alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET PHISHING GhostFrame Phish Server Checkin M1"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"pre_super_server.php"; fast_pattern; reference:url,blog.barracuda.com/2025/12/04/threat-spotlight-ghostframe-phishing-kit; classtype:social-engineering; sid:2066595; rev:1; metadata:created_at 2026_01_06, signature_severity Unknown, updated_at 2026_01_06;)