Montana Empire Phantom Domain Phishing Panel Response to Internal Client

Duo Tech@duotech

•updated Jul 1, 2026•0•0•0

Detects HTTP response bodies containing specific strings associated with the 'Montana Empire' phishing kit. This rule monitors for indicators that a web server is serving a phishing credential harvesting page.