Legal Threat Phishing DNS Lookup for Credential-Harvest Domain chongdaotang.net
This rule monitors DNS traffic for queries to the domain 'chongdaotang.net', which is associated with a phishing campaign leveraging legal threat lures to harvest credentials. Detecting these queries indicates that a host in the network is attempting to resolve a domain used in a known credential harvesting attack.
Suricata
