alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING TA2730 Javascript Request 2026-08-06"; flow:established,to_client; http.stat_code; content:"200"; http.content_len; byte_test:0,<=,450000,0,string,dec; http.response_body; content:"const"; startswith; content:"parseInt"; content:".push"; content:".shift"; content:"apiUrl"; fast_pattern; content:"siteName"; content:"new Proxy"; content:"config.js"; reference:url,urlscan.io/result/019fce1f-287e-7272-a0ec-e952047e373b/#transactions; classtype:social-engineering; sid:2071416; rev:1; metadata:attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_08_07, deployment Perimeter, deployment SSLDecrypt, performance_impact Moderate, confidence Medium, signature_severity Major, tag Phishing, tag TA2730, updated_at 2026_08_07; target:dest_ip;)