Phishing Link Target Page with Credential Form
This rule detects HTTP responses that appear to be phishing pages designed to capture credentials. It specifically looks for HTTP traffic flowing to the client that contains both the words "password" and "submit" (case-insensitive) in the file data, and where the HTTP host is an IP address. This combination suggests a credential input form on a page served from an IP address, which is a common characteristic of phishing attempts.
Suricata
