AT related malicious URL (metalrisrl.musvc3.net/e/tr?amp\;mupckp=mupAtu4m8OiX0wt&q=4=SaOSU%2526E=F%2526E=NTJ%2526F=MTFVMb%25260=9FM5J_Dthq_Od_7ros_Gg_Dthq_Niq6DB20EL4.4AF_7ros_Gg94r95Gp_Imve_Sb%25267=2LEOrT.089%25260E=UOaO%2526M2w4p8=SVUKaQULaMcHVQ%2526A=KZyYKYw6sZy9rR26pTTTG5M6HWVZs4w4r629I2PTKTxar3QcH21WtZyaHXN8NayW)

SID: 6008968Rev: 1EnabledDerived2 viewsHistory

Fileantiphishing.rules

CreatedMay 29, 2026

UpdatedJune 25, 2026

Classificationsocial-engineering

alert http $HOME_NET any -> any any (msg:"AT related malicious URL (metalrisrl.musvc3.net/e/tr?amp\;mupckp=mupAtu4m8OiX0wt&q=4=SaOSU%2526E=F%2526E=NTJ%2526F=MTFVMb%25260=9FM5J_Dthq_Od_7ros_Gg_Dthq_Niq6DB20EL4.4AF_7ros_Gg94r95Gp_Imve_Sb%25267=2LEOrT.089%25260E=UOaO%2526M2w4p8=SVUKaQULaMcHVQ%2526A=KZyYKYw6sZy9rR26pTTTG5M6HWVZs4w4r629I2PTKTxar3QcH21WtZyaHXN8NayW)"; flow:established,to_server; http.uri; content:"/e/tr?amp|3b|mupckp=mupAtu4m8OiX0wt&q=4=SaOSU%2526E=F%2526E=NTJ%2526F=MTFVMb%25260=9FM5J_Dthq_Od_7ros_Gg_Dthq_Niq6DB20EL4.4AF_7ros_Gg94r95Gp_Imve_Sb%25267=2LEOrT.089%25260E=UOaO%2526M2w4p8=SVUKaQULaMcHVQ%2526A=KZyYKYw6sZy9rR26pTTTG5M6HWVZs4w4r629I2PTKTxar3QcH21WtZyaHXN8NayW"; startswith; fast_pattern; http.host; content:"metalrisrl.musvc3.net"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6008968; classtype:social-engineering; sid:6008968; rev:1; metadata:signature_severity Major, created_et 2026_05_29, updated_et 2026_06_25;)

References

url	openphish.com
url	julioliraup.github.io/AT/signature.html?sid=6008968

References

Metadata

Comments (0)