AiTM panel infrastructure IP 31.42.184.213 contacted pre-auth

Arnold Chan@slaz

•updated Sep 8, 2026•1•0•8

This rule monitors network connections, DNS resolutions, and email URLs to detect traffic communicating with a known adversary-in-the-middle (AiTM) phishing infrastructure panel. By correlating security logs, DNS events, and email URL data against this specific indicator of compromise, it identifies potential interaction with phishing sites designed to capture credentials or session tokens.