""ET CURRENT_EVENTS W3LL STORE Credential Phish Landing Page (Success) 2023-05-05""

SID: 2045610

Revision: 2

Class Type: trojan-activity

Metadata: created_at 2023_05_05, updated_at 2023_05_05

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow:

Contents:

• Value: "|3c|div|20|style|3d 22|border|2d|radius|3a|200px|3b 20|height|3a|200px|3b 20|width|3a|200px|3b 20|background|3a 20 23|F8FAF5|3b 20|margin|3a|0|20|auto|3b 22 3e|"

• Value: "|3c|i|20|class|3d 22|checkmark|22 3e e2 9c 93 3c 2f|i|3e|"

• Value: "

  Success

  "

• Value: "

  
  Successfully confirmed
  Redirecting to Document...

  "

• Value: "setTimeout(function()"

• Value: "setTimeout(function()"

• Value: "document|2e|getElementById|28 27|autoclick|27 29 2e|click|28 29 3b|"

Within:

PCRE:

Special Options:

• file_data

source