alert http $HOME_NET any -> $EXTERNAL_NET 80 (msg:"🐾 - 🌐 Possible GET request to 🅿 parked domain"; requires:version >= 8; flow:to_server, stateless; flowbits:isset,pptrls.malprkeddom; http.method; content:"get"; http.uri; content:"|2f 3f 63 68 3d|"; content:"|26 6a 73|"; content:"|5f 6c 67 26 73 69 64 3d|"; reference:url,https://krebsonsecurity.com/2025/12/most-parked-domains-now-serving-malicious-content/; target:src_ip; metadata:attack_target Client_Endpoint, created_at 2025_12_19, updated_at 2025_12_19; sid:3321477; rev:1; classtype:bad-unknown; noalert;)