alert http $HOME_NET any -> any any (msg:"ET PHISHING TA446 PHP Redirect"; flow:established,to_server; http.uri; content:".php?"; content:"utm_refferer|3d|"; fast_pattern; http.method; content:"GET"; reference:url,blog.sekoia.io/ngo-reporters-without-borders-targeted-by-calisto-in-recent-campaign/; classtype:credential-theft; sid:2066323; rev:1; metadata:attack_target Client_Endpoint, created_at 2025_12_15, deployment Perimeter, confidence High, signature_severity Major, tag TA446, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_12_15;)