alert http $EXTERNAL_NET 80 -> any any (msg:"🐾 - 🚨 Possible malicious Web 🌐 redirection from 🅿 parked domain"; requires:version >= 8; flow:to_client, stateless; flowbits:set,pptrls.malprkeddom; flowbits:isnotset,pptrls.malprkeddom; content:"|52 65 64 69 72 65 63 74 69 6e 67|"; http.location; content:"http"; startswith; http.server; content:"nginx"; http.stat_code; content:"302"; reference:url,https://krebsonsecurity.com/2025/12/most-parked-domains-now-serving-malicious-content/; target:dest_ip; metadata:attack_target Client_Endpoint, created_at 2025_12_19, updated_at 2025_12_19; sid:3321476; rev:5; classtype:bad-unknown;)