Phantom Deal - repeated manual access to fraud tracking/canary token link from rotating VPN/proxy sources over extended period
Detects high-frequency, repeated access to a specific fraud-tracking or canary token link by sources utilizing rotating VPNs or proxies over an extended period. This behavior is indicative of automated probing or credential validation attempts associated with the Phantom Deal campaign.
Suricata
