alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Account Credential Phish Landing Page 2022-10-10"; flow:established; http.stat_code; content:"200"; file.data; content:"<title>Banco de Cr|c3 a9|dito BCP</title>"; fast_pattern; content:"<meta name|3d 22|viewport|22 20 63 6f 6e 74 65 6e 74 3d 22|user-scalable=no,initial-scale=1,maximum-scale=1,minimum-scale=1,width=device-width,height=device-height|22|>"; distance:0; content:"<meta|20|name|3d 22|theme-color|22 20|content|3d 22 23|002D87|22|>"; distance:0; content:"<meta name|3d 22|apple-mobile-web-app-status-bar-style|22 20|content|3d 22|black-translucent|22|>"; content:"<div class=|22|login-img columna"; content:"<form class|3d 22|form-group login-container-col-form-wrapper container ng-untouched ng-invalid ng-dirty|22 20|method|3d 22|post|22|>"; content:"<!-- Google Tag Manager --><!-- End Google Tag Manager -->"; classtype:social-engineering; sid:2039134; rev:2; metadata:attack_target Client_Endpoint, created_at 2022_10_10, deployment Perimeter, deployment SSLDecrypt, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_08_29, reviewed_at 2023_08_29;)