alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET DELETED Successful Revalidation Phish Nov 13 M2"; flow:established,from_server; content:"200"; http_stat_code; file_data; content:"<META HTTP-EQUIV=|22|REFRESH|22|"; nocase; content:"Revalidation</title>"; fast_pattern; nocase; distance:0; content:"Account Revalidated"; nocase; distance:0; content:"you have sucessfully revalidated"; nocase; distance:0; classtype:credential-theft; sid:2022085; rev:3; metadata:created_at 2015_11_13, signature_severity Unknown, updated_at 2019_07_26;)