Stealth Falcon CURP Campaign - TLS SNI to typosquatted gobf.mx RENAPO phishing domain
This rule detects network activity associated with a phishing campaign impersonating the RENAPO CURP lookup service. It monitors for TLS SNI and HTTP Host headers containing the typosquatted domain 'gobf.mx', as well as HTTP responses containing specific keywords related to the Mexican CURP registration form originating from this domain.
Suricata
