ET PHISHING Cloudflare Captcha JS 2025-07-15
Sourceet/open
CreatedJuly 16, 2025
UpdatedJuly 16, 2025
Classificationsocial-engineering
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Cloudflare Captcha JS 2025-07-15"; flow:established,to_client; http.stat_code; content:"200"; http.response_body; content:"<html"; distance:0; content:"<head>"; distance:0; pcre:"/<title>[a-zA-Z]{3,20}<\x2ftitle>/i"; content:"<script src=\"https://challenges.cloudflare.com/turnstile/v0/api.js\"></script>"; distance:0; content:"</head>"; distance:0; content:"<body>"; distance:0; content:"<div class=\"container mt-5\">"; distance:0; content:"<div class=\"centered-content\">"; distance:0; content:"<div class=\"col-lg-5 text-center\">"; distance:0; content:"<div class=\"mt-2\">"; distance:0; content:"<form method=\"POST\">"; distance:0; content:"<span class=\"cf-turnstile\" data-sitekey="; distance:0; content:"</form>"; distance:0; content:"<div class=\"mt-2 text-muted\""; distance:0; content:"<script>"; distance:0; content:"function"; distance:0; content:"document.forms[0].submit()"; fast_pattern; distance:0; content:"</script>"; distance:0; content:"</body>"; distance:0; content:"</html>"; distance:0; reference:url,t7f4e9n3.delivery.rocketcdn.me/wp-content/uploads/2025/06/Sekoia_io___Global_analysis_of_Adversary_in_the_Middle_phishing_threats.pdf; classtype:social-engineering; sid:2063535; rev:1; metadata:attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2025_07_16, deployment Perimeter, deployment SSLDecrypt, performance_impact Moderate, confidence Medium, signature_severity Major, tag Phishing, tag ODx, tag Storm_1167, updated_at 2025_07_16, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;)
Metadata
Comments (0)
Please sign in to leave a comment.
Sign inNo comments yet. Be the first to comment!