Phantom Domain Phishing Kit Credential Harvest via POST to login.php/result.php
This rule detects HTTP POST requests containing common credential field names directed at files ending in .php (such as login.php, result.php, or index.php), which is highly characteristic of phishing kits used to harvest credentials.
Suricata
