alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING France Ministry of Action and Public Accounts Phish Landing"; flow:established,from_server; http.stat_code; content:"200"; file.data; content:"cardcc|27 29|.mask|28 20 22|9999"; fast_pattern; content:"<title>Remboursement<|2f|title>"; distance:0; content:"id=|22|impotsgouv|22|"; distance:0; classtype:social-engineering; sid:2027680; rev:2; metadata:attack_target Client_Endpoint, created_at 2019_07_04, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Major, tag Phish, updated_at 2020_08_31;)