Phishing Link Using URL Shortener Redirect
This rule detects HTTP traffic where the URI contains common URL shortener domains (bit.ly, tinyurl, t.co, ow.ly, is.gd) and also contains the string "login" (case-insensitive). This combination is often indicative of phishing attempts that use URL shorteners to obscure malicious links, leading users to fake login pages.
Suricata
