alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO PhishingBox Landing Page - Phishing Simulation"; flow:established,to_client; http.response_body; content:"|24 2e|phishingKey|20 3d 20 27|"; fast_pattern; content:"|27 3b 0d 0a|"; distance:40; within:4; content:"|24 2e|URL|20 3d 20 27 2f|"; within:100; threshold:type limit, count 1, seconds 3600, track by_src; reference:url,urlscan.io/result/c35d9882-7324-40ed-a1cd-c89d20c943f6/; classtype:not-suspicious; sid:2047993; rev:1; metadata:attack_target Client_Endpoint, created_at 2023_09_11, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Informational, tag Phishing_Simulation, updated_at 2023_09_11;)