Reverse Proxy Phishing Page Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects potential reverse proxy phishing pages by looking for HTTP URI requests that contain the keywords 'verify', 'account', and 'secure' (case-insensitive). The presence of these keywords in the URI of an HTTP request, particularly when combined, can indicate an attempt to mimic legitimate login or account verification pages, often used in phishing attacks.