Social Media Phishing Redirect to Credential Page

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects HTTP traffic where the HTTP referer header indicates a social media platform (LinkedIn, Twitter, Facebook, Instagram) and the HTTP URI contains the string 'login'. This combination suggests a potential social media phishing attempt, where a user is redirected from a legitimate social media site to a credential harvesting page.