Phishing Redirect Cloaking - UA-Conditional JavaScript Redirect in HTTP Response

Duo Tech@duotech

•updated Jul 1, 2026•0•0•1

This rule detects potential phishing or cloaking activity where a web server response contains JavaScript logic that checks the visitor's User-Agent string using 'navigator.userAgent' and conditionally redirects the user via 'window.location'. This technique is commonly used to redirect specific targets (e.g., mobile devices or specific browsers) to malicious sites while serving benign content to others, often for credential harvesting or malware delivery.