Generic Credential Phishing Page Served to User
This rule detects potential credential phishing pages served to a user over HTTP. It looks for HTTP responses containing both "Enter your password" and "Sign in" (case-insensitive) in the file data, and where the HTTP host is an IP address rather than a domain name. This combination of indicators suggests a generic phishing attempt designed to trick users into providing their credentials.
Suricata
