social-engineering; sid:6010248; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (87a44a.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"87a44a.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010249; classtype:social-engineering; sid:6010249; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8c1cd1.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8c1cd1.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010250; classtype:social-engineering; sid:6010250; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bd5022.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bd5022.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010251; classtype:social-engineering; sid:6010251; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.gladagnn.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.gladagnn.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010252; classtype:social-engineering; sid:6010252; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (seguranca-novobanco.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"seguranca-novobanco.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010253; classtype:social-engineering; sid:6010253; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.boetnetx.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.boetnetx.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010254; classtype:social-engineering; sid:6010254; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.lokalna-ofeta1224178.lol/oferta/jacuzzi-mspa-camaro-6-os%C3%B3b-1000l-jak-nowe/763975002)"; flow:established,to_server; http.uri; content:"/oferta/jacuzzi-mspa-camaro-6-os%C3%B3b-1000l-jak-nowe/763975002"; startswith; fast_pattern; http.host; content:"allegrolokalnie.lokalna-ofeta1224178.lol"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010255; classtype:social-engineering; sid:6010255; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-coiin-square-cloud.square.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en-coiin-square-cloud.square.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010256; classtype:social-engineering; sid:6010256; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (158851.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"158851.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010257; classtype:social-engineering; sid:6010257; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (627012.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"627012.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010258; classtype:social-engineering; sid:6010258; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.hopev.eu.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.hopev.eu.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010259; classtype:social-engineering; sid:6010259; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ef21b6.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ef21b6.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010260; classtype:social-engineering; sid:6010260; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-index-page--zhimingzhang76.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-index-page--zhimingzhang76.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010261; classtype:social-engineering; sid:6010261; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (variousoffers.xyz/newverified/onedrive-verify-obf.html)"; flow:established,to_server; http.uri; content:"/newverified/onedrive-verify-obf.html"; startswith; fast_pattern; http.host; content:"variousoffers.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010262; classtype:social-engineering; sid:6010262; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.regazzierminio.it/ANTISC/login.html)"; flow:established,to_server; http.uri; content:"/ANTISC/login.html"; startswith; fast_pattern; http.host; content:"www.regazzierminio.it"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010263; classtype:social-engineering; sid:6010263; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7bf8ea.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7bf8ea.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010264; classtype:social-engineering; sid:6010264; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pemenangshopee27.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pemenangshopee27.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010265; classtype:social-engineering; sid:6010265; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prithiwis.github.io/first-project/)"; flow:established,to_server; http.uri; content:"/first-project/"; startswith; fast_pattern; http.host; content:"prithiwis.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010266; classtype:social-engineering; sid:6010266; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (payme-paypal.com/login/)"; flow:established,to_server; http.uri; content:"/login/"; startswith; fast_pattern; http.host; content:"payme-paypal.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010267; classtype:social-engineering; sid:6010267; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-security-checker.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-security-checker.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010268; classtype:social-engineering; sid:6010268; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (company-prod-limit-config.s3.us-east-005.backblazeb2.com/aumento.html)"; flow:established,to_server; http.uri; content:"/aumento.html"; startswith; fast_pattern; http.host; content:"company-prod-limit-config.s3.us-east-005.backblazeb2.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010269; classtype:social-engineering; sid:6010269; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.01xpga-agpx11.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.01xpga-agpx11.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010270; classtype:social-engineering; sid:6010270; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (14b435.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"14b435.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010271; classtype:social-engineering; sid:6010271; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.onlineservicetec.com/landingpages/4f81d4b6-e454-4944-b9fd-e1bb0f01bfdd/hJV5Cx4Lh0D3Qax1_r2TMHV4pB7GSAEL2ZrA8Dz826Y)"; flow:established,to_server; http.uri; content:"/landingpages/4f81d4b6-e454-4944-b9fd-e1bb0f01bfdd/hJV5Cx4Lh0D3Qax1_r2TMHV4pB7GSAEL2ZrA8Dz826Y"; startswith; fast_pattern; http.host; content:"www.onlineservicetec.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010272; classtype:social-engineering; sid:6010272; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (228ae9.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"228ae9.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010273; classtype:social-engineering; sid:6010273; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kabirkushwaha121-design.github.io/Amazon_clone)"; flow:established,to_server; http.uri; content:"/Amazon_clone"; startswith; fast_pattern; http.host; content:"kabirkushwaha121-design.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010274; classtype:social-engineering; sid:6010274; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.trustwallet-usdt-loader-card.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.trustwallet-usdt-loader-card.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010275; classtype:social-engineering; sid:6010275; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ahneina116x1x.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ahneina116x1x.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010276; classtype:social-engineering; sid:6010276; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.laokkks1.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.laokkks1.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010277; classtype:social-engineering; sid:6010277; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (33b7f5.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"33b7f5.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010278; classtype:social-engineering; sid:6010278; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (68516ecbdfa1400f9f313d831.wasmer.app/ThaPpX0qdYxtcARwvYUSVxIMKm6H0rMYG7lnOBXdox4R68Pc43VjCWG8wOcI/JWCMWGiyWUgy34tUeSAJ2nLlVo7NAjRVxfW8EjSClGez76PrHyhAu1fhHWjyt0yNuQOwpy7GguuVCP5R/c2VpbGhpdGVjaEBzZWlsaGktdGVjaC5jb20=)"; flow:established,to_server; http.uri; content:"/ThaPpX0qdYxtcARwvYUSVxIMKm6H0rMYG7lnOBXdox4R68Pc43VjCWG8wOcI/JWCMWGiyWUgy34tUeSAJ2nLlVo7NAjRVxfW8EjSClGez76PrHyhAu1fhHWjyt0yNuQOwpy7GguuVCP5R/c2VpbGhpdGVjaEBzZWlsaGktdGVjaC5jb20="; startswith; fast_pattern; http.host; content:"68516ecbdfa1400f9f313d831.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010279; classtype:social-engineering; sid:6010279; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (groupmailserver.co.uk/?r=dfb7f6d2-93ad-400e-bae4-b3d4eb052167)"; flow:established,to_server; http.uri; content:"/?r=dfb7f6d2-93ad-400e-bae4-b3d4eb052167"; startswith; fast_pattern; http.host; content:"groupmailserver.co.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010280; classtype:social-engineering; sid:6010280; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.grvtdocusignsetup.icu/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.grvtdocusignsetup.icu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010281; classtype:social-engineering; sid:6010281; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (layanan-pemenang33.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"layanan-pemenang33.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010282; classtype:social-engineering; sid:6010282; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (program-shopee13.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"program-shopee13.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010283; classtype:social-engineering; sid:6010283; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trackingexpress-help.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trackingexpress-help.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010284; classtype:social-engineering; sid:6010284; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (de72fc.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"de72fc.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010285; classtype:social-engineering; sid:6010285; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trenvia.joergjooss.info/ga/click/2-17066634-21-14849-29085-16013-1671608fec-886b1376c5)"; flow:established,to_server; http.uri; content:"/ga/click/2-17066634-21-14849-29085-16013-1671608fec-886b1376c5"; startswith; fast_pattern; http.host; content:"trenvia.joergjooss.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010286; classtype:social-engineering; sid:6010286; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spectrum.hirevue-app.com/utilities/setTimeZone.aspx?url=%2fguest%2fce%2ffoyers%2fnow%2fEvent.aspx%3fssid%3d4832471)"; flow:established,to_server; http.uri; content:"/utilities/setTimeZone.aspx?url=%2fguest%2fce%2ffoyers%2fnow%2fEvent.aspx%3fssid%3d4832471"; startswith; fast_pattern; http.host; content:"spectrum.hirevue-app.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010287; classtype:social-engineering; sid:6010287; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e1d2fa.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e1d2fa.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010288; classtype:social-engineering; sid:6010288; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nt.efxaxl.com/shavestix/shavestix.html)"; flow:established,to_server; http.uri; content:"/shavestix/shavestix.html"; startswith; fast_pattern; http.host; content:"nt.efxaxl.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010289; classtype:social-engineering; sid:6010289; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wandering-fog-f8b1.yvetteeusebio82k968ysa4.workers.dev/meta-account-security)"; flow:established,to_server; http.uri; content:"/meta-account-security"; startswith; fast_pattern; http.host; content:"wandering-fog-f8b1.yvetteeusebio82k968ysa4.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010290; classtype:social-engineering; sid:6010290; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9byz24te3c2mzqfde-w0e6ehvefr5cxjawryycct0f.vercel.app/sdgfj6hgkf3bsfdgj8sdfa2d.html)"; flow:established,to_server; http.uri; content:"/sdgfj6hgkf3bsfdgj8sdfa2d.html"; startswith; fast_pattern; http.host; content:"9byz24te3c2mzqfde-w0e6ehvefr5cxjawryycct0f.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010291; classtype:social-engineering; sid:6010291; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (norquza-kxt-farmora-c7x3fq91.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"norquza-kxt-farmora-c7x3fq91.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010292; classtype:social-engineering; sid:6010292; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ph.cljgux.com/bowlatpinhead/bowlatpinhead.html)"; flow:established,to_server; http.uri; content:"/bowlatpinhead/bowlatpinhead.html"; startswith; fast_pattern; http.host; content:"ph.cljgux.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010293; classtype:social-engineering; sid:6010293; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9e50af.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9e50af.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010294; classtype:social-engineering; sid:6010294; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dynamic-rolypoly-cc530a.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dynamic-rolypoly-cc530a.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010295; classtype:social-engineering; sid:6010295; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login-verifydocusignauthentication.fomlchev.uk/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"login-verifydocusignauthentication.fomlchev.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010296; classtype:social-engineering; sid:6010296; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sunshine-spending-blast-devices.trycloudflare.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sunshine-spending-blast-devices.trycloudflare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010297; classtype:social-engineering; sid:6010297; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sock-zizifn-us.ludeaphd.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sock-zizifn-us.ludeaphd.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010298; classtype:social-engineering; sid:6010298; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.onlinehomespersona.zip/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.onlinehomespersona.zip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010299; classtype:social-engineering; sid:6010299; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.supp0rt-assistance.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.supp0rt-assistance.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010300; classtype:social-engineering; sid:6010300; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ssosigninattcomilogin6w2if0.authcurrentlymailupdate.workers.dev/home.php?usrid=Z1QE2VMaFyqBnyn3BVuZhfJLGYiR5ivi5NlIGcYuSy9IBcKtYo9J33TTagQf6oXwsJi1sJZSls7UdoqHFFu8rSY2DgF3wgsCKIUOpiapMp5r8j9Z2uYHvbFHZGF2aWRyaHVnaGVzQGJlbGxzb3V0aC5uZXQ=DzeB8gmCMzIJ1pINDQeqtYZqxSEXSsEdi0NuRzruZhsoG59vhm)"; flow:established,to_server; http.uri; content:"/home.php?usrid=Z1QE2VMaFyqBnyn3BVuZhfJLGYiR5ivi5NlIGcYuSy9IBcKtYo9J33TTagQf6oXwsJi1sJZSls7UdoqHFFu8rSY2DgF3wgsCKIUOpiapMp5r8j9Z2uYHvbFHZGF2aWRyaHVnaGVzQGJlbGxzb3V0aC5uZXQ=DzeB8gmCMzIJ1pINDQeqtYZqxSEXSsEdi0NuRzruZhsoG59vhm"; startswith; fast_pattern; http.host; content:"ssosigninattcomilogin6w2if0.authcurrentlymailupdate.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010301; classtype:social-engineering; sid:6010301; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.connect.resourcecloud.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.connect.resourcecloud.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010302; classtype:social-engineering; sid:6010302; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b3b860.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b3b860.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010303; classtype:social-engineering; sid:6010303; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (surya-suresh5651.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"surya-suresh5651.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010304; classtype:social-engineering; sid:6010304; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.116xpga-agp61x.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.116xpga-agp61x.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010305; classtype:social-engineering; sid:6010305; rev:1; metadata: signature_severity Major, created_et 2026_08_15;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apienidqltct8hpqm5klwdiiklg1owarsf6-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"apienidqltct8hpqm5klwdiiklg1owarsf6-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010306; classtype:social-engineering; sid:6010306; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tmi6nol4gm8h1yh5rqabksprkigmikkapasf37-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tmi6nol4gm8h1yh5rqabksprkigmikkapasf37-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010307; classtype:social-engineering; sid:6010307; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aypbymd1bcyrfyc5hkr7adatvkp4l2vhlfb33-h14v.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"aypbymd1bcyrfyc5hkr7adatvkp4l2vhlfb33-h14v.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010308; classtype:social-engineering; sid:6010308; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ig-auth.apps.prov.cx/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ig-auth.apps.prov.cx"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010309; classtype:social-engineering; sid:6010309; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (784788.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"784788.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010310; classtype:social-engineering; sid:6010310; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (212ed4.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"212ed4.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010311; classtype:social-engineering; sid:6010311; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (894349.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"894349.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010312; classtype:social-engineering; sid:6010312; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f230q.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f230q.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010313; classtype:social-engineering; sid:6010313; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e04527.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e04527.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010314; classtype:social-engineering; sid:6010314; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d8fc40.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d8fc40.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010315; classtype:social-engineering; sid:6010315; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (legenda782.github.io/script/)"; flow:established,to_server; http.uri; content:"/script/"; startswith; fast_pattern; http.host; content:"legenda782.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010316; classtype:social-engineering; sid:6010316; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (answers.quantarchive.com/question/index?qid=20160705175651AA7cZf2/)"; flow:established,to_server; http.uri; content:"/question/index?qid=20160705175651AA7cZf2/"; startswith; fast_pattern; http.host; content:"answers.quantarchive.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010317; classtype:social-engineering; sid:6010317; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4dac6b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4dac6b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010318; classtype:social-engineering; sid:6010318; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mobilehsbccprivateonline.com/en-gb/regulations/legal-information.html)"; flow:established,to_server; http.uri; content:"/en-gb/regulations/legal-information.html"; startswith; fast_pattern; http.host; content:"mobilehsbccprivateonline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010319; classtype:social-engineering; sid:6010319; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (n3b9c37.com:8989/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"n3b9c37.com:8989"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010320; classtype:social-engineering; sid:6010320; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tbnzqcsuvmehca3tlnomlldfkkyhgswymzsf35-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tbnzqcsuvmehca3tlnomlldfkkyhgswymzsf35-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010321; classtype:social-engineering; sid:6010321; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f80443.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f80443.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010322; classtype:social-engineering; sid:6010322; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (n2thb1ueg4lally6wpfz21z6u6m7zyvwqnsf3-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"n2thb1ueg4lally6wpfz21z6u6m7zyvwqnsf3-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010323; classtype:social-engineering; sid:6010323; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zz92krldmalgxqwbcqmhqmy5nmcdwjxpsf14-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zz92krldmalgxqwbcqmhqmy5nmcdwjxpsf14-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010324; classtype:social-engineering; sid:6010324; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ez1000tn019yw41108vezj4n3ocggkz4a1ub7ncesjym8n98he8av.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ez1000tn019yw41108vezj4n3ocggkz4a1ub7ncesjym8n98he8av.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010325; classtype:social-engineering; sid:6010325; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vh18414.vh.net.pl/TD/TD-ZE5KIzX0UW4&oauth_key_signature=eyJraWQOiJrUFVqdlNhT25GWUVDakpjMmV1MXJvNGxnb2VFeXJJb2tCbU1X3BiZXN/loading.php)"; flow:established,to_server; http.uri; content:"/TD/TD-ZE5KIzX0UW4&oauth_key_signature=eyJraWQOiJrUFVqdlNhT25GWUVDakpjMmV1MXJvNGxnb2VFeXJJb2tCbU1X3BiZXN/loading.php"; startswith; fast_pattern; http.host; content:"vh18414.vh.net.pl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010326; classtype:social-engineering; sid:6010326; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (test1.sougoucloud.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"test1.sougoucloud.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010327; classtype:social-engineering; sid:6010327; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3d9ffd.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3d9ffd.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010328; classtype:social-engineering; sid:6010328; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rnfzd3.com:8989/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"rnfzd3.com:8989"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010329; classtype:social-engineering; sid:6010329; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sbcglobal-att-signing-786084.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sbcglobal-att-signing-786084.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010330; classtype:social-engineering; sid:6010330; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (920483.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"920483.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010331; classtype:social-engineering; sid:6010331; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (51888e.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"51888e.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010332; classtype:social-engineering; sid:6010332; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (496466.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"496466.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010333; classtype:social-engineering; sid:6010333; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (940e27.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"940e27.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010334; classtype:social-engineering; sid:6010334; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6704a6.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6704a6.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010335; classtype:social-engineering; sid:6010335; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (442be6.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"442be6.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010336; classtype:social-engineering; sid:6010336; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dyrews.github.io/instagram.)"; flow:established,to_server; http.uri; content:"/instagram."; startswith; fast_pattern; http.host; content:"dyrews.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010337; classtype:social-engineering; sid:6010337; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp20ct-zorqal-biz-dravik-fensom.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp20ct-zorqal-biz-dravik-fensom.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010338; classtype:social-engineering; sid:6010338; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagramfollowersincreasefast.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"instagramfollowersincreasefast.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010339; classtype:social-engineering; sid:6010339; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3vvyneos2gtvgxlcsyr9j9rexr7faysjv9sf9-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3vvyneos2gtvgxlcsyr9j9rexr7faysjv9sf9-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010340; classtype:social-engineering; sid:6010340; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ez100001lrww771108vezpl1z9ngj2ovlnwkh79esky2zt4c6e3bv.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ez100001lrww771108vezpl1z9ngj2ovlnwkh79esky2zt4c6e3bv.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010341; classtype:social-engineering; sid:6010341; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mfcxhdh0uvsatdv3wv1oo7lgybxxwmtlsf18-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mfcxhdh0uvsatdv3wv1oo7lgybxxwmtlsf18-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010342; classtype:social-engineering; sid:6010342; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.securitysuite365.com/AccountSelectionPage/c?c=00000000-0000-0000-0000-000000000000-b20504ed-072c-4df2-babe-b932c3b081e3)"; flow:established,to_server; http.uri; content:"/AccountSelectionPage/c?c=00000000-0000-0000-0000-000000000000-b20504ed-072c-4df2-babe-b932c3b081e3"; startswith; fast_pattern; http.host; content:"www.securitysuite365.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010343; classtype:social-engineering; sid:6010343; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ez1000n04l8wy91108vez7f9hqxg1jzxdiz74knesha0ejq62t4wv.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ez1000n04l8wy91108vez7f9hqxg1jzxdiz74knesha0ejq62t4wv.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010344; classtype:social-engineering; sid:6010344; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hitdifferentupdate.framer.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hitdifferentupdate.framer.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010345; classtype:social-engineering; sid:6010345; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trackingnumbers.org/ups-y)"; flow:established,to_server; http.uri; content:"/ups-y"; startswith; fast_pattern; http.host; content:"trackingnumbers.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010346; classtype:social-engineering; sid:6010346; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e62764.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e62764.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010347; classtype:social-engineering; sid:6010347; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pubgm.mobileaccesx-events.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pubgm.mobileaccesx-events.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010348; classtype:social-engineering; sid:6010348; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wan1cghebysv66lrkje5mtzbjo1wqtbbyysf39-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wan1cghebysv66lrkje5mtzbjo1wqtbbyysf39-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010349; classtype:social-engineering; sid:6010349; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ez1000bo947d2v1108vezvq3yx0gsk1xadnq69eesmqu15go8xs5v.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ez1000bo947d2v1108vezvq3yx0gsk1xadnq69eesmqu15go8xs5v.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010350; classtype:social-engineering; sid:6010350; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p1000v2z782wf1208vezl09upaghv5iya8s3nsesyfm3b4h26vpv.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p1000v2z782wf1208vezl09upaghv5iya8s3nsesyfm3b4h26vpv.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010351; classtype:social-engineering; sid:6010351; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abffb0.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"abffb0.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010352; classtype:social-engineering; sid:6010352; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amanvish90s.github.io/E-commerce_Amazon_Frontend_Clone/)"; flow:established,to_server; http.uri; content:"/E-commerce_Amazon_Frontend_Clone/"; startswith; fast_pattern; http.host; content:"amanvish90s.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010353; classtype:social-engineering; sid:6010353; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a8cwyd5h5othb84bsiyikuu7cxzl6iy9aksf23-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a8cwyd5h5othb84bsiyikuu7cxzl6iy9aksf23-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010354; classtype:social-engineering; sid:6010354; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sui-te-trezr.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sui-te-trezr.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010355; classtype:social-engineering; sid:6010355; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp20ct-molqer-biz-prasik-feldom.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp20ct-molqer-biz-prasik-feldom.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010356; classtype:social-engineering; sid:6010356; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cdjtrxh2zuesrvfw96w7ehiayydm1esu9jsf13-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cdjtrxh2zuesrvfw96w7ehiayydm1esu9jsf13-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010357; classtype:social-engineering; sid:6010357; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (627019.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"627019.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010358; classtype:social-engineering; sid:6010358; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox.com.ms/users/1346763463/profile)"; flow:established,to_server; http.uri; content:"/users/1346763463/profile"; startswith; fast_pattern; http.host; content:"roblox.com.ms"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010359; classtype:social-engineering; sid:6010359; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fe37afoluctqmdmlzinudgk8ttuf9lylyqsf25-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fe37afoluctqmdmlzinudgk8ttuf9lylyqsf25-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010360; classtype:social-engineering; sid:6010360; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (545b32.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"545b32.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010361; classtype:social-engineering; sid:6010361; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.netf-reintegration-definition.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.netf-reintegration-definition.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010362; classtype:social-engineering; sid:6010362; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (charter-login-your-email-accounts.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"charter-login-your-email-accounts.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010363; classtype:social-engineering; sid:6010363; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (senapatishrestha-ctrl.github.io/my-shopping-frontend/)"; flow:established,to_server; http.uri; content:"/my-shopping-frontend/"; startswith; fast_pattern; http.host; content:"senapatishrestha-ctrl.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010364; classtype:social-engineering; sid:6010364; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (freerobuxgen.r-e.kr/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"freerobuxgen.r-e.kr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010365; classtype:social-engineering; sid:6010365; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ed355c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ed355c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010366; classtype:social-engineering; sid:6010366; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (odgrslwsrkfs6ok0igls7el0b80rooogqfb23-h14v.vercel.app/jhfkme46hjtesdzgbasewr.html/)"; flow:established,to_server; http.uri; content:"/jhfkme46hjtesdzgbasewr.html/"; startswith; fast_pattern; http.host; content:"odgrslwsrkfs6ok0igls7el0b80rooogqfb23-h14v.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010367; classtype:social-engineering; sid:6010367; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p1000sh38a81c1208vezoyae01g3szvg46eqnues0wcc18mlaz0v.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p1000sh38a81c1208vezoyae01g3szvg46eqnues0wcc18mlaz0v.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010368; classtype:social-engineering; sid:6010368; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (15.rewardingmyself.com/index-form.php)"; flow:established,to_server; http.uri; content:"/index-form.php"; startswith; fast_pattern; http.host; content:"15.rewardingmyself.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010369; classtype:social-engineering; sid:6010369; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (phvswmrcpwohoasiro2zhclawbrpxg0ksf4-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"phvswmrcpwohoasiro2zhclawbrpxg0ksf4-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010370; classtype:social-engineering; sid:6010370; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ez1000u5v7a42y1108vezpc13inglj8qj0k4gcaesbrf15luzm24v.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ez1000u5v7a42y1108vezpc13inglj8qj0k4gcaesbrf15luzm24v.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010371; classtype:social-engineering; sid:6010371; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (87gnhs1ihmvmwlbstnmmrambg2zuojlbu5sf43-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"87gnhs1ihmvmwlbstnmmrambg2zuojlbu5sf43-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010372; classtype:social-engineering; sid:6010372; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (14bc2e.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"14bc2e.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010373; classtype:social-engineering; sid:6010373; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mobilehsbccprivateonline.com/campaigns/bib-works-for-me.html)"; flow:established,to_server; http.uri; content:"/campaigns/bib-works-for-me.html"; startswith; fast_pattern; http.host; content:"mobilehsbccprivateonline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010374; classtype:social-engineering; sid:6010374; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (750ecd.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"750ecd.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010375; classtype:social-engineering; sid:6010375; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ac1a0b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ac1a0b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010376; classtype:social-engineering; sid:6010376; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ez1000zw79yz451108vezi5t5segyegc42ymgm5esl8lih11c1ekv.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ez1000zw79yz451108vezi5t5segyegc42ymgm5esl8lih11c1ekv.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010377; classtype:social-engineering; sid:6010377; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (subscription.companymessagecenter.com/6197094-oH1faBZb-PKS9Q)"; flow:established,to_server; http.uri; content:"/6197094-oH1faBZb-PKS9Q"; startswith; fast_pattern; http.host; content:"subscription.companymessagecenter.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010378; classtype:social-engineering; sid:6010378; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s89hbugu68cg7wr6p7wvhlctmdszoesqsf26-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"s89hbugu68cg7wr6p7wvhlctmdszoesqsf26-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010379; classtype:social-engineering; sid:6010379; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (556648651.vip:8989/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"556648651.vip:8989"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010380; classtype:social-engineering; sid:6010380; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vh18414.vh.net.pl/TD/TD-ZE5KIzX0UW4&oauth_key_signature=eyJraWQOiJrUFVqdlNhT25GWUVDakpjMmV1MXJvNGxnb2VFeXJJb2tCbU1X3BiZXN/app.php)"; flow:established,to_server; http.uri; content:"/TD/TD-ZE5KIzX0UW4&oauth_key_signature=eyJraWQOiJrUFVqdlNhT25GWUVDakpjMmV1MXJvNGxnb2VFeXJJb2tCbU1X3BiZXN/app.php"; startswith; fast_pattern; http.host; content:"vh18414.vh.net.pl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010381; classtype:social-engineering; sid:6010381; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopbalancetrial.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopbalancetrial.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010382; classtype:social-engineering; sid:6010382; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apw0ad6t3hvzwtka4i0aezli1ok4lqf50nsf45-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"apw0ad6t3hvzwtka4i0aezli1ok4lqf50nsf45-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010383; classtype:social-engineering; sid:6010383; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0a8411.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0a8411.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010384; classtype:social-engineering; sid:6010384; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dealwa.cc/SwnkfvGL/?puma-schweiz-fan-drop-2026.html)"; flow:established,to_server; http.uri; content:"/SwnkfvGL/?puma-schweiz-fan-drop-2026.html"; startswith; fast_pattern; http.host; content:"dealwa.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010385; classtype:social-engineering; sid:6010385; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (44200f.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"44200f.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010386; classtype:social-engineering; sid:6010386; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (phvjn9dplixyw-bgrnd205uhy-1c4d3e-dru5a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"phvjn9dplixyw-bgrnd205uhy-1c4d3e-dru5a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010387; classtype:social-engineering; sid:6010387; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ngb4vymxdc302qd3hsc8mu2gcn5qhbzgsf2-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ngb4vymxdc302qd3hsc8mu2gcn5qhbzgsf2-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010388; classtype:social-engineering; sid:6010388; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (15.rewardingmyself.com/index-v3.php?version=v3)"; flow:established,to_server; http.uri; content:"/index-v3.php?version=v3"; startswith; fast_pattern; http.host; content:"15.rewardingmyself.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010389; classtype:social-engineering; sid:6010389; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7dhzrw85gm-cell.github.io/Roblox.com/)"; flow:established,to_server; http.uri; content:"/Roblox.com/"; startswith; fast_pattern; http.host; content:"7dhzrw85gm-cell.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010390; classtype:social-engineering; sid:6010390; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ki1wrevfps6s.cityabovetheclouwst.us.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ki1wrevfps6s.cityabovetheclouwst.us.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010391; classtype:social-engineering; sid:6010391; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (15.rewardinglocker.com/index-form.php)"; flow:established,to_server; http.uri; content:"/index-form.php"; startswith; fast_pattern; http.host; content:"15.rewardinglocker.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010392; classtype:social-engineering; sid:6010392; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (15.rewardinglocker.com/index-v14.php)"; flow:established,to_server; http.uri; content:"/index-v14.php"; startswith; fast_pattern; http.host; content:"15.rewardinglocker.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010393; classtype:social-engineering; sid:6010393; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mobilehsbccprivateonline.com/en-gb/products-and-solutions.html)"; flow:established,to_server; http.uri; content:"/en-gb/products-and-solutions.html"; startswith; fast_pattern; http.host; content:"mobilehsbccprivateonline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010394; classtype:social-engineering; sid:6010394; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f2c795.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f2c795.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010395; classtype:social-engineering; sid:6010395; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info.companymessagecenter.com/6197094-oH1faBZb-PKS9Q)"; flow:established,to_server; http.uri; content:"/6197094-oH1faBZb-PKS9Q"; startswith; fast_pattern; http.host; content:"info.companymessagecenter.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010396; classtype:social-engineering; sid:6010396; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a3b9c6s6.com:8989/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"a3b9c6s6.com:8989"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010397; classtype:social-engineering; sid:6010397; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ifj5zymzpstto15d7glrn1qslacax8b5vosf47-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ifj5zymzpstto15d7glrn1qslacax8b5vosf47-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010398; classtype:social-engineering; sid:6010398; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ab5ea1.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ab5ea1.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010399; classtype:social-engineering; sid:6010399; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fce4dhauzi5ifjwniomoltga3rwihqursf16-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fce4dhauzi5ifjwniomoltga3rwihqursf16-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010400; classtype:social-engineering; sid:6010400; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (0c053a.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"0c053a.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010401; classtype:social-engineering; sid:6010401; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8badd0.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8badd0.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010402; classtype:social-engineering; sid:6010402; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tanusharma630.github.io/Netflix-Clone/CreateAc.html)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/CreateAc.html"; startswith; fast_pattern; http.host; content:"tanusharma630.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010403; classtype:social-engineering; sid:6010403; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.team-dx.com/p/sst-cgj/lctwghft/)"; flow:established,to_server; http.uri; content:"/p/sst-cgj/lctwghft/"; startswith; fast_pattern; http.host; content:"s.team-dx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010404; classtype:social-engineering; sid:6010404; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cloud.totallao.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cloud.totallao.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010405; classtype:social-engineering; sid:6010405; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (de07b2.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"de07b2.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010406; classtype:social-engineering; sid:6010406; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (257898.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"257898.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010407; classtype:social-engineering; sid:6010407; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wzprb819m-yksmv341k-4e6f-qjl59p.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wzprb819m-yksmv341k-4e6f-qjl59p.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010408; classtype:social-engineering; sid:6010408; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (09097e.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"09097e.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010409; classtype:social-engineering; sid:6010409; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (15.rewardingmyself.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"15.rewardingmyself.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010410; classtype:social-engineering; sid:6010410; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (12e8ef.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"12e8ef.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010411; classtype:social-engineering; sid:6010411; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lacontroranaples.hostel.town/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lacontroranaples.hostel.town"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010412; classtype:social-engineering; sid:6010412; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ez10004w6lo2b11108vez5xycw4gwfo1o2r1ukiesgqu5l0z5l1sv.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ez10004w6lo2b11108vez5xycw4gwfo1o2r1ukiesgqu5l0z5l1sv.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010413; classtype:social-engineering; sid:6010413; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pcfhvgb7ntgxj1ycsanlykh6qxqpywdwsf46-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pcfhvgb7ntgxj1ycsanlykh6qxqpywdwsf46-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010414; classtype:social-engineering; sid:6010414; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (627020.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"627020.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010415; classtype:social-engineering; sid:6010415; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cesa2t9ssezsuo9nqtxqw1h43lwn62ibsf40-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cesa2t9ssezsuo9nqtxqw1h43lwn62ibsf40-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010416; classtype:social-engineering; sid:6010416; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sock-zizifn-anycast.ludeaphd.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sock-zizifn-anycast.ludeaphd.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010417; classtype:social-engineering; sid:6010417; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1e5ac2.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1e5ac2.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010418; classtype:social-engineering; sid:6010418; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (15.rewardingmyself.com/aboutyou-v7.php?version=v7)"; flow:established,to_server; http.uri; content:"/aboutyou-v7.php?version=v7"; startswith; fast_pattern; http.host; content:"15.rewardingmyself.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010419; classtype:social-engineering; sid:6010419; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (serdtfngbfv3.pages.dev/gp/most-gifted/toys-and-games)"; flow:established,to_server; http.uri; content:"/gp/most-gifted/toys-and-games"; startswith; fast_pattern; http.host; content:"serdtfngbfv3.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010420; classtype:social-engineering; sid:6010420; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (protectedcloud-message.merlekw.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"protectedcloud-message.merlekw.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010421; classtype:social-engineering; sid:6010421; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6c7f01.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6c7f01.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010422; classtype:social-engineering; sid:6010422; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ez1000k97ham891108veziq25kzgk2utgsl7t3pesges63flk19lv.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ez1000k97ham891108veziq25kzgk2utgsl7t3pesges63flk19lv.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010423; classtype:social-engineering; sid:6010423; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (formnnn-dnaindo.stripest.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"formnnn-dnaindo.stripest.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010424; classtype:social-engineering; sid:6010424; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qhchxoyrghtiwdu0j0dhuehpkuzylgmwj1sf41-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qhchxoyrghtiwdu0j0dhuehpkuzylgmwj1sf41-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010425; classtype:social-engineering; sid:6010425; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ez1000tc85sd431108vezof70qcgo4ceary7ow3esw5jb2mj5t4bv.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ez1000tc85sd431108vezof70qcgo4ceary7ow3esw5jb2mj5t4bv.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010426; classtype:social-engineering; sid:6010426; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tech-institute.org/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/"; startswith; fast_pattern; http.host; content:"tech-institute.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010427; classtype:social-engineering; sid:6010427; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (send-usdt-nu.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"send-usdt-nu.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010428; classtype:social-engineering; sid:6010428; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sendusdt-bnb.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sendusdt-bnb.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010429; classtype:social-engineering; sid:6010429; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c4ksgj9vue8z94kiflopfp3pjypgp4ypsf36-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c4ksgj9vue8z94kiflopfp3pjypgp4ypsf36-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010430; classtype:social-engineering; sid:6010430; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ez1000w88hmj861108vezq9l3olgrp7xawi4l5yesp2bm41jj3yhv.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ez1000w88hmj861108vezq9l3olgrp7xawi4l5yesp2bm41jj3yhv.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010431; classtype:social-engineering; sid:6010431; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wk2qjlbl9iz7kayeqlzhd5kzjqwakjkrsf30-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wk2qjlbl9iz7kayeqlzhd5kzjqwakjkrsf30-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010432; classtype:social-engineering; sid:6010432; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (55a783.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"55a783.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010433; classtype:social-engineering; sid:6010433; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.lose-dafa.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.lose-dafa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010434; classtype:social-engineering; sid:6010434; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8cb859.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8cb859.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010435; classtype:social-engineering; sid:6010435; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (g8efyxbyslwh11gtww2v86yftgtbh2yydmsf15-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"g8efyxbyslwh11gtww2v86yftgtbh2yydmsf15-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010436; classtype:social-engineering; sid:6010436; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b4f97e.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b4f97e.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010437; classtype:social-engineering; sid:6010437; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgerlive-app--run.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgerlive-app--run.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010438; classtype:social-engineering; sid:6010438; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (12g-fsc1lv-tfaq8a-sfi-5gt.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"12g-fsc1lv-tfaq8a-sfi-5gt.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010439; classtype:social-engineering; sid:6010439; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.updateserv-owa.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.updateserv-owa.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010440; classtype:social-engineering; sid:6010440; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sock-zizifn-jp.ludeaphd.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sock-zizifn-jp.ludeaphd.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010441; classtype:social-engineering; sid:6010441; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (15.rewardingmyself.com/index-v14.php)"; flow:established,to_server; http.uri; content:"/index-v14.php"; startswith; fast_pattern; http.host; content:"15.rewardingmyself.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010442; classtype:social-engineering; sid:6010442; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (052dfe.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"052dfe.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010443; classtype:social-engineering; sid:6010443; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mobilehsbccprivateonline.com/en-gb/corporate/insights/growing-my-business/euromoney-awards.html)"; flow:established,to_server; http.uri; content:"/en-gb/corporate/insights/growing-my-business/euromoney-awards.html"; startswith; fast_pattern; http.host; content:"mobilehsbccprivateonline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010444; classtype:social-engineering; sid:6010444; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abdulsami-code.github.io/Amazon_Clone/)"; flow:established,to_server; http.uri; content:"/Amazon_Clone/"; startswith; fast_pattern; http.host; content:"abdulsami-code.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010445; classtype:social-engineering; sid:6010445; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d50700.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d50700.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010446; classtype:social-engineering; sid:6010446; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (351927.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"351927.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010447; classtype:social-engineering; sid:6010447; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.ezhj2znh069c.com:9229/account/reg?code=49407)"; flow:established,to_server; http.uri; content:"/account/reg?code=49407"; startswith; fast_pattern; http.host; content:"m.ezhj2znh069c.com:9229"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010448; classtype:social-engineering; sid:6010448; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mandtlogin.pages.dev/favicon.ico)"; flow:established,to_server; http.uri; content:"/favicon.ico"; startswith; fast_pattern; http.host; content:"mandtlogin.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010449; classtype:social-engineering; sid:6010449; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d1fb8b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d1fb8b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010450; classtype:social-engineering; sid:6010450; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (627014.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"627014.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010451; classtype:social-engineering; sid:6010451; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (930592.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"930592.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010452; classtype:social-engineering; sid:6010452; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (webmail-shaw-ca-source-webmail-poiu9ehuhe.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"webmail-shaw-ca-source-webmail-poiu9ehuhe.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010453; classtype:social-engineering; sid:6010453; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3a43bf.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3a43bf.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010454; classtype:social-engineering; sid:6010454; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ravichavi.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"ravichavi.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010455; classtype:social-engineering; sid:6010455; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ghjsc4158lk-mrqxbpli-2ik95d-ghj92c.pages.dev/welcome_aboard?welcome=1000968689063090&token248=1000968689063090&name_token136=Aylesford%20Farmers%20Market)"; flow:established,to_server; http.uri; content:"/welcome_aboard?welcome=1000968689063090&token248=1000968689063090&name_token136=Aylesford%20Farmers%20Market"; startswith; fast_pattern; http.host; content:"ghjsc4158lk-mrqxbpli-2ik95d-ghj92c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010456; classtype:social-engineering; sid:6010456; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4b066a.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4b066a.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010457; classtype:social-engineering; sid:6010457; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rkc3jqypcoxn9ag5p75asbmclpxcqqnxsf42-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rkc3jqypcoxn9ag5p75asbmclpxcqqnxsf42-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010458; classtype:social-engineering; sid:6010458; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bfe57e.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bfe57e.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010459; classtype:social-engineering; sid:6010459; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a3b9c19.com:8989/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"a3b9c19.com:8989"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010460; classtype:social-engineering; sid:6010460; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jyjlp005frgzee3sdiwv6xlyyidwaphisf34-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jyjlp005frgzee3sdiwv6xlyyidwaphisf34-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010461; classtype:social-engineering; sid:6010461; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p100061dw7cs11208vez6hz6yygnxvx37uo5kpesex7c90tw8huv.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p100061dw7cs11208vez6hz6yygnxvx37uo5kpesex7c90tw8huv.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010462; classtype:social-engineering; sid:6010462; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mobilehsbccprivateonline.com/en-gb/campaigns/fraud-reporting.html)"; flow:established,to_server; http.uri; content:"/en-gb/campaigns/fraud-reporting.html"; startswith; fast_pattern; http.host; content:"mobilehsbccprivateonline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010463; classtype:social-engineering; sid:6010463; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ez1000b42r0e9d1108vez6lwf5sgza6ujs43enbesmx4iaesp682v.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ez1000b42r0e9d1108vez6lwf5sgza6ujs43enbesmx4iaesp682v.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010464; classtype:social-engineering; sid:6010464; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shayan-builds.github.io/Amazon-Inspired-Landing-Page)"; flow:established,to_server; http.uri; content:"/Amazon-Inspired-Landing-Page"; startswith; fast_pattern; http.host; content:"shayan-builds.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010465; classtype:social-engineering; sid:6010465; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ez10002xf9fx931108vezv4yio3golls7b4g4pses1nycvbd87r8v.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ez10002xf9fx931108vezv4yio3golls7b4g4pses1nycvbd87r8v.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010466; classtype:social-engineering; sid:6010466; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.trezcr-live.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.trezcr-live.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010467; classtype:social-engineering; sid:6010467; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4c0228.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4c0228.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010468; classtype:social-engineering; sid:6010468; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6jlukswhynyjzypkuxfteu9o5zuibyfl0fb43-h14v.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6jlukswhynyjzypkuxfteu9o5zuibyfl0fb43-h14v.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010469; classtype:social-engineering; sid:6010469; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (i-teamdanmark.dk/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"i-teamdanmark.dk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010470; classtype:social-engineering; sid:6010470; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6hmdmw8yrhvexoevsksbs3k7abfbkexdsf44-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6hmdmw8yrhvexoevsksbs3k7abfbkexdsf44-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010471; classtype:social-engineering; sid:6010471; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jumk7vvywdyjmahfwyuo0tfnav9dfsfzsf28-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jumk7vvywdyjmahfwyuo0tfnav9dfsfzsf28-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010472; classtype:social-engineering; sid:6010472; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www-roblqx.co/users/587534862/profile)"; flow:established,to_server; http.uri; content:"/users/587534862/profile"; startswith; fast_pattern; http.host; content:"www-roblqx.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010473; classtype:social-engineering; sid:6010473; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (365k614.com:8989/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"365k614.com:8989"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010474; classtype:social-engineering; sid:6010474; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a78519.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a78519.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010475; classtype:social-engineering; sid:6010475; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (get-ledzer-us.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"get-ledzer-us.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010476; classtype:social-engineering; sid:6010476; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (19a8f6.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"19a8f6.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010477; classtype:social-engineering; sid:6010477; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lyiwj6shxzad4znunl3er39bnwr3qbhgbfb32-cg14v.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lyiwj6shxzad4znunl3er39bnwr3qbhgbfb32-cg14v.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010478; classtype:social-engineering; sid:6010478; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (218d6c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"218d6c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010479; classtype:social-engineering; sid:6010479; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d4544a.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d4544a.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010480; classtype:social-engineering; sid:6010480; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5d327b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"5d327b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010481; classtype:social-engineering; sid:6010481; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.to.lk/hJepFC/)"; flow:established,to_server; http.uri; content:"/hJepFC/"; startswith; fast_pattern; http.host; content:"www.to.lk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010482; classtype:social-engineering; sid:6010482; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7423e4.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7423e4.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010483; classtype:social-engineering; sid:6010483; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p10000b8q48ch1208vez3yp3bkg7ntznr1jal7est5bvio9t3c1v.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p10000b8q48ch1208vez3yp3bkg7ntznr1jal7est5bvio9t3c1v.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010484; classtype:social-engineering; sid:6010484; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (73y.8ca.mytemp.website/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"73y.8ca.mytemp.website"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010485; classtype:social-engineering; sid:6010485; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (78d625.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"78d625.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010486; classtype:social-engineering; sid:6010486; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ca6046.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ca6046.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010487; classtype:social-engineering; sid:6010487; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rbxlab.st/a/Search)"; flow:established,to_server; http.uri; content:"/a/Search"; startswith; fast_pattern; http.host; content:"rbxlab.st"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010488; classtype:social-engineering; sid:6010488; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (danazxindo.stripest.biz.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"danazxindo.stripest.biz.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010489; classtype:social-engineering; sid:6010489; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qtwiz-bfrnk-vlypx-b8c210-wplm-blidex.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qtwiz-bfrnk-vlypx-b8c210-wplm-blidex.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010490; classtype:social-engineering; sid:6010490; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hossein.ali-azizi2672.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hossein.ali-azizi2672.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010491; classtype:social-engineering; sid:6010491; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zh.wsp-whatapp.hl.cn/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"zh.wsp-whatapp.hl.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010492; classtype:social-engineering; sid:6010492; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dtiorpatpebd2mr8zqgirjvpbvmuufo4jysf5-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dtiorpatpebd2mr8zqgirjvpbvmuufo4jysf5-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010493; classtype:social-engineering; sid:6010493; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.boaliveportalaccess.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.boaliveportalaccess.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010494; classtype:social-engineering; sid:6010494; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (de845b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"de845b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010495; classtype:social-engineering; sid:6010495; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagramfollowersincreasefast.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagramfollowersincreasefast.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010496; classtype:social-engineering; sid:6010496; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.lnk.ink/https.wwvv.roblox-com)"; flow:established,to_server; http.uri; content:"/https.wwvv.roblox-com"; startswith; fast_pattern; http.host; content:"www.lnk.ink"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010497; classtype:social-engineering; sid:6010497; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rgq7x1bvj4fwdn9bnogx0dbcajn5pyvokfb46-h14v.vercel.app/jhfkme46hjtesdzgbasewr.html/)"; flow:established,to_server; http.uri; content:"/jhfkme46hjtesdzgbasewr.html/"; startswith; fast_pattern; http.host; content:"rgq7x1bvj4fwdn9bnogx0dbcajn5pyvokfb46-h14v.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010498; classtype:social-engineering; sid:6010498; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ebbc49.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ebbc49.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010499; classtype:social-engineering; sid:6010499; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (15.rewardinglocker.com/index-v3.php?version=v3)"; flow:established,to_server; http.uri; content:"/index-v3.php?version=v3"; startswith; fast_pattern; http.host; content:"15.rewardinglocker.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010500; classtype:social-engineering; sid:6010500; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp20ct-molqer-biz-prasik-feldom.pages.dev/rtyu-iopj-qewr-thjm?welcome=357416121091909&idnp=357416121091909&name_idnp=Freedom%20Satellite)"; flow:established,to_server; http.uri; content:"/rtyu-iopj-qewr-thjm?welcome=357416121091909&idnp=357416121091909&name_idnp=Freedom%20Satellite"; startswith; fast_pattern; http.host; content:"sp20ct-molqer-biz-prasik-feldom.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010501; classtype:social-engineering; sid:6010501; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6sdc92htfriorizie8ei4caqn4sumewi0fb4-h14v.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6sdc92htfriorizie8ei4caqn4sumewi0fb4-h14v.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010502; classtype:social-engineering; sid:6010502; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (business-metasupports.tiiny.site/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"business-metasupports.tiiny.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010503; classtype:social-engineering; sid:6010503; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d4441d.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d4441d.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010504; classtype:social-engineering; sid:6010504; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nn1nfwobickgopgcuw3rvcwwudezimafpvsf21-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nn1nfwobickgopgcuw3rvcwwudezimafpvsf21-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010505; classtype:social-engineering; sid:6010505; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (erdeepaksharm.github.io/Amazone/)"; flow:established,to_server; http.uri; content:"/Amazone/"; startswith; fast_pattern; http.host; content:"erdeepaksharm.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010506; classtype:social-engineering; sid:6010506; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8f7173.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8f7173.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010507; classtype:social-engineering; sid:6010507; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (scotiabank.net.pe/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"scotiabank.net.pe"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010508; classtype:social-engineering; sid:6010508; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (de0d2c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"de0d2c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010509; classtype:social-engineering; sid:6010509; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ab74fd.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ab74fd.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010510; classtype:social-engineering; sid:6010510; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kazuvjwtdblvpemjtlht6k2zru7p3qovsf8-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kazuvjwtdblvpemjtlht6k2zru7p3qovsf8-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010511; classtype:social-engineering; sid:6010511; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookuseraccount.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebookuseraccount.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010512; classtype:social-engineering; sid:6010512; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amazon-ae-relay.apps.prov.cx/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"amazon-ae-relay.apps.prov.cx"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010513; classtype:social-engineering; sid:6010513; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ez1000w69p4jp11108vezlcd6h6ghn5onn2pkg4es9pmsur4f1a0v.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ez1000w69p4jp11108vezlcd6h6ghn5onn2pkg4es9pmsur4f1a0v.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010514; classtype:social-engineering; sid:6010514; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (protectedcloud-message.merlekw.workers.dev/d1b45803535d30af)"; flow:established,to_server; http.uri; content:"/d1b45803535d30af"; startswith; fast_pattern; http.host; content:"protectedcloud-message.merlekw.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010515; classtype:social-engineering; sid:6010515; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (znvqk1ntppxkjsv31jos0vlgeyclufl5hjsf7-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"znvqk1ntppxkjsv31jos0vlgeyclufl5hjsf7-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010516; classtype:social-engineering; sid:6010516; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (59d735.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"59d735.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010517; classtype:social-engineering; sid:6010517; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (15.rewardinglocker.com/index-v13.php)"; flow:established,to_server; http.uri; content:"/index-v13.php"; startswith; fast_pattern; http.host; content:"15.rewardinglocker.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010518; classtype:social-engineering; sid:6010518; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (im.savemorelab.com/walmart/walmart_260420_v1.html?lptoken=179586a0801976df0705&cep=N4Igdgpg7g+gFgSwC4wQExALhADgAwBsATDhEQKwC0ALAIyE0DGaOlAnAOyMSUCGOaIgTYAjanjTVeIADQgAbggDOyVBmwiOeAMwRG/Gh21sm5AGaUcjEUUrlGDtCJEsibDHMUqUSBAFsIJSRePwAHLBAiPCFKPFZacgAVWmpMcgJMag4AOnI2WgAtWRAIAA8kCAAnMF4AGzUI4EZahEYAazUAX2KvZAB7SobsIjNqIl4OEVYCam1tGl4iakoRRgJGSghOcg4Utmo2CBxi/TDeBABzMCGQYQhyCG0CHZwbHC08WiIEtDZtY7kYD6aAgNzwxSBIJgSAAnqEIBEADK8MBoBBgC4Q4Ggxhwc5gLAAbRA4IAunJQpVAhBanoKmgYJCEZhQLD4UiUWiMcVgpULhAUOgIncHhQ2GwzNpFgQ8J8ongRGYINJAdiwRCykgsKy4cyQAB5MxKyo83h8gU3EUQWi8ahoRg4LLkWVfOaMPDUchYqFC7B4GDgwGarBgACutVqnU6clx+JgoT63gQfQJLJAjFDlSpYCQADlsQBJVFlLB4OQiSoo3FFtHcJRE0nRkDKGBUtFUxhazBISqhiByACOSnCaearQ6vpATRa7S6JypvF88lBk6aC6XK7Q3TkvDQ8hgp1C5yuN2Au/3h+P13Q2/T64Qy8ZIT1a+VG6fAVvodDq+/N+K54wH0RpVKegHAcac5yBBoE1AEjQwYMcEQLevBGggLSLpujRoWYGEIFhUHNmgZjSNgwDoKRt6UbwMB+GgXrkTRdEMbeFznOoU7sf+cjcQy9GMVxHEseQ1EBAgjT+BACBidJImSeJImoailR9OgYEqWpDI8SAnKqep6kCThmkGfxrHFH4vCMI0lmMLetnyeRDkCbefQcQhHGucJRnkW5hnmXIoZkVOQXdE2LaQFAWCkbUSgoUAA=&cpid=69e5e36578b287001215d938)"; flow:established,to_server; http.uri; content:"/walmart/walmart_260420_v1.html?lptoken=179586a0801976df0705&cep=N4Igdgpg7g+gFgSwC4wQExALhADgAwBsATDhEQKwC0ALAIyE0DGaOlAnAOyMSUCGOaIgTYAjanjTVeIADQgAbggDOyVBmwiOeAMwRG/Gh21sm5AGaUcjEUUrlGDtCJEsibDHMUqUSBAFsIJSRePwAHLBAiPCFKPFZacgAVWmpMcgJMag4AOnI2WgAtWRAIAA8kCAAnMF4AGzUI4EZahEYAazUAX2KvZAB7SobsIjNqIl4OEVYCam1tGl4iakoRRgJGSghOcg4Utmo2CBxi/TDeBABzMCGQYQhyCG0CHZwbHC08WiIEtDZtY7kYD6aAgNzwxSBIJgSAAnqEIBEADK8MBoBBgC4Q4Ggxhwc5gLAAbRA4IAunJQpVAhBanoKmgYJCEZhQLD4UiUWiMcVgpULhAUOgIncHhQ2GwzNpFgQ8J8ongRGYINJAdiwRCykgsKy4cyQAB5MxKyo83h8gU3EUQWi8ahoRg4LLkWVfOaMPDUchYqFC7B4GDgwGarBgACutVqnU6clx+JgoT63gQfQJLJAjFDlSpYCQADlsQBJVFlLB4OQiSoo3FFtHcJRE0nRkDKGBUtFUxhazBISqhiByACOSnCaearQ6vpATRa7S6JypvF88lBk6aC6XK7Q3TkvDQ8hgp1C5yuN2Au/3h+P13Q2/T64Qy8ZIT1a+VG6fAVvodDq+/N+K54wH0RpVKegHAcac5yBBoE1AEjQwYMcEQLevBGggLSLpujRoWYGEIFhUHNmgZjSNgwDoKRt6UbwMB+GgXrkTRdEMbeFznOoU7sf+cjcQy9GMVxHEseQ1EBAgjT+BACBidJImSeJImoailR9OgYEqWpDI8SAnKqep6kCThmkGfxrHFH4vCMI0lmMLetnyeRDkCbefQcQhHGucJRnkW5hnmXIoZkVOQXdE2LaQFAWCkbUSgoUAA=&cpid=69e5e36578b287001215d938"; startswith; fast_pattern; http.host; content:"im.savemorelab.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010519; classtype:social-engineering; sid:6010519; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ez10000l8uf6g21108veziq73gvgggam82xjzu8eslew9sba3a85v.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ez10000l8uf6g21108veziq73gvgggam82xjzu8eslew9sba3a85v.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010520; classtype:social-engineering; sid:6010520; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lpykpobibcrgab4gddp71gmxs45zqtxssf20-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lpykpobibcrgab4gddp71gmxs45zqtxssf20-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010521; classtype:social-engineering; sid:6010521; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4db70e.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4db70e.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010522; classtype:social-engineering; sid:6010522; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ez1000b8o43c0s1108vez2ww8hrgeda3y27rhaqes6aoko51eq2iv.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ez1000b8o43c0s1108vez2ww8hrgeda3y27rhaqes6aoko51eq2iv.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010523; classtype:social-engineering; sid:6010523; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp11ct-fornel-biz8-zavrek-molsar.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp11ct-fornel-biz8-zavrek-molsar.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010524; classtype:social-engineering; sid:6010524; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cfxd3omk5uitu80hvkb9x1h2l3ud2wzex5sf27-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cfxd3omk5uitu80hvkb9x1h2l3ud2wzex5sf27-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010525; classtype:social-engineering; sid:6010525; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lux1-nanizi1.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lux1-nanizi1.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010526; classtype:social-engineering; sid:6010526; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fpx-ge1tgo.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"fpx-ge1tgo.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010527; classtype:social-engineering; sid:6010527; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appleishop-online.com/s1.php/)"; flow:established,to_server; http.uri; content:"/s1.php/"; startswith; fast_pattern; http.host; content:"appleishop-online.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010528; classtype:social-engineering; sid:6010528; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloud-find-my.com/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"icloud-find-my.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010529; classtype:social-engineering; sid:6010529; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wzprb0fdran-fmktplpw-2e9d1d-fm811a.pages.dev/welcome_aboard)"; flow:established,to_server; http.uri; content:"/welcome_aboard"; startswith; fast_pattern; http.host; content:"wzprb0fdran-fmktplpw-2e9d1d-fm811a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010530; classtype:social-engineering; sid:6010530; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f4b9c541.com:8989/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"f4b9c541.com:8989"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010531; classtype:social-engineering; sid:6010531; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ingreseaqui365.webcindario.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ingreseaqui365.webcindario.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010532; classtype:social-engineering; sid:6010532; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cuccuttroisongsspp.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cuccuttroisongsspp.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010533; classtype:social-engineering; sid:6010533; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dd2.qzz.io/dana/6g3/)"; flow:established,to_server; http.uri; content:"/dana/6g3/"; startswith; fast_pattern; http.host; content:"dd2.qzz.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010534; classtype:social-engineering; sid:6010534; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inasoq22.blogspot.com/2022/11/27.html)"; flow:established,to_server; http.uri; content:"/2022/11/27.html"; startswith; fast_pattern; http.host; content:"inasoq22.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010535; classtype:social-engineering; sid:6010535; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reclamacionmacstore.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"reclamacionmacstore.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010536; classtype:social-engineering; sid:6010536; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (soporte.world/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"soporte.world"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010537; classtype:social-engineering; sid:6010537; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (soporteinfo.click/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"soporteinfo.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010538; classtype:social-engineering; sid:6010538; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (misoporteonline-ishopmixupmx.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"misoporteonline-ishopmixupmx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010539; classtype:social-engineering; sid:6010539; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adeeshadasuniduwara.github.io/Trading-calculator)"; flow:established,to_server; http.uri; content:"/Trading-calculator"; startswith; fast_pattern; http.host; content:"adeeshadasuniduwara.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010540; classtype:social-engineering; sid:6010540; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ishopstoreoficial.com/s1.php/)"; flow:established,to_server; http.uri; content:"/s1.php/"; startswith; fast_pattern; http.host; content:"ishopstoreoficial.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010541; classtype:social-engineering; sid:6010541; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reclamacionesapple.com/s1.php/)"; flow:established,to_server; http.uri; content:"/s1.php/"; startswith; fast_pattern; http.host; content:"reclamacionesapple.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010542; classtype:social-engineering; sid:6010542; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-celularseguro.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app-celularseguro.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010543; classtype:social-engineering; sid:6010543; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (g3b9c105.com:8989/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"g3b9c105.com:8989"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010544; classtype:social-engineering; sid:6010544; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cn.lumxza.com/home/register?code=47546)"; flow:established,to_server; http.uri; content:"/home/register?code=47546"; startswith; fast_pattern; http.host; content:"cn.lumxza.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010545; classtype:social-engineering; sid:6010545; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (photos-shared.live/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"photos-shared.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010546; classtype:social-engineering; sid:6010546; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (findmydevice-locater.com/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"findmydevice-locater.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010547; classtype:social-engineering; sid:6010547; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ishopstore-oficial.com/s1.php/)"; flow:established,to_server; http.uri; content:"/s1.php/"; startswith; fast_pattern; http.host; content:"ishopstore-oficial.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010548; classtype:social-engineering; sid:6010548; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloud-in-find.com/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"icloud-in-find.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010549; classtype:social-engineering; sid:6010549; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (laoshunfaweb2.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"laoshunfaweb2.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010550; classtype:social-engineering; sid:6010550; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ra7233.craftum.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ra7233.craftum.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010551; classtype:social-engineering; sid:6010551; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (online.ishopmixup-recuperaciomx.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"online.ishopmixup-recuperaciomx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010552; classtype:social-engineering; sid:6010552; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p10002p4lrh061208vezvy7mj1gounc4qyb1l7esd0ss37iqzy3v.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p10002p4lrh061208vezvy7mj1gounc4qyb1l7esd0ss37iqzy3v.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010553; classtype:social-engineering; sid:6010553; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ezv1d3kr2und116bcq2sgdzoa4mda42gecs8dcl7aqrem58lvw.vercel.app/ldCzX4vp-8JWZ1hEB-dLF0Q9MX)"; flow:established,to_server; http.uri; content:"/ldCzX4vp-8JWZ1hEB-dLF0Q9MX"; startswith; fast_pattern; http.host; content:"ezv1d3kr2und116bcq2sgdzoa4mda42gecs8dcl7aqrem58lvw.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010554; classtype:social-engineering; sid:6010554; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inasoq22.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"inasoq22.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010555; classtype:social-engineering; sid:6010555; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mireporteapplemx.com/s1.php/)"; flow:established,to_server; http.uri; content:"/s1.php/"; startswith; fast_pattern; http.host; content:"mireporteapplemx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010556; classtype:social-engineering; sid:6010556; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ishopmexico-retenciones.app/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"ishopmexico-retenciones.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010557; classtype:social-engineering; sid:6010557; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (soporteapple-ishopmx.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"soporteapple-ishopmx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010558; classtype:social-engineering; sid:6010558; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ishopmx-support.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"ishopmx-support.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010559; classtype:social-engineering; sid:6010559; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (misoporte-mixupmx.com/s1.php/)"; flow:established,to_server; http.uri; content:"/s1.php/"; startswith; fast_pattern; http.host; content:"misoporte-mixupmx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010560; classtype:social-engineering; sid:6010560; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (misoporteonline-ishopmixupmx.com/s1.php/)"; flow:established,to_server; http.uri; content:"/s1.php/"; startswith; fast_pattern; http.host; content:"misoporteonline-ishopmixupmx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010561; classtype:social-engineering; sid:6010561; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xiaomi-help.sbs/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"xiaomi-help.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010562; classtype:social-engineering; sid:6010562; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sock-zizifn-us.pennyphd.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sock-zizifn-us.pennyphd.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010563; classtype:social-engineering; sid:6010563; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloudbuscar.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"icloudbuscar.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010564; classtype:social-engineering; sid:6010564; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (masdozx1.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"masdozx1.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010565; classtype:social-engineering; sid:6010565; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (link.curiosityproject.info/ga/click/2-110620629-1492-9938-19429-10679-e7545cdb29-6b7dcff176/)"; flow:established,to_server; http.uri; content:"/ga/click/2-110620629-1492-9938-19429-10679-e7545cdb29-6b7dcff176/"; startswith; fast_pattern; http.host; content:"link.curiosityproject.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010566; classtype:social-engineering; sid:6010566; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onlineishop-misoporte.com/s1.php/)"; flow:established,to_server; http.uri; content:"/s1.php/"; startswith; fast_pattern; http.host; content:"onlineishop-misoporte.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010567; classtype:social-engineering; sid:6010567; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (main-bep20-demo-scriptboss.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"main-bep20-demo-scriptboss.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010568; classtype:social-engineering; sid:6010568; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ishopstoreoficial.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"ishopstoreoficial.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010569; classtype:social-engineering; sid:6010569; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (instagram-verify-your-identity.github.io/canada/)"; flow:established,to_server; http.uri; content:"/canada/"; startswith; fast_pattern; http.host; content:"instagram-verify-your-identity.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010570; classtype:social-engineering; sid:6010570; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apple-support-net.in/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"apple-support-net.in"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010571; classtype:social-engineering; sid:6010571; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (soporteapple-ishopmx.com/s1.php/)"; flow:established,to_server; http.uri; content:"/s1.php/"; startswith; fast_pattern; http.host; content:"soporteapple-ishopmx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010572; classtype:social-engineering; sid:6010572; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apple.es-co.my/app/webroot/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/app/webroot/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"apple.es-co.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010573; classtype:social-engineering; sid:6010573; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ishop-supportmex.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"ishop-supportmex.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010574; classtype:social-engineering; sid:6010574; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maniattarian.github.io/amazon-clone/checkout.html)"; flow:established,to_server; http.uri; content:"/amazon-clone/checkout.html"; startswith; fast_pattern; http.host; content:"maniattarian.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010575; classtype:social-engineering; sid:6010575; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ez1000bd282j7x1108vezof56cjgkq7whbut2s3esya3q8on1w9tv.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ez1000bd282j7x1108vezof56cjgkq7whbut2s3esya3q8on1w9tv.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010576; classtype:social-engineering; sid:6010576; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yashasvi21aug-debug.github.io/Amazon-Clone-/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone-/"; startswith; fast_pattern; http.host; content:"yashasvi21aug-debug.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010577; classtype:social-engineering; sid:6010577; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gastaldiferla.com.ar/antai/amnd/)"; flow:established,to_server; http.uri; content:"/antai/amnd/"; startswith; fast_pattern; http.host; content:"gastaldiferla.com.ar"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010578; classtype:social-engineering; sid:6010578; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (misoporteishopmx.com/s1.php/)"; flow:established,to_server; http.uri; content:"/s1.php/"; startswith; fast_pattern; http.host; content:"misoporteishopmx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010579; classtype:social-engineering; sid:6010579; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suport-lcloud.com.tr/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"suport-lcloud.com.tr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010580; classtype:social-engineering; sid:6010580; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pkasoda1.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"pkasoda1.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010581; classtype:social-engineering; sid:6010581; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lux-no1aos1.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"lux-no1aos1.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010582; classtype:social-engineering; sid:6010582; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iamsamhitaacharya.github.io/Spotify-Clone/)"; flow:established,to_server; http.uri; content:"/Spotify-Clone/"; startswith; fast_pattern; http.host; content:"iamsamhitaacharya.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010583; classtype:social-engineering; sid:6010583; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spot1da252-149d-4c61-90e9-e2681a72log.netlify.app/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"spot1da252-149d-4c61-90e9-e2681a72log.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010584; classtype:social-engineering; sid:6010584; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lmasb.es/wordpress)"; flow:established,to_server; http.uri; content:"/wordpress"; startswith; fast_pattern; http.host; content:"lmasb.es"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010585; classtype:social-engineering; sid:6010585; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lux-oppo8.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lux-oppo8.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010586; classtype:social-engineering; sid:6010586; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lz-so1pa1.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lz-so1pa1.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010587; classtype:social-engineering; sid:6010587; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maniattarian.github.io/amazon-clone/orders.html)"; flow:established,to_server; http.uri; content:"/amazon-clone/orders.html"; startswith; fast_pattern; http.host; content:"maniattarian.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010588; classtype:social-engineering; sid:6010588; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bveline.click/inter/core/client/scotia/)"; flow:established,to_server; http.uri; content:"/inter/core/client/scotia/"; startswith; fast_pattern; http.host; content:"bveline.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010589; classtype:social-engineering; sid:6010589; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (es-co.my/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"es-co.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010590; classtype:social-engineering; sid:6010590; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cuccuttroisongsspp.vercel.app/index1.html)"; flow:established,to_server; http.uri; content:"/index1.html"; startswith; fast_pattern; http.host; content:"cuccuttroisongsspp.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010591; classtype:social-engineering; sid:6010591; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (luxt1-opzanz.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"luxt1-opzanz.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010592; classtype:social-engineering; sid:6010592; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reclamacionapple.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"reclamacionapple.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010593; classtype:social-engineering; sid:6010593; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mireporteapplemx.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"mireporteapplemx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010594; classtype:social-engineering; sid:6010594; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (com-ec.app/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"com-ec.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010595; classtype:social-engineering; sid:6010595; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ishopmireportemx.com/s1.php/)"; flow:established,to_server; http.uri; content:"/s1.php/"; startswith; fast_pattern; http.host; content:"ishopmireportemx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010596; classtype:social-engineering; sid:6010596; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shiro1x210.github.io/robloxlogin-/)"; flow:established,to_server; http.uri; content:"/robloxlogin-/"; startswith; fast_pattern; http.host; content:"shiro1x210.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010597; classtype:social-engineering; sid:6010597; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (i-find.my/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"i-find.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010598; classtype:social-engineering; sid:6010598; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (icloud-id.click/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"icloud-id.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010599; classtype:social-engineering; sid:6010599; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.iremoval.us/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"www.iremoval.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010600; classtype:social-engineering; sid:6010600; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (harshavardhan1432.github.io/Spotify-Clone)"; flow:established,to_server; http.uri; content:"/Spotify-Clone"; startswith; fast_pattern; http.host; content:"harshavardhan1432.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010601; classtype:social-engineering; sid:6010601; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reporteonline-applemx.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"reporteonline-applemx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010602; classtype:social-engineering; sid:6010602; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sock-zizifn-hk.ludea-lau.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sock-zizifn-hk.ludea-lau.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010603; classtype:social-engineering; sid:6010603; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onlineservice-mixupmexico.com/s1.php/)"; flow:established,to_server; http.uri; content:"/s1.php/"; startswith; fast_pattern; http.host; content:"onlineservice-mixupmexico.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010604; classtype:social-engineering; sid:6010604; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ez10001h8o0p5x1108vezk9cw8fg1niewbvx90mes4aar4x7fn5dv.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ez10001h8o0p5x1108vezk9cw8fg1niewbvx90mes4aar4x7fn5dv.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010605; classtype:social-engineering; sid:6010605; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tanviborkar2028.github.io/Spotify-UI)"; flow:established,to_server; http.uri; content:"/Spotify-UI"; startswith; fast_pattern; http.host; content:"tanviborkar2028.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010606; classtype:social-engineering; sid:6010606; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cancelarcardiffseguro360.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cancelarcardiffseguro360.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010607; classtype:social-engineering; sid:6010607; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lcloud.ve-s.com/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"lcloud.ve-s.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010608; classtype:social-engineering; sid:6010608; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (maps-apple.id/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"maps-apple.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010609; classtype:social-engineering; sid:6010609; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ishopstore-oficial.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"ishopstore-oficial.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010610; classtype:social-engineering; sid:6010610; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (buscarmi.es-co.my/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"buscarmi.es-co.my"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010611; classtype:social-engineering; sid:6010611; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sso---secure-robinhood--coms.webflow.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sso---secure-robinhood--coms.webflow.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010612; classtype:social-engineering; sid:6010612; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ishopmixup-recuperaciomx.com/s1.php/)"; flow:established,to_server; http.uri; content:"/s1.php/"; startswith; fast_pattern; http.host; content:"ishopmixup-recuperaciomx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010613; classtype:social-engineering; sid:6010613; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lzoxpasa1.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"lzoxpasa1.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010614; classtype:social-engineering; sid:6010614; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (com-v.dev/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"com-v.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010615; classtype:social-engineering; sid:6010615; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p100062iu56tv1208vezn6srt0g4wsmf3o5goaesxl0qj8u1h7gv.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p100062iu56tv1208vezn6srt0g4wsmf3o5goaesxl0qj8u1h7gv.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010616; classtype:social-engineering; sid:6010616; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ez1000c38nds861108vezf3zn1hgw7xgje53ybbes3vntlzn203iv.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ez1000c38nds861108vezf3zn1hgw7xgje53ybbes3vntlzn203iv.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010617; classtype:social-engineering; sid:6010617; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (misoporte-ishopmxonline.com/s1.php/)"; flow:established,to_server; http.uri; content:"/s1.php/"; startswith; fast_pattern; http.host; content:"misoporte-ishopmxonline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010618; classtype:social-engineering; sid:6010618; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (janprasad-jan.github.io/spotify_clone/)"; flow:established,to_server; http.uri; content:"/spotify_clone/"; startswith; fast_pattern; http.host; content:"janprasad-jan.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010619; classtype:social-engineering; sid:6010619; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mnchtrv.coupons/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mnchtrv.coupons"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010620; classtype:social-engineering; sid:6010620; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (misoporte-online-mixupmx.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"misoporte-online-mixupmx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010621; classtype:social-engineering; sid:6010621; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure.amozprime-billing.165-154-254-14.cpanel.site/desktop/?auth_max_open=0&ref=VaaZX7LxMuxtxoDSdISBQZiO1M3AglXRR2VDeS7636Gzd29qSh1G7TyYjxm1ZcOLuPQLemoBo89NSgowWLk6ssE6k5qBpMBW1sOX)"; flow:established,to_server; http.uri; content:"/desktop/?auth_max_open=0&ref=VaaZX7LxMuxtxoDSdISBQZiO1M3AglXRR2VDeS7636Gzd29qSh1G7TyYjxm1ZcOLuPQLemoBo89NSgowWLk6ssE6k5qBpMBW1sOX"; startswith; fast_pattern; http.host; content:"secure.amozprime-billing.165-154-254-14.cpanel.site"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010622; classtype:social-engineering; sid:6010622; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pasdpalz1.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"pasdpalz1.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010623; classtype:social-engineering; sid:6010623; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (madhvisaharan01.github.io/amazon-clone)"; flow:established,to_server; http.uri; content:"/amazon-clone"; startswith; fast_pattern; http.host; content:"madhvisaharan01.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010624; classtype:social-engineering; sid:6010624; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (id-icloud.support/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"id-icloud.support"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010625; classtype:social-engineering; sid:6010625; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (misoporteonline-macstoremx.com/s1.php/)"; flow:established,to_server; http.uri; content:"/s1.php/"; startswith; fast_pattern; http.host; content:"misoporteonline-macstoremx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010626; classtype:social-engineering; sid:6010626; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hello-my-project-for-study.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hello-my-project-for-study.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010627; classtype:social-engineering; sid:6010627; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appleishop-online.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"appleishop-online.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010628; classtype:social-engineering; sid:6010628; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chartermailfdeagg78.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"chartermailfdeagg78.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010629; classtype:social-engineering; sid:6010629; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (surl.li/qbenee)"; flow:established,to_server; http.uri; content:"/qbenee"; startswith; fast_pattern; http.host; content:"surl.li"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010630; classtype:social-engineering; sid:6010630; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ishopmirecuperacion.com/s1.php/)"; flow:established,to_server; http.uri; content:"/s1.php/"; startswith; fast_pattern; http.host; content:"ishopmirecuperacion.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010631; classtype:social-engineering; sid:6010631; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moviezone.netlify.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moviezone.netlify.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010632; classtype:social-engineering; sid:6010632; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (myx4mnvrarzcyxmkamityer27vr2cinsvfb9-h14v.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"myx4mnvrarzcyxmkamityer27vr2cinsvfb9-h14v.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010633; classtype:social-engineering; sid:6010633; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ishopstore-recuperacion.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"ishopstore-recuperacion.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010634; classtype:social-engineering; sid:6010634; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (account-apple.com.tr/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"account-apple.com.tr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010635; classtype:social-engineering; sid:6010635; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (heyysizzii.github.io/Amazon.in)"; flow:established,to_server; http.uri; content:"/Amazon.in"; startswith; fast_pattern; http.host; content:"heyysizzii.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010636; classtype:social-engineering; sid:6010636; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onlineservice-mixupmexico.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"onlineservice-mixupmexico.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010637; classtype:social-engineering; sid:6010637; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (amzokfzuxyfslftppedidbb9hqjkndwcsf12-cg1108s.vercel.app/hgfjmd45syhwas4wersfdzv.html/)"; flow:established,to_server; http.uri; content:"/hgfjmd45syhwas4wersfdzv.html/"; startswith; fast_pattern; http.host; content:"amzokfzuxyfslftppedidbb9hqjkndwcsf12-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010638; classtype:social-engineering; sid:6010638; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mireporteishoponline.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"mireporteishoponline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010639; classtype:social-engineering; sid:6010639; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (testing-uphold-test.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"testing-uphold-test.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010640; classtype:social-engineering; sid:6010640; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (roblox.com.bz/users/144464888/profile)"; flow:established,to_server; http.uri; content:"/users/144464888/profile"; startswith; fast_pattern; http.host; content:"roblox.com.bz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010641; classtype:social-engineering; sid:6010641; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-0c0358537dca45eda089cd1fcc62f455.r2.dev/Payment_Confirmation_854aec15a4ed1.html)"; flow:established,to_server; http.uri; content:"/Payment_Confirmation_854aec15a4ed1.html"; startswith; fast_pattern; http.host; content:"pub-0c0358537dca45eda089cd1fcc62f455.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010642; classtype:social-engineering; sid:6010642; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (boxopensea86-b189d2a4995c.herokuapp.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"boxopensea86-b189d2a4995c.herokuapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010643; classtype:social-engineering; sid:6010643; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cancelarsegurodecardiff360.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cancelarsegurodecardiff360.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010644; classtype:social-engineering; sid:6010644; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lux-bantitii1.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"lux-bantitii1.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010645; classtype:social-engineering; sid:6010645; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ssl18.websouls.net/spec/)"; flow:established,to_server; http.uri; content:"/spec/"; startswith; fast_pattern; http.host; content:"ssl18.websouls.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010646; classtype:social-engineering; sid:6010646; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a3b9c2s1.com:8989/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"a3b9c2s1.com:8989"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010647; classtype:social-engineering; sid:6010647; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hosus.info/Q0g0MS1OMTUxNS1EMDkwNjA2/?u=161C1515&e=hislosatri%40throam.com&s3=Sharon&s4=J.+Conner&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/Q0g0MS1OMTUxNS1EMDkwNjA2/?u=161C1515&e=hislosatri%40throam.com&s3=Sharon&s4=J.+Conner&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"hosus.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010648; classtype:social-engineering; sid:6010648; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (br-icloud.support/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"br-icloud.support"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010649; classtype:social-engineering; sid:6010649; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (soporte-info.click/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"soporte-info.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010650; classtype:social-engineering; sid:6010650; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mireporteishop-mx.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"mireporteishop-mx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010651; classtype:social-engineering; sid:6010651; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p1000sa127s1d1208vezx86xswg7qogyz8o0ieeswt5uibk00q7v.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p1000sa127s1d1208vezx86xswg7qogyz8o0ieeswt5uibk00q7v.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010652; classtype:social-engineering; sid:6010652; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (join.switchit.app/Youtube/)"; flow:established,to_server; http.uri; content:"/Youtube/"; startswith; fast_pattern; http.host; content:"join.switchit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010653; classtype:social-engineering; sid:6010653; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ishop-mixupmx-online.com/s1.php/)"; flow:established,to_server; http.uri; content:"/s1.php/"; startswith; fast_pattern; http.host; content:"ishop-mixupmx-online.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010654; classtype:social-engineering; sid:6010654; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (online-macstoremexico.com/s1.php/)"; flow:established,to_server; http.uri; content:"/s1.php/"; startswith; fast_pattern; http.host; content:"online-macstoremexico.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010655; classtype:social-engineering; sid:6010655; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (updatescoopyahoo.dpdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"updatescoopyahoo.dpdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010656; classtype:social-engineering; sid:6010656; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mail.iremoval.us/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"mail.iremoval.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010657; classtype:social-engineering; sid:6010657; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ez0-pas10aq.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"ez0-pas10aq.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010658; classtype:social-engineering; sid:6010658; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moasd011.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"moasd011.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010659; classtype:social-engineering; sid:6010659; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ishopmixup-recuperaciomx.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"ishopmixup-recuperaciomx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010660; classtype:social-engineering; sid:6010660; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lux-oppzpe1.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lux-oppzpe1.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010661; classtype:social-engineering; sid:6010661; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lux-ezzeze.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lux-ezzeze.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010662; classtype:social-engineering; sid:6010662; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (p1000u7s94x8d1208vezqs83mwgj8txd3ygu4pess6dv0u6nct4v.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"p1000u7s94x8d1208vezqs83mwgj8txd3ygu4pess6dv0u6nct4v.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010663; classtype:social-engineering; sid:6010663; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (findhub.click/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"findhub.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010664; classtype:social-engineering; sid:6010664; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (online-ishopoficial.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"online-ishopoficial.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010665; classtype:social-engineering; sid:6010665; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (compliance-docs-review.com/6197094-oH1faBZb-PKS9Q)"; flow:established,to_server; http.uri; content:"/6197094-oH1faBZb-PKS9Q"; startswith; fast_pattern; http.host; content:"compliance-docs-review.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010666; classtype:social-engineering; sid:6010666; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pages-suitetrzer.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pages-suitetrzer.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010667; classtype:social-engineering; sid:6010667; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.loss-dafa.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.loss-dafa.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010668; classtype:social-engineering; sid:6010668; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (recuperacionoesonline-ishopmx.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"recuperacionoesonline-ishopmx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010669; classtype:social-engineering; sid:6010669; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (locatedevices.app/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"locatedevices.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010670; classtype:social-engineering; sid:6010670; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apple-inc.com.tr/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"apple-inc.com.tr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010671; classtype:social-engineering; sid:6010671; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (l-nutra.com/trezor-login-no-username-or-password-here-is-why-en-p1-3)"; flow:established,to_server; http.uri; content:"/trezor-login-no-username-or-password-here-is-why-en-p1-3"; startswith; fast_pattern; http.host; content:"l-nutra.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010672; classtype:social-engineering; sid:6010672; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (opportunitiesforgambians.org/images/img-im/inagery/Rm9yIHNvbWUgdW5mYXRob21hYmxlIHJlYXNvbiwgdGhlIHJlc3BvbnNlIHRlYW0gZGlkbid0IGNvbnNpZGVyIGEgbGFjayBvZiBtaWxrIGZvciBteSBjZXJlYWwgYXMgYSBwcm9wZXIgZW1lcmdlbmN5Lg.html)"; flow:established,to_server; http.uri; content:"/images/img-im/inagery/Rm9yIHNvbWUgdW5mYXRob21hYmxlIHJlYXNvbiwgdGhlIHJlc3BvbnNlIHRlYW0gZGlkbid0IGNvbnNpZGVyIGEgbGFjayBvZiBtaWxrIGZvciBteSBjZXJlYWwgYXMgYSBwcm9wZXIgZW1lcmdlbmN5Lg.html"; startswith; fast_pattern; http.host; content:"opportunitiesforgambians.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010673; classtype:social-engineering; sid:6010673; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (open.apknewdownload.info/41-1511-280526/?u=12C1515&e=info%40art-of-technology.ch&s3=&s4=&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/41-1511-280526/?u=12C1515&e=info%40art-of-technology.ch&s3=&s4=&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"open.apknewdownload.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010674; classtype:social-engineering; sid:6010674; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a3b9c6k1.com:8989/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"a3b9c6k1.com:8989"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010675; classtype:social-engineering; sid:6010675; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lostapple-alert.live/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"lostapple-alert.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010676; classtype:social-engineering; sid:6010676; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (misoporteishopmx.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"misoporteishopmx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010677; classtype:social-engineering; sid:6010677; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gastric-turquoise-uqpzxsmk.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gastric-turquoise-uqpzxsmk.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010678; classtype:social-engineering; sid:6010678; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (misoporte-online-mixupmx.com/s1.php/)"; flow:established,to_server; http.uri; content:"/s1.php/"; startswith; fast_pattern; http.host; content:"misoporte-online-mixupmx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010679; classtype:social-engineering; sid:6010679; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (microsoftdemo.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"microsoftdemo.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010680; classtype:social-engineering; sid:6010680; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (inforesmi873.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"inforesmi873.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010681; classtype:social-engineering; sid:6010681; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mhvqol.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mhvqol.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010682; classtype:social-engineering; sid:6010682; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (appleservice-onlinemixup.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"appleservice-onlinemixup.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010683; classtype:social-engineering; sid:6010683; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gmail-account.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gmail-account.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010684; classtype:social-engineering; sid:6010684; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pyh3.info/Y2gtZmVkZXgtMjAyNg/?e=seren9@0746cb778514d4fa080fc93a7463f991d55c.org&s3=Gabriela&s4=Rust&u=14C1655)"; flow:established,to_server; http.uri; content:"/Y2gtZmVkZXgtMjAyNg/?e=seren9@0746cb778514d4fa080fc93a7463f991d55c.org&s3=Gabriela&s4=Rust&u=14C1655"; startswith; fast_pattern; http.host; content:"pyh3.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010685; classtype:social-engineering; sid:6010685; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reclamacionapple.com/s1.php/)"; flow:established,to_server; http.uri; content:"/s1.php/"; startswith; fast_pattern; http.host; content:"reclamacionapple.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010686; classtype:social-engineering; sid:6010686; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (docs-ledger-live-feq.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"docs-ledger-live-feq.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010687; classtype:social-engineering; sid:6010687; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (soporteishopreclamacion.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"soporteishopreclamacion.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010688; classtype:social-engineering; sid:6010688; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lux-an1tran.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lux-an1tran.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010689; classtype:social-engineering; sid:6010689; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (online-recuperacionishop.com/s1.php/)"; flow:established,to_server; http.uri; content:"/s1.php/"; startswith; fast_pattern; http.host; content:"online-recuperacionishop.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010690; classtype:social-engineering; sid:6010690; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ezv1d3kr2und116bcq2sgdzoa4mda42gecs8dcl7aqrem58lvw.vercel.app/ldCzX4vp-8JWZ1hEB-dLF0Q9MX.html)"; flow:established,to_server; http.uri; content:"/ldCzX4vp-8JWZ1hEB-dLF0Q9MX.html"; startswith; fast_pattern; http.host; content:"ezv1d3kr2und116bcq2sgdzoa4mda42gecs8dcl7aqrem58lvw.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010691; classtype:social-engineering; sid:6010691; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robinhoodclaim.solstream.cc/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"robinhoodclaim.solstream.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010692; classtype:social-engineering; sid:6010692; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (isuzupart.ir/Ivwer/page/page/)"; flow:established,to_server; http.uri; content:"/Ivwer/page/page/"; startswith; fast_pattern; http.host; content:"isuzupart.ir"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010693; classtype:social-engineering; sid:6010693; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (retenciones-ishopmiuxpmx.com/s1.php/)"; flow:established,to_server; http.uri; content:"/s1.php/"; startswith; fast_pattern; http.host; content:"retenciones-ishopmiuxpmx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010694; classtype:social-engineering; sid:6010694; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fidelity-investment.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fidelity-investment.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010695; classtype:social-engineering; sid:6010695; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (retenciones-misoportemixupmx.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"retenciones-misoportemixupmx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010696; classtype:social-engineering; sid:6010696; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ishop-mixupmx-online.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"ishop-mixupmx-online.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010697; classtype:social-engineering; sid:6010697; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp-clone-new.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whatsapp-clone-new.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010698; classtype:social-engineering; sid:6010698; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (misoporte-ishopmxonline.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"misoporte-ishopmxonline.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010699; classtype:social-engineering; sid:6010699; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (vanitasikhwal-214.github.io/Spotify-Clone/)"; flow:established,to_server; http.uri; content:"/Spotify-Clone/"; startswith; fast_pattern; http.host; content:"vanitasikhwal-214.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010700; classtype:social-engineering; sid:6010700; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.update-netflix.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.update-netflix.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010701; classtype:social-engineering; sid:6010701; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (updateversescoopyah.dpdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"updateversescoopyah.dpdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010702; classtype:social-engineering; sid:6010702; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ishopmireporte-online.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"ishopmireporte-online.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010703; classtype:social-engineering; sid:6010703; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-lostdevice.live/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"support-lostdevice.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010704; classtype:social-engineering; sid:6010704; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7jxuoz50qgguwvrojrydcx4ijmhu8dynlfb8-h14v.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7jxuoz50qgguwvrojrydcx4ijmhu8dynlfb8-h14v.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010705; classtype:social-engineering; sid:6010705; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (online-recuperacionishop.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"online-recuperacionishop.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010706; classtype:social-engineering; sid:6010706; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aistudio-cloudflare-ai.pages.dev/assets/new_chat_42124368-DfxDaCic.html)"; flow:established,to_server; http.uri; content:"/assets/new_chat_42124368-DfxDaCic.html"; startswith; fast_pattern; http.host; content:"aistudio-cloudflare-ai.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010707; classtype:social-engineering; sid:6010707; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onlineishop-misoporte.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"onlineishop-misoporte.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010708; classtype:social-engineering; sid:6010708; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (misoporteonline-reportesmx.com/s1.php/)"; flow:established,to_server; http.uri; content:"/s1.php/"; startswith; fast_pattern; http.host; content:"misoporteonline-reportesmx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010709; classtype:social-engineering; sid:6010709; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prime-desaplentations-funerere.fr/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"prime-desaplentations-funerere.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010710; classtype:social-engineering; sid:6010710; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (th-pozee.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"th-pozee.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010711; classtype:social-engineering; sid:6010711; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bveline.click/inter/core/client/desjardins/)"; flow:established,to_server; http.uri; content:"/inter/core/client/desjardins/"; startswith; fast_pattern; http.host; content:"bveline.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010712; classtype:social-engineering; sid:6010712; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pendaftar4an-piinjaamanbrii.xuu.my.id/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pendaftar4an-piinjaamanbrii.xuu.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010713; classtype:social-engineering; sid:6010713; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (findmyapple-devices.co/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"findmyapple-devices.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010714; classtype:social-engineering; sid:6010714; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (aistudio-cloudflare-ai.pages.dev/assets/new_chat_42124368-DfxDaCic)"; flow:established,to_server; http.uri; content:"/assets/new_chat_42124368-DfxDaCic"; startswith; fast_pattern; http.host; content:"aistudio-cloudflare-ai.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010715; classtype:social-engineering; sid:6010715; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-lost-alert.live/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"support-lost-alert.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010716; classtype:social-engineering; sid:6010716; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (misoporte-mixupmx.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"misoporte-mixupmx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010717; classtype:social-engineering; sid:6010717; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supports-location.help/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"supports-location.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010718; classtype:social-engineering; sid:6010718; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ishopmexico-retenciones.app/s1.php/)"; flow:established,to_server; http.uri; content:"/s1.php/"; startswith; fast_pattern; http.host; content:"ishopmexico-retenciones.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010719; classtype:social-engineering; sid:6010719; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (soporteishopreclamacion.com/s1.php/)"; flow:established,to_server; http.uri; content:"/s1.php/"; startswith; fast_pattern; http.host; content:"soporteishopreclamacion.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010720; classtype:social-engineering; sid:6010720; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lost-live.help/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"lost-live.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010721; classtype:social-engineering; sid:6010721; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arpit-gzp.github.io/amazon-clone/)"; flow:established,to_server; http.uri; content:"/amazon-clone/"; startswith; fast_pattern; http.host; content:"arpit-gzp.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010722; classtype:social-engineering; sid:6010722; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lostdevice.co/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"lostdevice.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010723; classtype:social-engineering; sid:6010723; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (robinhood-rewards.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"robinhood-rewards.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010724; classtype:social-engineering; sid:6010724; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (misoporteonline-reportesmx.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"misoporteonline-reportesmx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010725; classtype:social-engineering; sid:6010725; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reclamacionesapple.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"reclamacionesapple.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010726; classtype:social-engineering; sid:6010726; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sock-zizifn-hkips.254052671.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sock-zizifn-hkips.254052671.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010727; classtype:social-engineering; sid:6010727; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b3b9c02.com:8989/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"b3b9c02.com:8989"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010728; classtype:social-engineering; sid:6010728; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (guptadisha1107-png.github.io/amazon-project/)"; flow:established,to_server; http.uri; content:"/amazon-project/"; startswith; fast_pattern; http.host; content:"guptadisha1107-png.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010729; classtype:social-engineering; sid:6010729; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b3b9c123.com:8989/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"b3b9c123.com:8989"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010730; classtype:social-engineering; sid:6010730; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (giua1xmc11.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"giua1xmc11.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010731; classtype:social-engineering; sid:6010731; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (click.okanhyeuem.info/ga/click/2-17307796-22-10221-19997-11076-e11ea96571-a011b4c6f2/)"; flow:established,to_server; http.uri; content:"/ga/click/2-17307796-22-10221-19997-11076-e11ea96571-a011b4c6f2/"; startswith; fast_pattern; http.host; content:"click.okanhyeuem.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010732; classtype:social-engineering; sid:6010732; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (online-ishopoficial.com/s1.php/)"; flow:established,to_server; http.uri; content:"/s1.php/"; startswith; fast_pattern; http.host; content:"online-ishopoficial.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010733; classtype:social-engineering; sid:6010733; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (377618.click/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"377618.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010734; classtype:social-engineering; sid:6010734; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (soporteishop-oficial.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"soporteishop-oficial.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010735; classtype:social-engineering; sid:6010735; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sasw-avhdbzawd0e4gjev.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sasw-avhdbzawd0e4gjev.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010736; classtype:social-engineering; sid:6010736; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bveline.click/inter/core/client/td/)"; flow:established,to_server; http.uri; content:"/inter/core/client/td/"; startswith; fast_pattern; http.host; content:"bveline.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010737; classtype:social-engineering; sid:6010737; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (arosh2004.github.io/Spotify-Clone/)"; flow:established,to_server; http.uri; content:"/Spotify-Clone/"; startswith; fast_pattern; http.host; content:"arosh2004.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010738; classtype:social-engineering; sid:6010738; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (system.insureshealth.info/CH41-N1515-D090606/?u=12C1515&e=sidmckenzie%40bigpind.com&s3=Alan&s4=McKenzie&s5=&s6=&s7=&s8=)"; flow:established,to_server; http.uri; content:"/CH41-N1515-D090606/?u=12C1515&e=sidmckenzie%40bigpind.com&s3=Alan&s4=McKenzie&s5=&s6=&s7=&s8="; startswith; fast_pattern; http.host; content:"system.insureshealth.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010739; classtype:social-engineering; sid:6010739; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (adarshkishore007.github.io/Spotifyclone/)"; flow:established,to_server; http.uri; content:"/Spotifyclone/"; startswith; fast_pattern; http.host; content:"adarshkishore007.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010740; classtype:social-engineering; sid:6010740; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (heyysizzii.github.io/Amazon.in/)"; flow:established,to_server; http.uri; content:"/Amazon.in/"; startswith; fast_pattern; http.host; content:"heyysizzii.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010741; classtype:social-engineering; sid:6010741; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (midasnews.mobileaccesx-events.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"midasnews.mobileaccesx-events.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010742; classtype:social-engineering; sid:6010742; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mireporteishop-mx.com/s1.php/)"; flow:established,to_server; http.uri; content:"/s1.php/"; startswith; fast_pattern; http.host; content:"mireporteishop-mx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010743; classtype:social-engineering; sid:6010743; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (reclamacionmacstore.com/s1.php/)"; flow:established,to_server; http.uri; content:"/s1.php/"; startswith; fast_pattern; http.host; content:"reclamacionmacstore.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010744; classtype:social-engineering; sid:6010744; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lostdevice-live.help/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"lostdevice-live.help"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010745; classtype:social-engineering; sid:6010745; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (misoporteonline-macstoremx.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"misoporteonline-macstoremx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010746; classtype:social-engineering; sid:6010746; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (retenciones-ishopmiuxpmx.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"retenciones-ishopmiuxpmx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010747; classtype:social-engineering; sid:6010747; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (llori807.github.io/Netflix-Clone-2.0/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone-2.0/"; startswith; fast_pattern; http.host; content:"llori807.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010748; classtype:social-engineering; sid:6010748; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lux-eo0o0.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"lux-eo0o0.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010749; classtype:social-engineering; sid:6010749; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kf84gbrtm5hzqkwwzlxvr5dq9jqm4jvimsf28-h11v.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kf84gbrtm5hzqkwwzlxvr5dq9jqm4jvimsf28-h11v.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010750; classtype:social-engineering; sid:6010750; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jmd92400.github.io/Grab/)"; flow:established,to_server; http.uri; content:"/Grab/"; startswith; fast_pattern; http.host; content:"jmd92400.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010751; classtype:social-engineering; sid:6010751; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-location-in.live/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"support-location-in.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010752; classtype:social-engineering; sid:6010752; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.xfinity-upgrade2.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.xfinity-upgrade2.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010753; classtype:social-engineering; sid:6010753; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cardiffcancelacionseguro360.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cardiffcancelacionseguro360.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010754; classtype:social-engineering; sid:6010754; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (30665.com/wp-admin/.wp-languages)"; flow:established,to_server; http.uri; content:"/wp-admin/.wp-languages"; startswith; fast_pattern; http.host; content:"30665.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010755; classtype:social-engineering; sid:6010755; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (find-my-device.us/app/webroot/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/app/webroot/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"find-my-device.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010756; classtype:social-engineering; sid:6010756; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ishopmireportemx.com/s1.php)"; flow:established,to_server; http.uri; content:"/s1.php"; startswith; fast_pattern; http.host; content:"ishopmireportemx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010757; classtype:social-engineering; sid:6010757; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rtsuttonbgy.segwalds.info/ga/click/2-10035552-14-10259-20083-11127-33f41e4eb8-8216acc1ab/)"; flow:established,to_server; http.uri; content:"/ga/click/2-10035552-14-10259-20083-11127-33f41e4eb8-8216acc1ab/"; startswith; fast_pattern; http.host; content:"rtsuttonbgy.segwalds.info"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010758; classtype:social-engineering; sid:6010758; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (madekrisnaj.github.io/ledgerv1)"; flow:established,to_server; http.uri; content:"/ledgerv1"; startswith; fast_pattern; http.host; content:"madekrisnaj.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010759; classtype:social-engineering; sid:6010759; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a3b9c26.com:8989/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"a3b9c26.com:8989"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010760; classtype:social-engineering; sid:6010760; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (supports-appie.com.tr/script/zoom_map_2026_passcode6_login/Components/2026/)"; flow:established,to_server; http.uri; content:"/script/zoom_map_2026_passcode6_login/Components/2026/"; startswith; fast_pattern; http.host; content:"supports-appie.com.tr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010761; classtype:social-engineering; sid:6010761; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.oferta-247157.cfd/oferta/sprzedam-ponton-kolibri-330/22506/dostawa)"; flow:established,to_server; http.uri; content:"/oferta/sprzedam-ponton-kolibri-330/22506/dostawa"; startswith; fast_pattern; http.host; content:"allegrolokalnie.oferta-247157.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010762; classtype:social-engineering; sid:6010762; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prime-desaplentations-funerere.fr/login_up.php)"; flow:established,to_server; http.uri; content:"/login_up.php"; startswith; fast_pattern; http.host; content:"prime-desaplentations-funerere.fr"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010763; classtype:social-engineering; sid:6010763; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bveline.click/inter/core/client/rbcroyal/)"; flow:established,to_server; http.uri; content:"/inter/core/client/rbcroyal/"; startswith; fast_pattern; http.host; content:"bveline.click"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010764; classtype:social-engineering; sid:6010764; rev:1; metadata: signature_severity Major, created_et 2026_08_16;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecomaicer89teried.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ecomaicer89teried.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010765; classtype:social-engineering; sid:6010765; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newlogin.webaccess-alert.com/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/)"; flow:established,to_server; http.uri; content:"/s/63BZGFSVBWSFCDX7Y9/584dd8/90eab167-7429-489f-99f6-ce86e8d0d81a/"; startswith; fast_pattern; http.host; content:"newlogin.webaccess-alert.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010766; classtype:social-engineering; sid:6010766; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (066a90.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"066a90.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010767; classtype:social-engineering; sid:6010767; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m-riverateam.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m-riverateam.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010768; classtype:social-engineering; sid:6010768; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (121hiu.senes.at/stakings/?b=YTo0OntzOjU6ImxhYmVsIjtzOjA6IiI7czozOiJ1c3IiO2k6MjUwO3M6NDoibm9wZCI7czoxMzoicnNzLnNheWxlci5hdCI7czoxOiJvIjtpOjExMzY7fQ==)"; flow:established,to_server; http.uri; content:"/stakings/?b=YTo0OntzOjU6ImxhYmVsIjtzOjA6IiI7czozOiJ1c3IiO2k6MjUwO3M6NDoibm9wZCI7czoxMzoicnNzLnNheWxlci5hdCI7czoxOiJvIjtpOjExMzY7fQ=="; startswith; fast_pattern; http.host; content:"121hiu.senes.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010769; classtype:social-engineering; sid:6010769; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e96d05.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e96d05.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010770; classtype:social-engineering; sid:6010770; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (official-coinbus-help.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"official-coinbus-help.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010771; classtype:social-engineering; sid:6010771; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (asifseemab23-coder.github.io/e.g.-assingment25)"; flow:established,to_server; http.uri; content:"/e.g.-assingment25"; startswith; fast_pattern; http.host; content:"asifseemab23-coder.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010772; classtype:social-engineering; sid:6010772; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rodissenguele.github.io/javaScript-AmazonClone-project/)"; flow:established,to_server; http.uri; content:"/javaScript-AmazonClone-project/"; startswith; fast_pattern; http.host; content:"rodissenguele.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010773; classtype:social-engineering; sid:6010773; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (transcript.humapolicyreview.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"transcript.humapolicyreview.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010774; classtype:social-engineering; sid:6010774; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.nsgacademy.com/path/directory/cpanel.html)"; flow:established,to_server; http.uri; content:"/path/directory/cpanel.html"; startswith; fast_pattern; http.host; content:"www.nsgacademy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010775; classtype:social-engineering; sid:6010775; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgrecomlive.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgrecomlive.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010776; classtype:social-engineering; sid:6010776; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (student-shifajamali.github.io/Netflix-Clone/)"; flow:established,to_server; http.uri; content:"/Netflix-Clone/"; startswith; fast_pattern; http.host; content:"student-shifajamali.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010777; classtype:social-engineering; sid:6010777; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zerobot043-wqam.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zerobot043-wqam.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010778; classtype:social-engineering; sid:6010778; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rosehearingaid.com/service.php)"; flow:established,to_server; http.uri; content:"/service.php"; startswith; fast_pattern; http.host; content:"rosehearingaid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010779; classtype:social-engineering; sid:6010779; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (uigocjtd1ev9sdwxwpsydrmdghrvpalpsf2-h13s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"uigocjtd1ev9sdwxwpsydrmdghrvpalpsf2-h13s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010780; classtype:social-engineering; sid:6010780; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a4b52a.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a4b52a.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010781; classtype:social-engineering; sid:6010781; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9442dd.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9442dd.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010782; classtype:social-engineering; sid:6010782; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suite-trezzor-com.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"suite-trezzor-com.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010783; classtype:social-engineering; sid:6010783; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (begin-ledger-support.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"begin-ledger-support.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010784; classtype:social-engineering; sid:6010784; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tracking-security.com/track/track.php)"; flow:established,to_server; http.uri; content:"/track/track.php"; startswith; fast_pattern; http.host; content:"tracking-security.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010785; classtype:social-engineering; sid:6010785; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shipra830.github.io/spotify-clone/)"; flow:established,to_server; http.uri; content:"/spotify-clone/"; startswith; fast_pattern; http.host; content:"shipra830.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010786; classtype:social-engineering; sid:6010786; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinitywebmail26.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinitywebmail26.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010787; classtype:social-engineering; sid:6010787; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinittysignin.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinittysignin.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010788; classtype:social-engineering; sid:6010788; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ecmengenharia.com.br/wp-content/Sys/login.php)"; flow:established,to_server; http.uri; content:"/wp-content/Sys/login.php"; startswith; fast_pattern; http.host; content:"ecmengenharia.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010789; classtype:social-engineering; sid:6010789; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (netflixcasinonz.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"netflixcasinonz.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010790; classtype:social-engineering; sid:6010790; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-live-desktop-start-cloud.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-live-desktop-start-cloud.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010791; classtype:social-engineering; sid:6010791; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (2cae93.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"2cae93.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010792; classtype:social-engineering; sid:6010792; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookimagelogin.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebookimagelogin.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010793; classtype:social-engineering; sid:6010793; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mardortii.github.io/barca/)"; flow:established,to_server; http.uri; content:"/barca/"; startswith; fast_pattern; http.host; content:"mardortii.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010794; classtype:social-engineering; sid:6010794; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-login-facebook.bolt.host/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-login-facebook.bolt.host"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010795; classtype:social-engineering; sid:6010795; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sene4.ojczenasz.org/usbankverify/)"; flow:established,to_server; http.uri; content:"/usbankverify/"; startswith; fast_pattern; http.host; content:"sene4.ojczenasz.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010796; classtype:social-engineering; sid:6010796; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (627026.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"627026.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010797; classtype:social-engineering; sid:6010797; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (umitceriuete94.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"umitceriuete94.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010798; classtype:social-engineering; sid:6010798; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (php-hanna34.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"php-hanna34.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010799; classtype:social-engineering; sid:6010799; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nologiceries814aug.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"nologiceries814aug.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010800; classtype:social-engineering; sid:6010800; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (627024.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"627024.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010801; classtype:social-engineering; sid:6010801; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support-uphold-auths-secure.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"support-uphold-auths-secure.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010802; classtype:social-engineering; sid:6010802; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cuimopornant345cert.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"cuimopornant345cert.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010803; classtype:social-engineering; sid:6010803; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (riya020207-ux.github.io/Netflix-clone/)"; flow:established,to_server; http.uri; content:"/Netflix-clone/"; startswith; fast_pattern; http.host; content:"riya020207-ux.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010804; classtype:social-engineering; sid:6010804; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whatsapp.xolura.com/app/whatsapp)"; flow:established,to_server; http.uri; content:"/app/whatsapp"; startswith; fast_pattern; http.host; content:"whatsapp.xolura.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010805; classtype:social-engineering; sid:6010805; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gbwhatsup.app/es/jtwhatsapp-apk/)"; flow:established,to_server; http.uri; content:"/es/jtwhatsapp-apk/"; startswith; fast_pattern; http.host; content:"gbwhatsup.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010806; classtype:social-engineering; sid:6010806; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (design42.ict.ph/broxx/allieif.html)"; flow:established,to_server; http.uri; content:"/broxx/allieif.html"; startswith; fast_pattern; http.host; content:"design42.ict.ph"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010807; classtype:social-engineering; sid:6010807; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (access-divace-bridge.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"access-divace-bridge.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010808; classtype:social-engineering; sid:6010808; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (notebook-ledger.altinay09.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"notebook-ledger.altinay09.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010809; classtype:social-engineering; sid:6010809; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app-live-ledger-wllet.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app-live-ledger-wllet.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010810; classtype:social-engineering; sid:6010810; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (7ec328.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"7ec328.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010811; classtype:social-engineering; sid:6010811; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (namratamehra27-pixel.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"namratamehra27-pixel.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010812; classtype:social-engineering; sid:6010812; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steamcommumminmty.cam/tradeoffer/new/partner=PX1313853234tokenMq4217365)"; flow:established,to_server; http.uri; content:"/tradeoffer/new/partner=PX1313853234tokenMq4217365"; startswith; fast_pattern; http.host; content:"steamcommumminmty.cam"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010813; classtype:social-engineering; sid:6010813; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-us-en-ledger-live-wallet.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-us-en-ledger-live-wallet.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010814; classtype:social-engineering; sid:6010814; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (6a2abb.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"6a2abb.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010815; classtype:social-engineering; sid:6010815; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (messenger-verrification-supporst.us/login)"; flow:established,to_server; http.uri; content:"/login"; startswith; fast_pattern; http.host; content:"messenger-verrification-supporst.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010816; classtype:social-engineering; sid:6010816; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qnwznxkgybujvhorkppwz10ymwegxe4oeesf1-h13s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qnwznxkgybujvhorkppwz10ymwegxe4oeesf1-h13s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010817; classtype:social-engineering; sid:6010817; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (enelopecurelans89.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"enelopecurelans89.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010818; classtype:social-engineering; sid:6010818; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.nw-facebook.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.nw-facebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010819; classtype:social-engineering; sid:6010819; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bigtalkcentres.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bigtalkcentres.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010820; classtype:social-engineering; sid:6010820; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stearmconmumniity.com/trade0ffers/new/partners=28174219pg9&token=HBjro092/)"; flow:established,to_server; http.uri; content:"/trade0ffers/new/partners=28174219pg9&token=HBjro092/"; startswith; fast_pattern; http.host; content:"stearmconmumniity.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010821; classtype:social-engineering; sid:6010821; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (48173c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"48173c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010822; classtype:social-engineering; sid:6010822; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (diksha-pal04.github.io/SPOTIFY-CLONE/)"; flow:established,to_server; http.uri; content:"/SPOTIFY-CLONE/"; startswith; fast_pattern; http.host; content:"diksha-pal04.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010823; classtype:social-engineering; sid:6010823; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (quiz-amazon.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"quiz-amazon.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010824; classtype:social-engineering; sid:6010824; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a8a270.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a8a270.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010825; classtype:social-engineering; sid:6010825; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (redirect-to-same-5-woad.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"redirect-to-same-5-woad.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010826; classtype:social-engineering; sid:6010826; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebookimagelogin.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebookimagelogin.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010827; classtype:social-engineering; sid:6010827; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s.team-qf.com/p/opcu-khmt/wealtvqc)"; flow:established,to_server; http.uri; content:"/p/opcu-khmt/wealtvqc"; startswith; fast_pattern; http.host; content:"s.team-qf.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010828; classtype:social-engineering; sid:6010828; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a3b9c5s1.com:8989/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"a3b9c5s1.com:8989"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010829; classtype:social-engineering; sid:6010829; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-download-web-sso.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-download-web-sso.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010830; classtype:social-engineering; sid:6010830; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebook0login.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebook0login.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010831; classtype:social-engineering; sid:6010831; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sexy-whatsapp.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"sexy-whatsapp.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010832; classtype:social-engineering; sid:6010832; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fb9161.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fb9161.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010833; classtype:social-engineering; sid:6010833; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trafifer.github.io/rob/?p=robuxroblox)"; flow:established,to_server; http.uri; content:"/rob/?p=robuxroblox"; startswith; fast_pattern; http.host; content:"trafifer.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010834; classtype:social-engineering; sid:6010834; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (student-shifajamali.github.io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"student-shifajamali.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010835; classtype:social-engineering; sid:6010835; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (436706.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"436706.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010836; classtype:social-engineering; sid:6010836; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rnfzd4.com:8989/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"rnfzd4.com:8989"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010837; classtype:social-engineering; sid:6010837; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.535by.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.535by.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010838; classtype:social-engineering; sid:6010838; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (coinbaseinvestors.ai/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"coinbaseinvestors.ai"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010839; classtype:social-engineering; sid:6010839; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.instagram.com.178.105.92.231.sslip.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.instagram.com.178.105.92.231.sslip.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010840; classtype:social-engineering; sid:6010840; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (messenger-verrification-supporst.us/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"messenger-verrification-supporst.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010841; classtype:social-engineering; sid:6010841; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure----bybit-login.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure----bybit-login.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010842; classtype:social-engineering; sid:6010842; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d7693c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d7693c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010843; classtype:social-engineering; sid:6010843; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kucoine-learn-doce.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kucoine-learn-doce.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010844; classtype:social-engineering; sid:6010844; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (26eb32.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"26eb32.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010845; classtype:social-engineering; sid:6010845; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hellomatethismypagepleasejoin.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hellomatethismypagepleasejoin.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010846; classtype:social-engineering; sid:6010846; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tejasequity.github.io/Amazon-clone/)"; flow:established,to_server; http.uri; content:"/Amazon-clone/"; startswith; fast_pattern; http.host; content:"tejasequity.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010847; classtype:social-engineering; sid:6010847; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-c-om-ledg-er-sta-rt.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-c-om-ledg-er-sta-rt.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010848; classtype:social-engineering; sid:6010848; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faq-app-trzor-suite.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faq-app-trzor-suite.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010849; classtype:social-engineering; sid:6010849; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faceb00k-br.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faceb00k-br.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010850; classtype:social-engineering; sid:6010850; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bankofamericamailcompte.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bankofamericamailcompte.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010851; classtype:social-engineering; sid:6010851; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (info-suit-e-treze-er-doc.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"info-suit-e-treze-er-doc.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010852; classtype:social-engineering; sid:6010852; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ayushmamgain1.github.io/netflix/)"; flow:established,to_server; http.uri; content:"/netflix/"; startswith; fast_pattern; http.host; content:"ayushmamgain1.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010853; classtype:social-engineering; sid:6010853; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledgr-walt-secure-td.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledgr-walt-secure-td.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010854; classtype:social-engineering; sid:6010854; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tactica7.com.mx/plala/jpn/webmai1/index.php)"; flow:established,to_server; http.uri; content:"/plala/jpn/webmai1/index.php"; startswith; fast_pattern; http.host; content:"tactica7.com.mx"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010855; classtype:social-engineering; sid:6010855; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bybit-login-app.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bybit-login-app.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010856; classtype:social-engineering; sid:6010856; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.sexy-whatsapp.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"www.sexy-whatsapp.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010857; classtype:social-engineering; sid:6010857; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wedfgbnmoijhgcxvbnm-dpyjx01bl5o7.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wedfgbnmoijhgcxvbnm-dpyjx01bl5o7.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010858; classtype:social-engineering; sid:6010858; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (asifseemab23-coder.github.io/e.g.-assingment25/)"; flow:established,to_server; http.uri; content:"/e.g.-assingment25/"; startswith; fast_pattern; http.host; content:"asifseemab23-coder.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010859; classtype:social-engineering; sid:6010859; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-treezer-logins-cdns.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en-treezer-logins-cdns.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010860; classtype:social-engineering; sid:6010860; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (g3b9c123.com:8989/register.html)"; flow:established,to_server; http.uri; content:"/register.html"; startswith; fast_pattern; http.host; content:"g3b9c123.com:8989"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010861; classtype:social-engineering; sid:6010861; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebook0login.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"facebook0login.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010862; classtype:social-engineering; sid:6010862; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ubmbutcernavies.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ubmbutcernavies.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010863; classtype:social-engineering; sid:6010863; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (comcastsecurityupdate.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"comcastsecurityupdate.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010864; classtype:social-engineering; sid:6010864; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-base-start-sso.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"help-base-start-sso.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010865; classtype:social-engineering; sid:6010865; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ea51fe.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ea51fe.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010866; classtype:social-engineering; sid:6010866; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mrbeast-gifts.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"mrbeast-gifts.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010867; classtype:social-engineering; sid:6010867; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sucar77por.bond/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sucar77por.bond"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010868; classtype:social-engineering; sid:6010868; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (transcript.shakepayreviewpolicy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"transcript.shakepayreviewpolicy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010869; classtype:social-engineering; sid:6010869; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (annyfox16.github.io/netflix-landing-page)"; flow:established,to_server; http.uri; content:"/netflix-landing-page"; startswith; fast_pattern; http.host; content:"annyfox16.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010870; classtype:social-engineering; sid:6010870; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (forprojectwork2021.github.io/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"forprojectwork2021.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010871; classtype:social-engineering; sid:6010871; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.motorola.com/us/en/homepage/)"; flow:established,to_server; http.uri; content:"/us/en/homepage/"; startswith; fast_pattern; http.host; content:"www.motorola.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010872; classtype:social-engineering; sid:6010872; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (84758b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"84758b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010873; classtype:social-engineering; sid:6010873; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (help-bridge-desk.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"help-bridge-desk.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010874; classtype:social-engineering; sid:6010874; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-login-start-ledger-web.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-login-start-ledger-web.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010875; classtype:social-engineering; sid:6010875; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (smackapp.com/grp01.id.rakuten.co.jp/jp/bbfd66ebc9cf8def0b2cf4ab59953a1b/)"; flow:established,to_server; http.uri; content:"/grp01.id.rakuten.co.jp/jp/bbfd66ebc9cf8def0b2cf4ab59953a1b/"; startswith; fast_pattern; http.host; content:"smackapp.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010876; classtype:social-engineering; sid:6010876; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (codedetrichelattaquedeszombieroblox.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"codedetrichelattaquedeszombieroblox.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010877; classtype:social-engineering; sid:6010877; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hmskcert782mebr7.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hmskcert782mebr7.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010878; classtype:social-engineering; sid:6010878; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sock-zizifn-hk.pennyphd.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sock-zizifn-hk.pennyphd.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010879; classtype:social-engineering; sid:6010879; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pcswap.org/home/)"; flow:established,to_server; http.uri; content:"/home/"; startswith; fast_pattern; http.host; content:"pcswap.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010880; classtype:social-engineering; sid:6010880; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (accessfilepointhiu.cloud-ip.cc/nci/vm-file/)"; flow:established,to_server; http.uri; content:"/nci/vm-file/"; startswith; fast_pattern; http.host; content:"accessfilepointhiu.cloud-ip.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010881; classtype:social-engineering; sid:6010881; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c8042e.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c8042e.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010882; classtype:social-engineering; sid:6010882; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (faq-bridge-en-us.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"faq-bridge-en-us.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010883; classtype:social-engineering; sid:6010883; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.globalterdaftar.com/m/index)"; flow:established,to_server; http.uri; content:"/m/index"; startswith; fast_pattern; http.host; content:"www.globalterdaftar.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010884; classtype:social-engineering; sid:6010884; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (121hiu.senes.at:443/stakings/)"; flow:established,to_server; http.uri; content:"/stakings/"; startswith; fast_pattern; http.host; content:"121hiu.senes.at:443"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010885; classtype:social-engineering; sid:6010885; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (transcript.bisqreviewpolicy.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"transcript.bisqreviewpolicy.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010886; classtype:social-engineering; sid:6010886; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lhttps--www-roblox.co/users/475950072/profile)"; flow:established,to_server; http.uri; content:"/users/475950072/profile"; startswith; fast_pattern; http.host; content:"lhttps--www-roblox.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010887; classtype:social-engineering; sid:6010887; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (eiriesmamies6789.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"eiriesmamies6789.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010888; classtype:social-engineering; sid:6010888; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (app----en-bybit-sso.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"app----en-bybit-sso.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010889; classtype:social-engineering; sid:6010889; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.365bet288.com/eng/home/index/)"; flow:established,to_server; http.uri; content:"/eng/home/index/"; startswith; fast_pattern; http.host; content:"m.365bet288.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010890; classtype:social-engineering; sid:6010890; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (live-led-ger-sso-auth.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"live-led-ger-sso-auth.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010891; classtype:social-engineering; sid:6010891; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pay-profiles-bs0k3xr24-walletconnect.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"pay-profiles-bs0k3xr24-walletconnect.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010892; classtype:social-engineering; sid:6010892; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (us-conect-ledger-live-login.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"us-conect-ledger-live-login.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010893; classtype:social-engineering; sid:6010893; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (am.xjrct.best/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"am.xjrct.best"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010894; classtype:social-engineering; sid:6010894; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ashishkumar8543.github.io/Amazon-Clone/)"; flow:established,to_server; http.uri; content:"/Amazon-Clone/"; startswith; fast_pattern; http.host; content:"ashishkumar8543.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010895; classtype:social-engineering; sid:6010895; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (newfinity.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"newfinity.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010896; classtype:social-engineering; sid:6010896; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dashboardappv1.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dashboardappv1.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010897; classtype:social-engineering; sid:6010897; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-trezor-get-web.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-trezor-get-web.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010898; classtype:social-engineering; sid:6010898; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (chat.ajsdnwx.com/?naps)"; flow:established,to_server; http.uri; content:"/?naps"; startswith; fast_pattern; http.host; content:"chat.ajsdnwx.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010899; classtype:social-engineering; sid:6010899; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (einimourou892seret.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"einimourou892seret.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010900; classtype:social-engineering; sid:6010900; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinity1234.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinity1234.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010901; classtype:social-engineering; sid:6010901; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b67.ch/Coeeirmmmasuaoseks/index.php)"; flow:established,to_server; http.uri; content:"/Coeeirmmmasuaoseks/index.php"; startswith; fast_pattern; http.host; content:"b67.ch"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010902; classtype:social-engineering; sid:6010902; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.pn-pg.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.pn-pg.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010903; classtype:social-engineering; sid:6010903; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (public-suite-app-trez.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"public-suite-app-trez.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010904; classtype:social-engineering; sid:6010904; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (messenger-verrification-supporst.us/verify-js)"; flow:established,to_server; http.uri; content:"/verify-js"; startswith; fast_pattern; http.host; content:"messenger-verrification-supporst.us"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010905; classtype:social-engineering; sid:6010905; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (cxyziva.vu/onlghdhhg/hihtrybhgg)"; flow:established,to_server; http.uri; content:"/onlghdhhg/hihtrybhgg"; startswith; fast_pattern; http.host; content:"cxyziva.vu"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010906; classtype:social-engineering; sid:6010906; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bright-secure-blokf-com-authd.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bright-secure-blokf-com-authd.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010907; classtype:social-engineering; sid:6010907; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ayushsharma2302.github.io/spotify-clone/)"; flow:established,to_server; http.uri; content:"/spotify-clone/"; startswith; fast_pattern; http.host; content:"ayushsharma2302.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010908; classtype:social-engineering; sid:6010908; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rbx4kb.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rbx4kb.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010909; classtype:social-engineering; sid:6010909; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hardware-trezr-faq-wallets.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"hardware-trezr-faq-wallets.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010910; classtype:social-engineering; sid:6010910; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.xpjylc.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.xpjylc.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010911; classtype:social-engineering; sid:6010911; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portal-liv-e-ap-p-ledger.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"portal-liv-e-ap-p-ledger.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010912; classtype:social-engineering; sid:6010912; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (co-web-ledger-live-login.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"co-web-ledger-live-login.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010913; classtype:social-engineering; sid:6010913; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (quickbookstechcare.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"quickbookstechcare.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010914; classtype:social-engineering; sid:6010914; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-treezer-cdn-sso.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en-treezer-cdn-sso.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010915; classtype:social-engineering; sid:6010915; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sbrthend.site:443/base/?b=YTo0OntzOjU6ImxhYmVsIjtzOjA6IiI7czozOiJ1c3IiO2k6NjE3O3M6NDoibm9wZCI7czoxMzoicnNzLnNheWxlci5hdCI7czoxOiJvIjtpOjIxNDQ7fQ==)"; flow:established,to_server; http.uri; content:"/base/?b=YTo0OntzOjU6ImxhYmVsIjtzOjA6IiI7czozOiJ1c3IiO2k6NjE3O3M6NDoibm9wZCI7czoxMzoicnNzLnNheWxlci5hdCI7czoxOiJvIjtpOjIxNDQ7fQ=="; startswith; fast_pattern; http.host; content:"sbrthend.site:443"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010916; classtype:social-engineering; sid:6010916; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gagandeep-singh19.github.io/SPOTIFY-CLONE/)"; flow:established,to_server; http.uri; content:"/SPOTIFY-CLONE/"; startswith; fast_pattern; http.host; content:"gagandeep-singh19.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010917; classtype:social-engineering; sid:6010917; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xxfinityvoice.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xxfinityvoice.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010918; classtype:social-engineering; sid:6010918; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stilles-oertchen.de/HomeWell/download.html)"; flow:established,to_server; http.uri; content:"/HomeWell/download.html"; startswith; fast_pattern; http.host; content:"stilles-oertchen.de"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010919; classtype:social-engineering; sid:6010919; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a2cd23.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a2cd23.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010920; classtype:social-engineering; sid:6010920; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (watco.microsoft-notifcation.com/wa4d1737192/78b65c00e4993df97452c88c/index.php)"; flow:established,to_server; http.uri; content:"/wa4d1737192/78b65c00e4993df97452c88c/index.php"; startswith; fast_pattern; http.host; content:"watco.microsoft-notifcation.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010921; classtype:social-engineering; sid:6010921; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (f2f081.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"f2f081.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010922; classtype:social-engineering; sid:6010922; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (transcript.krakenpolicyreview.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"transcript.krakenpolicyreview.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010923; classtype:social-engineering; sid:6010923; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (support--legderlive-us--learn.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"support--legderlive-us--learn.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010924; classtype:social-engineering; sid:6010924; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (website-b28cb301.iza.col.mybluehost.me/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"website-b28cb301.iza.col.mybluehost.me"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010925; classtype:social-engineering; sid:6010925; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zhkilmmfyuvtc7q1effysmlxxe3ifpkrypsf19-cg1108s.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zhkilmmfyuvtc7q1effysmlxxe3ifpkrypsf19-cg1108s.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010926; classtype:social-engineering; sid:6010926; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (tracking-security.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"tracking-security.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010927; classtype:social-engineering; sid:6010927; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9a881f.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"9a881f.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010928; classtype:social-engineering; sid:6010928; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4c3cab.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4c3cab.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010929; classtype:social-engineering; sid:6010929; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dynamic-coconut-665358.framer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dynamic-coconut-665358.framer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010930; classtype:social-engineering; sid:6010930; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (spotify-accounts-login.callora.cz/z/pages/login.php/)"; flow:established,to_server; http.uri; content:"/z/pages/login.php/"; startswith; fast_pattern; http.host; content:"spotify-accounts-login.callora.cz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010931; classtype:social-engineering; sid:6010931; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zxxxxzzzz.weeblysite.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zxxxxzzzz.weeblysite.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010932; classtype:social-engineering; sid:6010932; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-com-start-start-us-app.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-com-start-start-us-app.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010933; classtype:social-engineering; sid:6010933; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ycgfn51lkwg-vnzktpli-4ce50c-ycg77c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ycgfn51lkwg-vnzktpli-4ce50c-ycg77c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010934; classtype:social-engineering; sid:6010934; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (nw-facebook.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"nw-facebook.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010935; classtype:social-engineering; sid:6010935; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.tmpnh.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"m.tmpnh.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010936; classtype:social-engineering; sid:6010936; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (en-t-r-e-z-r-io-login.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"en-t-r-e-z-r-io-login.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010937; classtype:social-engineering; sid:6010937; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sock-zizifn-us.ludea-liu.workers.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sock-zizifn-us.ludea-liu.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010938; classtype:social-engineering; sid:6010938; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ledger-eng-start.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ledger-eng-start.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010939; classtype:social-engineering; sid:6010939; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (moba-ml.com-id.my.id/en/)"; flow:established,to_server; http.uri; content:"/en/"; startswith; fast_pattern; http.host; content:"moba-ml.com-id.my.id"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010940; classtype:social-engineering; sid:6010940; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pradeeppanaganti.github.io/Spotify-clone/)"; flow:established,to_server; http.uri; content:"/Spotify-clone/"; startswith; fast_pattern; http.host; content:"pradeeppanaganti.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010941; classtype:social-engineering; sid:6010941; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (trczorw3.top/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"trczorw3.top"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010942; classtype:social-engineering; sid:6010942; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (securityxfinty.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"securityxfinty.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010943; classtype:social-engineering; sid:6010943; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-help-eng-ledger-live-login.typedream.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-help-eng-ledger-live-login.typedream.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010944; classtype:social-engineering; sid:6010944; rev:1; metadata: signature_severity Major, created_et 2026_08_17;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (165-154-235-121.cprapid.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"165-154-235-121.cprapid.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010945; classtype:social-engineering; sid:6010945; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.updateversescoopyah.dpdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.updateversescoopyah.dpdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010946; classtype:social-engineering; sid:6010946; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dzima.mk/bvg/)"; flow:established,to_server; http.uri; content:"/bvg/"; startswith; fast_pattern; http.host; content:"dzima.mk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010947; classtype:social-engineering; sid:6010947; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (contentprotectionlogin.com/api/user/request-perm?email_id=e45bfe25-8691-4fee-98ea-9841fda7987e)"; flow:established,to_server; http.uri; content:"/api/user/request-perm?email_id=e45bfe25-8691-4fee-98ea-9841fda7987e"; startswith; fast_pattern; http.host; content:"contentprotectionlogin.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010948; classtype:social-engineering; sid:6010948; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cuccuttroisongsspp.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cuccuttroisongsspp.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010949; classtype:social-engineering; sid:6010949; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.ingreseaqui365.webcindario.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.ingreseaqui365.webcindario.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010950; classtype:social-engineering; sid:6010950; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (page-archive-guide-6d21.syifatul771.workers.dev/meta_privacy_center/)"; flow:established,to_server; http.uri; content:"/meta_privacy_center/"; startswith; fast_pattern; http.host; content:"page-archive-guide-6d21.syifatul771.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010951; classtype:social-engineering; sid:6010951; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dravora-gld-felquna-r9t5hk20.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dravora-gld-felquna-r9t5hk20.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010952; classtype:social-engineering; sid:6010952; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (8cbc1d.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"8cbc1d.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010953; classtype:social-engineering; sid:6010953; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (frforte.com.br/card.php/)"; flow:established,to_server; http.uri; content:"/card.php/"; startswith; fast_pattern; http.host; content:"frforte.com.br"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010954; classtype:social-engineering; sid:6010954; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (stonemicrofinance.co.zw/about/help/web/info.php)"; flow:established,to_server; http.uri; content:"/about/help/web/info.php"; startswith; fast_pattern; http.host; content:"stonemicrofinance.co.zw"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010955; classtype:social-engineering; sid:6010955; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (m.365bet990.com/chs/)"; flow:established,to_server; http.uri; content:"/chs/"; startswith; fast_pattern; http.host; content:"m.365bet990.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010956; classtype:social-engineering; sid:6010956; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (mrmeowcoder.github.io/Amazon-Clone)"; flow:established,to_server; http.uri; content:"/Amazon-Clone"; startswith; fast_pattern; http.host; content:"mrmeowcoder.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010957; classtype:social-engineering; sid:6010957; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jinuganesh39.github.io/Ledger-app)"; flow:established,to_server; http.uri; content:"/Ledger-app"; startswith; fast_pattern; http.host; content:"jinuganesh39.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010958; classtype:social-engineering; sid:6010958; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creditoecuador-2026--creditoenlinea1.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"creditoecuador-2026--creditoenlinea1.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010959; classtype:social-engineering; sid:6010959; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (jbwrblxjbw34.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"jbwrblxjbw34.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010960; classtype:social-engineering; sid:6010960; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (3751dc.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"3751dc.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010961; classtype:social-engineering; sid:6010961; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wre693.github.io/lnstagram/)"; flow:established,to_server; http.uri; content:"/lnstagram/"; startswith; fast_pattern; http.host; content:"wre693.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010962; classtype:social-engineering; sid:6010962; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d481ab.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d481ab.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010963; classtype:social-engineering; sid:6010963; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ae90ba.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ae90ba.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010964; classtype:social-engineering; sid:6010964; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (finiityupdate.dpdns.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"finiityupdate.dpdns.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010965; classtype:social-engineering; sid:6010965; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (c927-v0h4-auunl-irt8-n0gb.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"c927-v0h4-auunl-irt8-n0gb.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010966; classtype:social-engineering; sid:6010966; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (demontdedsd.github.io/fadse)"; flow:established,to_server; http.uri; content:"/fadse"; startswith; fast_pattern; http.host; content:"demontdedsd.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010967; classtype:social-engineering; sid:6010967; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (klzyhi5p-cg17.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"klzyhi5p-cg17.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010968; classtype:social-engineering; sid:6010968; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xelzeta-kxt-felmora-r5t1hq87.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xelzeta-kxt-felmora-r5t1hq87.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010969; classtype:social-engineering; sid:6010969; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1708dkfjxusxkxlolxxisdforxxllp1-endpoint-d9huf9bsffb3hab8.z03.azurefd.net/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1708dkfjxusxkxlolxxisdforxxllp1-endpoint-d9huf9bsffb3hab8.z03.azurefd.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010970; classtype:social-engineering; sid:6010970; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1xbetbk1.com/en/block)"; flow:established,to_server; http.uri; content:"/en/block"; startswith; fast_pattern; http.host; content:"1xbetbk1.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010971; classtype:social-engineering; sid:6010971; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (expresssze48h-delivery.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"expresssze48h-delivery.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010972; classtype:social-engineering; sid:6010972; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (portalportalportalportalportal.edgeone.dev/genhrportal23490282727363738902-289776.html)"; flow:established,to_server; http.uri; content:"/genhrportal23490282727363738902-289776.html"; startswith; fast_pattern; http.host; content:"portalportalportalportalportal.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010973; classtype:social-engineering; sid:6010973; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flipcartshoppingoffer.github.io/Instagram-/)"; flow:established,to_server; http.uri; content:"/Instagram-/"; startswith; fast_pattern; http.host; content:"flipcartshoppingoffer.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010974; classtype:social-engineering; sid:6010974; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mercadolibre.cl/gz/account-verification?go=https%3A%2F%2Flistado.mercadolibre.cl%2F_Container_ms-perfumes%2F&tid=4078e439-20c8-4c40-8de3-c50d3d8d5253)"; flow:established,to_server; http.uri; content:"/gz/account-verification?go=https%3A%2F%2Flistado.mercadolibre.cl%2F_Container_ms-perfumes%2F&tid=4078e439-20c8-4c40-8de3-c50d3d8d5253"; startswith; fast_pattern; http.host; content:"www.mercadolibre.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010975; classtype:social-engineering; sid:6010975; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bermora-gld-lentavi-a6x3dw19.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bermora-gld-lentavi-a6x3dw19.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010976; classtype:social-engineering; sid:6010976; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (d6859d.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"d6859d.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010977; classtype:social-engineering; sid:6010977; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9bxwv2tbfyc8dvdgng.vercel.app/hgfdkmhtbs35e4rhbgsadf.html)"; flow:established,to_server; http.uri; content:"/hgfdkmhtbs35e4rhbgsadf.html"; startswith; fast_pattern; http.host; content:"9bxwv2tbfyc8dvdgng.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010978; classtype:social-engineering; sid:6010978; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lvmtx8x9-h14.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"lvmtx8x9-h14.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010979; classtype:social-engineering; sid:6010979; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bancaporinternet.bartrading.net/BNWeb/Inicio/)"; flow:established,to_server; http.uri; content:"/BNWeb/Inicio/"; startswith; fast_pattern; http.host; content:"bancaporinternet.bartrading.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010980; classtype:social-engineering; sid:6010980; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (h8g7f6d5s43d4567-dp91egqbnglh.edgeone.dev/english.html)"; flow:established,to_server; http.uri; content:"/english.html"; startswith; fast_pattern; http.host; content:"h8g7f6d5s43d4567-dp91egqbnglh.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010981; classtype:social-engineering; sid:6010981; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhlde.wallbee.dk/Account/LogOn?ReturnUrl=%2f)"; flow:established,to_server; http.uri; content:"/Account/LogOn?ReturnUrl=%2f"; startswith; fast_pattern; http.host; content:"dhlde.wallbee.dk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010982; classtype:social-engineering; sid:6010982; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (staticfile-6d308.wasmer.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"staticfile-6d308.wasmer.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010983; classtype:social-engineering; sid:6010983; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-fenor-biz8-kavix-morlen.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-fenor-biz8-kavix-morlen.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010984; classtype:social-engineering; sid:6010984; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (abertoexpress.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"abertoexpress.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010985; classtype:social-engineering; sid:6010985; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dhlde.wallbee.dk/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dhlde.wallbee.dk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010986; classtype:social-engineering; sid:6010986; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (85i07-7of-u9zi0-71j-tasag.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"85i07-7of-u9zi0-71j-tasag.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010987; classtype:social-engineering; sid:6010987; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (xfinity342.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"xfinity342.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010988; classtype:social-engineering; sid:6010988; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1c791c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"1c791c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010989; classtype:social-engineering; sid:6010989; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qelvora-gld-lormeta-a9x2dk68.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qelvora-gld-lormeta-a9x2dk68.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010990; classtype:social-engineering; sid:6010990; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (izedeliverys-48h.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"izedeliverys-48h.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010991; classtype:social-engineering; sid:6010991; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (e2b37f.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"e2b37f.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010992; classtype:social-engineering; sid:6010992; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (creditopichinchaecuadorenlinea-2026--creditobhd.replit.app/?monto=10000)"; flow:established,to_server; http.uri; content:"/?monto=10000"; startswith; fast_pattern; http.host; content:"creditopichinchaecuadorenlinea-2026--creditobhd.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010993; classtype:social-engineering; sid:6010993; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lqk-bgrm-2dgn-ml1o5-1xl-rsz8j.pages.dev/qaz-wsx-edc-rfv?welcome=1966983813543360&token248=1966983813543360&name_token136=Joletec)"; flow:established,to_server; http.uri; content:"/qaz-wsx-edc-rfv?welcome=1966983813543360&token248=1966983813543360&name_token136=Joletec"; startswith; fast_pattern; http.host; content:"lqk-bgrm-2dgn-ml1o5-1xl-rsz8j.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010994; classtype:social-engineering; sid:6010994; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (07zh-uz1y-725xm-5jzd-huu8vl.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"07zh-uz1y-725xm-5jzd-huu8vl.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010995; classtype:social-engineering; sid:6010995; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookloginuser.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebookloginuser.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010996; classtype:social-engineering; sid:6010996; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (izeexpresss-48h.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"izeexpresss-48h.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010997; classtype:social-engineering; sid:6010997; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (boqmphwc-h14.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"boqmphwc-h14.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010998; classtype:social-engineering; sid:6010998; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (secure-index-manager--wynjones2017.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"secure-index-manager--wynjones2017.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6010999; classtype:social-engineering; sid:6010999; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.mrbeast-gifts.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.mrbeast-gifts.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011000; classtype:social-engineering; sid:6011000; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b11c28.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b11c28.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011001; classtype:social-engineering; sid:6011001; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.abertoexpress.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.abertoexpress.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011002; classtype:social-engineering; sid:6011002; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (352082.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"352082.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011003; classtype:social-engineering; sid:6011003; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-jarvik-biz8-velax-norim.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-jarvik-biz8-velax-norim.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011004; classtype:social-engineering; sid:6011004; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (viralizate.net/fencebuildersinc/)"; flow:established,to_server; http.uri; content:"/fencebuildersinc/"; startswith; fast_pattern; http.host; content:"viralizate.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011005; classtype:social-engineering; sid:6011005; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp3ct-hurnik-biz8-lavqor-fused.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp3ct-hurnik-biz8-lavqor-fused.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011006; classtype:social-engineering; sid:6011006; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kdply75skrp-zfnrw204nhb-4c1f8d-rqv09c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"kdply75skrp-zfnrw204nhb-4c1f8d-rqv09c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011007; classtype:social-engineering; sid:6011007; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bermita-gld-larqumi-a6x3dk74.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bermita-gld-larqumi-a6x3dk74.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011008; classtype:social-engineering; sid:6011008; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.jbwrblxjbw34.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.jbwrblxjbw34.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011009; classtype:social-engineering; sid:6011009; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bolsoemdia.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bolsoemdia.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011010; classtype:social-engineering; sid:6011010; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qnkxz7bskra-mtvljwur-6m1j7d-zl399a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qnkxz7bskra-mtvljwur-6m1j7d-zl399a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011011; classtype:social-engineering; sid:6011011; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s3.us-east-2.amazonaws.com/landing-uzariways.com/feelway.html)"; flow:established,to_server; http.uri; content:"/landing-uzariways.com/feelway.html"; startswith; fast_pattern; http.host; content:"s3.us-east-2.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011012; classtype:social-engineering; sid:6011012; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hariomsingh045.github.io/Spotify-Clone/)"; flow:established,to_server; http.uri; content:"/Spotify-Clone/"; startswith; fast_pattern; http.host; content:"hariomsingh045.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011013; classtype:social-engineering; sid:6011013; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.lux-oppo8.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.lux-oppo8.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011014; classtype:social-engineering; sid:6011014; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (09fbd3.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"09fbd3.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011015; classtype:social-engineering; sid:6011015; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (norveta-gld-zentora-p3t4dq91.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"norveta-gld-zentora-p3t4dq91.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011016; classtype:social-engineering; sid:6011016; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (esl-org-claim-alert.cfd/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"esl-org-claim-alert.cfd"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011017; classtype:social-engineering; sid:6011017; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.iforrhys-session-hmuxz5su-c1otsfedf---vhwubxx4v0.kharwadejewellers.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.iforrhys-session-hmuxz5su-c1otsfedf---vhwubxx4v0.kharwadejewellers.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011018; classtype:social-engineering; sid:6011018; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebookxlogin.blogspot.com/?m=1)"; flow:established,to_server; http.uri; content:"/?m=1"; startswith; fast_pattern; http.host; content:"facebookxlogin.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011019; classtype:social-engineering; sid:6011019; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qnkxz71mjwy-mtvljren-6j5j7g-zl299a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qnkxz71mjwy-mtvljren-6j5j7g-zl299a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011020; classtype:social-engineering; sid:6011020; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (onedocuvetinary-8t5h.ipfs.4everland.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"onedocuvetinary-8t5h.ipfs.4everland.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011021; classtype:social-engineering; sid:6011021; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (506453.xyz/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"506453.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011022; classtype:social-engineering; sid:6011022; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dexter-1280.github.io/Amazon-clone/orders.html)"; flow:established,to_server; http.uri; content:"/Amazon-clone/orders.html"; startswith; fast_pattern; http.host; content:"dexter-1280.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011023; classtype:social-engineering; sid:6011023; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (yjr7x9dq-cg17.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"yjr7x9dq-cg17.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011024; classtype:social-engineering; sid:6011024; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (incubalab.com.mx/uall/)"; flow:established,to_server; http.uri; content:"/uall/"; startswith; fast_pattern; http.host; content:"incubalab.com.mx"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011025; classtype:social-engineering; sid:6011025; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (securce-chasce.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"securce-chasce.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011026; classtype:social-engineering; sid:6011026; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.chartermailfdeagg78.weebly.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.chartermailfdeagg78.weebly.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011027; classtype:social-engineering; sid:6011027; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ag888.vip/home/register)"; flow:established,to_server; http.uri; content:"/home/register"; startswith; fast_pattern; http.host; content:"ag888.vip"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011028; classtype:social-engineering; sid:6011028; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (allegrolokalnie.lokalna-067.sbs/oferta/-Myjka-ci%C5%9Bnieniowa-Karcher-K7-Comfort-Premium/625020283)"; flow:established,to_server; http.uri; content:"/oferta/-Myjka-ci%C5%9Bnieniowa-Karcher-K7-Comfort-Premium/625020283"; startswith; fast_pattern; http.host; content:"allegrolokalnie.lokalna-067.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011029; classtype:social-engineering; sid:6011029; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (067368.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"067368.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011030; classtype:social-engineering; sid:6011030; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (r2gsjgp6-cg17.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"r2gsjgp6-cg17.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011031; classtype:social-engineering; sid:6011031; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp3ct-jasvor-biz8-folqen-ridak.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp3ct-jasvor-biz8-folqen-ridak.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011032; classtype:social-engineering; sid:6011032; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (whtahs.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"whtahs.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011033; classtype:social-engineering; sid:6011033; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (web-claude-launches-v4-09-dev-data-uniswap.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"web-claude-launches-v4-09-dev-data-uniswap.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011034; classtype:social-engineering; sid:6011034; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (phvjn857kf-bgrndpdrf-8e1a5b-gre3c.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"phvjn857kf-bgrndpdrf-8e1a5b-gre3c.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011035; classtype:social-engineering; sid:6011035; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zedeliverys48h-entrega.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zedeliverys48h-entrega.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011036; classtype:social-engineering; sid:6011036; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (40hpsh-zmd-hsz-8l3ek-bls.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"40hpsh-zmd-hsz-8l3ek-bls.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011037; classtype:social-engineering; sid:6011037; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (suspension-esl-org.sbs/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"suspension-esl-org.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011038; classtype:social-engineering; sid:6011038; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (severe-copper-y92uxuu9.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"severe-copper-y92uxuu9.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011039; classtype:social-engineering; sid:6011039; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.urlfy.org/9AqN5vj/)"; flow:established,to_server; http.uri; content:"/9AqN5vj/"; startswith; fast_pattern; http.host; content:"www.urlfy.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011040; classtype:social-engineering; sid:6011040; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sp4ct-norvurin-biz8-durem-lafix.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sp4ct-norvurin-biz8-durem-lafix.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011041; classtype:social-engineering; sid:6011041; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (prkgilrs-usdt-draner-frant.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"prkgilrs-usdt-draner-frant.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011042; classtype:social-engineering; sid:6011042; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www-rqblox.co/users/689394051/profile)"; flow:established,to_server; http.uri; content:"/users/689394051/profile"; startswith; fast_pattern; http.host; content:"www-rqblox.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011043; classtype:social-engineering; sid:6011043; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.fakinthefunk.net/en/)"; flow:established,to_server; http.uri; content:"/en/"; startswith; fast_pattern; http.host; content:"www.fakinthefunk.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011044; classtype:social-engineering; sid:6011044; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (expressbebidas24h-ze.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"expressbebidas24h-ze.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011045; classtype:social-engineering; sid:6011045; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (121491.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"121491.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011046; classtype:social-engineering; sid:6011046; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (velnora-gld-farqumi-r8k4hc51.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"velnora-gld-farqumi-r8k4hc51.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011047; classtype:social-engineering; sid:6011047; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zexpresss-delivery.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zexpresss-delivery.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011048; classtype:social-engineering; sid:6011048; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (steamncomnumity.ru/id/7656119798487711)"; flow:established,to_server; http.uri; content:"/id/7656119798487711"; startswith; fast_pattern; http.host; content:"steamncomnumity.ru"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011049; classtype:social-engineering; sid:6011049; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (rude-black-4tow5jpt.edgeone.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"rude-black-4tow5jpt.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011050; classtype:social-engineering; sid:6011050; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (hjelectrics.com/co/Korea.html)"; flow:established,to_server; http.uri; content:"/co/Korea.html"; startswith; fast_pattern; http.host; content:"hjelectrics.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011051; classtype:social-engineering; sid:6011051; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (izedeliverys-24h.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"izedeliverys-24h.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011052; classtype:social-engineering; sid:6011052; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (a6799c.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"a6799c.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011053; classtype:social-engineering; sid:6011053; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www-rqblox.co/users/1903963388/profile)"; flow:established,to_server; http.uri; content:"/users/1903963388/profile"; startswith; fast_pattern; http.host; content:"www-rqblox.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011054; classtype:social-engineering; sid:6011054; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (embalar.aigdk.eu.cc/KW)"; flow:established,to_server; http.uri; content:"/KW"; startswith; fast_pattern; http.host; content:"embalar.aigdk.eu.cc"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011055; classtype:social-engineering; sid:6011055; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (zexpresss-24h.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"zexpresss-24h.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011056; classtype:social-engineering; sid:6011056; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b9679b.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b9679b.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011057; classtype:social-engineering; sid:6011057; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kzptb6b20sk-xvqmrwur-3j2g4d-pm788a242.pages.dev/welcome_aboard?welcome=1000968689063090&token248=1000968689063090&name_token136=The%20Mohegan%20Tribe)"; flow:established,to_server; http.uri; content:"/welcome_aboard?welcome=1000968689063090&token248=1000968689063090&name_token136=The%20Mohegan%20Tribe"; startswith; fast_pattern; http.host; content:"kzptb6b20sk-xvqmrwur-3j2g4d-pm788a242.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011058; classtype:social-engineering; sid:6011058; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (broad-river-4f0d.forms-f8f.workers.dev/docusign)"; flow:established,to_server; http.uri; content:"/docusign"; startswith; fast_pattern; http.host; content:"broad-river-4f0d.forms-f8f.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011059; classtype:social-engineering; sid:6011059; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.pasdpalz1.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.pasdpalz1.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011060; classtype:social-engineering; sid:6011060; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (facebooknlogin.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"facebooknlogin.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011061; classtype:social-engineering; sid:6011061; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (oedhfx.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"oedhfx.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011062; classtype:social-engineering; sid:6011062; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (flouscashzebii.ilovemorkies.com/Last/ch/)"; flow:established,to_server; http.uri; content:"/Last/ch/"; startswith; fast_pattern; http.host; content:"flouscashzebii.ilovemorkies.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011063; classtype:social-engineering; sid:6011063; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (651b4d.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"651b4d.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011064; classtype:social-engineering; sid:6011064; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (marneta-gld-lormavi-p1t3fq85.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"marneta-gld-lormavi-p1t3fq85.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011065; classtype:social-engineering; sid:6011065; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (office.parketthaus-badnauheim.sbs/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca)"; flow:established,to_server; http.uri; content:"/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca"; startswith; fast_pattern; http.host; content:"office.parketthaus-badnauheim.sbs"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011066; classtype:social-engineering; sid:6011066; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (5e0979.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"5e0979.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011067; classtype:social-engineering; sid:6011067; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.365securitydevices.com/accountselectionpage/c)"; flow:established,to_server; http.uri; content:"/accountselectionpage/c"; startswith; fast_pattern; http.host; content:"www.365securitydevices.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011068; classtype:social-engineering; sid:6011068; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (9bxwv2tbfyc8dvdgng.vercel.app/hgfdkmhtbs35e4rhbgsadf)"; flow:established,to_server; http.uri; content:"/hgfdkmhtbs35e4rhbgsadf"; startswith; fast_pattern; http.host; content:"9bxwv2tbfyc8dvdgng.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011069; classtype:social-engineering; sid:6011069; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dondantyzip--elirdgz.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"dondantyzip--elirdgz.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011070; classtype:social-engineering; sid:6011070; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (company-rewards.org/?/mysso/SecureFederation/employeeID=aWVnTsQ)"; flow:established,to_server; http.uri; content:"/?/mysso/SecureFederation/employeeID=aWVnTsQ"; startswith; fast_pattern; http.host; content:"company-rewards.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011071; classtype:social-engineering; sid:6011071; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (backoffice.myvibe.co/march/help/META25/META25/us/)"; flow:established,to_server; http.uri; content:"/march/help/META25/META25/us/"; startswith; fast_pattern; http.host; content:"backoffice.myvibe.co"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011072; classtype:social-engineering; sid:6011072; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (307df8.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"307df8.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011073; classtype:social-engineering; sid:6011073; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (php-web-server--eduxsoporte.replit.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"php-web-server--eduxsoporte.replit.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011074; classtype:social-engineering; sid:6011074; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (telvora-gld-felqumi-r7t5dw47.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"telvora-gld-felqumi-r7t5dw47.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011075; classtype:social-engineering; sid:6011075; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ldgr-lv-app-in.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ldgr-lv-app-in.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011076; classtype:social-engineering; sid:6011076; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (pub-fc4e848664d24995973cae38a24c0ceb.r2.dev/Wi0n042HelpSaiErr0082/index.html)"; flow:established,to_server; http.uri; content:"/Wi0n042HelpSaiErr0082/index.html"; startswith; fast_pattern; http.host; content:"pub-fc4e848664d24995973cae38a24c0ceb.r2.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011077; classtype:social-engineering; sid:6011077; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kkkksgsgdfdjfdhhfdhlhdflhxkkkk-dpxklwputyu8.edgeone.dev/index.html)"; flow:established,to_server; http.uri; content:"/index.html"; startswith; fast_pattern; http.host; content:"kkkksgsgdfdjfdhhfdhlhdflhxkkkk-dpxklwputyu8.edgeone.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011078; classtype:social-engineering; sid:6011078; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bgrnd5ekqlopw-phvjn98plos-6c8d3a-pli5w.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"bgrnd5ekqlopw-phvjn98plos-6c8d3a-pli5w.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011079; classtype:social-engineering; sid:6011079; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (gwcu.us.org/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"gwcu.us.org"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011080; classtype:social-engineering; sid:6011080; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (joinyourrobux.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"joinyourrobux.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011081; classtype:social-engineering; sid:6011081; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (lxqzemwt.xyz/JacquelineJones/cfaa.html)"; flow:established,to_server; http.uri; content:"/JacquelineJones/cfaa.html"; startswith; fast_pattern; http.host; content:"lxqzemwt.xyz"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011082; classtype:social-engineering; sid:6011082; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qernora-gld-belxora-a5v9hp74.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qernora-gld-belxora-a5v9hp74.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011083; classtype:social-engineering; sid:6011083; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (verify.invitetracking.com/remote-auth/login?state===QP9ElZ5oUeRNkVD1UNVlmU1U1QNdkVDJlQWNkU0UVaSVTVD10RWNUT5V1UapnVzI2b4dkY2J1RNlXV5NmbjhVW3pUaPlWVXJGa10WSzl0QOhXS610dJRVTz0EROFza65UeRRlT6VFVNl2bql0asVEZ1Z1VhNnTtl0cJlmT4lEVNdXSE5kMRRlT5FFROJzZ65UeVRVTp9maJtGbFp1csdFZup0QMlGMyIma1knW1xmMhpmRtNGMWdEZwplbiBXNTVWbs12YsplbJZTSpJGcGdlY2JVbJdDcqlEMohlWpdXeOJTWE1kMBpXT3FkeORzYU1kNJl3YspEWhdHaYpVa3lWSYJlROdFcrFWeGhEVydmMOJTSXZFRSJTW6FESOhnSyMVTKBTV5hWbVpWOr10TkJzSwYESPRkUYFVUWtWU4dXVNpGaUFGWWV0UppVRVdkTwI1dsRkW4F1Mj9GdFJVd5UEVKlDMThmRzQ1VkpnVyF1VaBHer50Mjd0TVJUMaVEZyIVcktWYzETROxkSqRVVah0VClzUaRXMwQGdGRVZ0QzRjRnQsV1Voh0VvZUbJZTSTlFMGdkW4pkbJNXSTJmdO1GTuVzVhJnTXlVeShFTsJFWhJTNXFWavpWS1x2VZRXOHpVa3lWSyE1RPNTTt1kaopmTyUVbZRXSy00dFdFT1UEVNBDMD10aCRVW0lERaRTRX1keFRVTp9maJtGbXRWMKlXZ)"; flow:established,to_server; http.uri; content:"/remote-auth/login?state===QP9ElZ5oUeRNkVD1UNVlmU1U1QNdkVDJlQWNkU0UVaSVTVD10RWNUT5V1UapnVzI2b4dkY2J1RNlXV5NmbjhVW3pUaPlWVXJGa10WSzl0QOhXS610dJRVTz0EROFza65UeRRlT6VFVNl2bql0asVEZ1Z1VhNnTtl0cJlmT4lEVNdXSE5kMRRlT5FFROJzZ65UeVRVTp9maJtGbFp1csdFZup0QMlGMyIma1knW1xmMhpmRtNGMWdEZwplbiBXNTVWbs12YsplbJZTSpJGcGdlY2JVbJdDcqlEMohlWpdXeOJTWE1kMBpXT3FkeORzYU1kNJl3YspEWhdHaYpVa3lWSYJlROdFcrFWeGhEVydmMOJTSXZFRSJTW6FESOhnSyMVTKBTV5hWbVpWOr10TkJzSwYESPRkUYFVUWtWU4dXVNpGaUFGWWV0UppVRVdkTwI1dsRkW4F1Mj9GdFJVd5UEVKlDMThmRzQ1VkpnVyF1VaBHer50Mjd0TVJUMaVEZyIVcktWYzETROxkSqRVVah0VClzUaRXMwQGdGRVZ0QzRjRnQsV1Voh0VvZUbJZTSTlFMGdkW4pkbJNXSTJmdO1GTuVzVhJnTXlVeShFTsJFWhJTNXFWavpWS1x2VZRXOHpVa3lWSyE1RPNTTt1kaopmTyUVbZRXSy00dFdFT1UEVNBDMD10aCRVW0lERaRTRX1keFRVTp9maJtGbXRWMKlXZ"; startswith; fast_pattern; http.host; content:"verify.invitetracking.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011084; classtype:social-engineering; sid:6011084; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (dexter-1280.github.io/Amazon-clone/checkout.html)"; flow:established,to_server; http.uri; content:"/Amazon-clone/checkout.html"; startswith; fast_pattern; http.host; content:"dexter-1280.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011085; classtype:social-engineering; sid:6011085; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (121deo.senes.at/stakings/?b=YTo0OntzOjU6ImxhYmVsIjtzOjA6IiI7czozOiJ1c3IiO2k6MjUwO3M6NDoibm9wZCI7czoxMzoicnNzLnNheWxlci5hdCI7czoxOiJvIjtpOjExMzY7fQ==)"; flow:established,to_server; http.uri; content:"/stakings/?b=YTo0OntzOjU6ImxhYmVsIjtzOjA6IiI7czozOiJ1c3IiO2k6MjUwO3M6NDoibm9wZCI7czoxMzoicnNzLnNheWxlci5hdCI7czoxOiJvIjtpOjExMzY7fQ=="; startswith; fast_pattern; http.host; content:"121deo.senes.at"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011086; classtype:social-engineering; sid:6011086; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebooknlogin.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebooknlogin.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011087; classtype:social-engineering; sid:6011087; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (4h578rtq-h16.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"4h578rtq-h16.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011088; classtype:social-engineering; sid:6011088; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (1xbetbk1.com/promotions/goalless-football)"; flow:established,to_server; http.uri; content:"/promotions/goalless-football"; startswith; fast_pattern; http.host; content:"1xbetbk1.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011089; classtype:social-engineering; sid:6011089; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (express-zpedidos.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"express-zpedidos.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011090; classtype:social-engineering; sid:6011090; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (iforrhys-session-qarphegw-doc97w6vm---ldbaupeswc.kharwadejewellers.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"iforrhys-session-qarphegw-doc97w6vm---ldbaupeswc.kharwadejewellers.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011091; classtype:social-engineering; sid:6011091; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (beryl-bet365.com.cn/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"beryl-bet365.com.cn"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011092; classtype:social-engineering; sid:6011092; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sand1-bnb-bep20.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"sand1-bnb-bep20.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011093; classtype:social-engineering; sid:6011093; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (s3.us-east-2.amazonaws.com/landing-aerodonequipment.ca/ekjnbhrvjvnkrjnkm.html)"; flow:established,to_server; http.uri; content:"/landing-aerodonequipment.ca/ekjnbhrvjvnkrjnkm.html"; startswith; fast_pattern; http.host; content:"s3.us-east-2.amazonaws.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011094; classtype:social-engineering; sid:6011094; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (clqr.uk/wp-includes/theme-compat/cbayilq/kr/Krapp12.html)"; flow:established,to_server; http.uri; content:"/wp-includes/theme-compat/cbayilq/kr/Krapp12.html"; startswith; fast_pattern; http.host; content:"clqr.uk"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011095; classtype:social-engineering; sid:6011095; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (izedelivery-24h.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"izedelivery-24h.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011096; classtype:social-engineering; sid:6011096; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (b5e8b7.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"b5e8b7.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011097; classtype:social-engineering; sid:6011097; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ce2ed8.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ce2ed8.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011098; classtype:social-engineering; sid:6011098; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.cancelarsegurodecardiff360.vercel.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.cancelarsegurodecardiff360.vercel.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011099; classtype:social-engineering; sid:6011099; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.facebookxlogin.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.facebookxlogin.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011100; classtype:social-engineering; sid:6011100; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (apple-device.live/WXn)"; flow:established,to_server; http.uri; content:"/WXn"; startswith; fast_pattern; http.host; content:"apple-device.live"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011101; classtype:social-engineering; sid:6011101; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (thehelpinghanddebt.co.za/surex/sure.html?eta=nelorlab@4db2794ba18a04c549e522763a5864112abc.org)"; flow:established,to_server; http.uri; content:"/surex/sure.html?eta=nelorlab@4db2794ba18a04c549e522763a5864112abc.org"; startswith; fast_pattern; http.host; content:"thehelpinghanddebt.co.za"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011102; classtype:social-engineering; sid:6011102; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (qpd-6fwy-dj0u-qpxd-6br-8ms67.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"qpd-6fwy-dj0u-qpxd-6br-8ms67.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011103; classtype:social-engineering; sid:6011103; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (wtrkb523mjw-pfxmzrel-5i2h8g-yk611a.pages.dev/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"wtrkb523mjw-pfxmzrel-5i2h8g-yk611a.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011104; classtype:social-engineering; sid:6011104; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (ce295f.icefactory.cl/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"ce295f.icefactory.cl"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011105; classtype:social-engineering; sid:6011105; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (shopee-ltdaw.onrender.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"shopee-ltdaw.onrender.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011106; classtype:social-engineering; sid:6011106; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (url1924.medicardmalta.com/ls/click?upn=u001.wRZvbrXLvnjskRozsJol3kEPP5nBAWk4SHCrLwKF96tDReUPRazq2ZhXUXlMKA2ETWwmce8xwJNMvTN71XzYOZGOXYg24CSX5avcEHnUtAg-3Dku1o_p4A4YQt8epDIK9HlKea9sYxS1RRaeO1uPU4eCr6Zba-2FMHhaAWe2dFZoouVc-2BpKMKvNwtaGuPkA7tW28JsO6ecEJBcmMSjwFc-2FUOVwL7Asize6stR9-2FzxLs0X4mJrQvRpQD90BQSY2pxzarQb5ctiwBDMC3oq4pk-2BsYFhVC4HagsLjtTrP08k6K6RawDOqmYVFFPr80cu-2BREJyB7bbFZeYA-3D-3D)"; flow:established,to_server; http.uri; content:"/ls/click?upn=u001.wRZvbrXLvnjskRozsJol3kEPP5nBAWk4SHCrLwKF96tDReUPRazq2ZhXUXlMKA2ETWwmce8xwJNMvTN71XzYOZGOXYg24CSX5avcEHnUtAg-3Dku1o_p4A4YQt8epDIK9HlKea9sYxS1RRaeO1uPU4eCr6Zba-2FMHhaAWe2dFZoouVc-2BpKMKvNwtaGuPkA7tW28JsO6ecEJBcmMSjwFc-2FUOVwL7Asize6stR9-2FzxLs0X4mJrQvRpQD90BQSY2pxzarQb5ctiwBDMC3oq4pk-2BsYFhVC4HagsLjtTrP08k6K6RawDOqmYVFFPr80cu-2BREJyB7bbFZeYA-3D-3D"; startswith; fast_pattern; http.host; content:"url1924.medicardmalta.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011107; classtype:social-engineering; sid:6011107; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (bgo-t9-78.abscisses.ch/ga/click/2-17317519-22-14861-29107-16023-0b66adf3d6-a0796cfe5b)"; flow:established,to_server; http.uri; content:"/ga/click/2-17317519-22-14861-29107-16023-0b66adf3d6-a0796cfe5b"; startswith; fast_pattern; http.host; content:"bgo-t9-78.abscisses.ch"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011108; classtype:social-engineering; sid:6011108; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (kzptb6b20sk-xvqmrwur-3j2g4d-pm788a242.pages.dev/send_appeal_request)"; flow:established,to_server; http.uri; content:"/send_appeal_request"; startswith; fast_pattern; http.host; content:"kzptb6b20sk-xvqmrwur-3j2g4d-pm788a242.pages.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011109; classtype:social-engineering; sid:6011109; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (www.zerobot043-wqam.blogspot.com/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"www.zerobot043-wqam.blogspot.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011110; classtype:social-engineering; sid:6011110; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (taiwoaden.github.io/Netflix-Nigeria-Clone/signin.html)"; flow:established,to_server; http.uri; content:"/Netflix-Nigeria-Clone/signin.html"; startswith; fast_pattern; http.host; content:"taiwoaden.github.io"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011111; classtype:social-engineering; sid:6011111; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (midasbuy-official-topup.shop/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"midasbuy-official-topup.shop"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011112; classtype:social-engineering; sid:6011112; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (fix.walletvalidator.app/)"; flow:established,to_server; http.uri; content:"/"; startswith; fast_pattern; http.host; content:"fix.walletvalidator.app"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6011113; classtype:social-engineering; sid:6011113; rev:1; metadata: signature_severity Major, created_et 2026_08_18;) alert http $HOME_NET any -> any any (msg:"AT related malicious URL (17.rewardinglocker.com/aboutyou-v7.php?version=v7)"; flow:established,to_server; http.uri; content:"/aboutyou-v7.php?version=v7"; startswith; fast_pattern; http.host; content:"17.rewardinglocker.com"; end