alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING Anonisma Paypal Phishing Uri Structure 2015-12-29"; flow:to_server,established; http.uri; content:".php?cmd=_"; nocase; fast_pattern; content:"account_limited="; distance:0; nocase; content:"&session="; nocase; distance:0; pcre:"/=[a-f0-9]{32}&session=[a-f0-9]{40}$/i"; classtype:social-engineering; sid:2031861; rev:6; metadata:attack_target Client_Endpoint, created_at 2015_12_29, deployment Perimeter, confidence Medium, signature_severity Major, tag Phishing, updated_at 2020_08_31;)