AT related malicious URL (login-microsoft-online.no-reply-highflyer-awardco-com.workers.dev/federated/aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU_Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM5MjMzMzQzNjE3MzM1OTkyLk1XUTVZVFl5WlRRdE5qTTVZeTAwTnpRMkxXRTFOVGN0TkRFd01XTTJNV00wTUdRd1l6WTVZVGs1TkRndFpUSmpNUzAwT0RJMkxUaGxaRE10WW1aaVpUUmxabUpoTVdSaSZ1aV9sb2NhbGVzPWVuLUNBJm1rdD1lbi1DQSZjbGllbnQtcmVxdWVzdC1pZD1kOTA1MzQxNS02ZjZjLTRjZGQtODJiNi01ZmY2OWFhMmVjZGImc2l3YT0xJnNpd2c9MSZzdGF0ZT1OYjFvSHJrYlZGT3F5Z3ZySkVHU3Nja3A2eTJYVEFYRUxKOVhBY3V1dF9UYWZOUHl6STJhWks5eGoxa0NfQjhaSTU3R01QQzc0TUJmSXZpWVdyaFNCdHRTaXY1eXJtQmpuVVFpSjNkMmtvR1M1Z1ZyMVl6VkhlMlFyVDlVRkFfTldmUHI3M2M2bkFwWUdUOGtvcnVMbF94UUxZWmlCazh5UFRKbzQ2UDZfUUwtNy1pTC1QOER6SnhYeUtWWV9OM182SFBEUEhxc3BrdmdKbzZGc0o5OFJpS2Y0Ty1SRURNcU8wcVNidnA1RE5aLUZMaGpkMWZyOU5ESkQ4dWdzbW95NTBkc2RISUh4NUxqbTFFbWktdzRuUnlGOTNGTHBGZi1YeDJ2dElEWDFubE1lSkJhVk4xcFdQVlp5Y012QnpzMGxvMjRFOGp4N05OYmZMS0tYUTFYTkVYQjF4anpnUjZxaVZGZVV0anhwMUg0M0FDejNRX3JKX3YtSHhyeWlqcU1HQ1A2cDhMaHNxQXpNSEZCcFE1S0otQldqV0dZQTBTdVQ2V1dsYVNFdkJGanBPU1VFN3dmRUlKaDBJbjRaTFlpJngtY2xpZW50LVNLVT1JRF9ORVQ4XzAmeC1jbGllbnQtdmVyPTguMTYuMC4w)

SID: 6013981Rev: 1EnabledDerived0 views
History
Fileantiphishing.rules
CreatedAugust 27, 2026
UpdatedAugust 27, 2026
Classificationsocial-engineering
alert http $HOME_NET any -> any any (msg:"AT related malicious URL (login-microsoft-online.no-reply-highflyer-awardco-com.workers.dev/federated/aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU_Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM5MjMzMzQzNjE3MzM1OTkyLk1XUTVZVFl5WlRRdE5qTTVZeTAwTnpRMkxXRTFOVGN0TkRFd01XTTJNV00wTUdRd1l6WTVZVGs1TkRndFpUSmpNUzAwT0RJMkxUaGxaRE10WW1aaVpUUmxabUpoTVdSaSZ1aV9sb2NhbGVzPWVuLUNBJm1rdD1lbi1DQSZjbGllbnQtcmVxdWVzdC1pZD1kOTA1MzQxNS02ZjZjLTRjZGQtODJiNi01ZmY2OWFhMmVjZGImc2l3YT0xJnNpd2c9MSZzdGF0ZT1OYjFvSHJrYlZGT3F5Z3ZySkVHU3Nja3A2eTJYVEFYRUxKOVhBY3V1dF9UYWZOUHl6STJhWks5eGoxa0NfQjhaSTU3R01QQzc0TUJmSXZpWVdyaFNCdHRTaXY1eXJtQmpuVVFpSjNkMmtvR1M1Z1ZyMVl6VkhlMlFyVDlVRkFfTldmUHI3M2M2bkFwWUdUOGtvcnVMbF94UUxZWmlCazh5UFRKbzQ2UDZfUUwtNy1pTC1QOER6SnhYeUtWWV9OM182SFBEUEhxc3BrdmdKbzZGc0o5OFJpS2Y0Ty1SRURNcU8wcVNidnA1RE5aLUZMaGpkMWZyOU5ESkQ4dWdzbW95NTBkc2RISUh4NUxqbTFFbWktdzRuUnlGOTNGTHBGZi1YeDJ2dElEWDFubE1lSkJhVk4xcFdQVlp5Y012QnpzMGxvMjRFOGp4N05OYmZMS0tYUTFYTkVYQjF4anpnUjZxaVZGZVV0anhwMUg0M0FDejNRX3JKX3YtSHhyeWlqcU1HQ1A2cDhMaHNxQXpNSEZCcFE1S0otQldqV0dZQTBTdVQ2V1dsYVNFdkJGanBPU1VFN3dmRUlKaDBJbjRaTFlpJngtY2xpZW50LVNLVT1JRF9ORVQ4XzAmeC1jbGllbnQtdmVyPTguMTYuMC4w)"; flow:established,to_server; http.uri; content:"/federated/aHR0cHM6Ly9sb2dpbi5taWNyb3NvZnRvbmxpbmUuY29tL2NvbW1vbi9vYXV0aDIvdjIuMC9hdXRob3JpemU_Y2xpZW50X2lkPTQ3NjU0NDViLTMyYzYtNDliMC04M2U2LTFkOTM3NjUyNzZjYSZyZWRpcmVjdF91cmk9aHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRmxhbmRpbmd2MiZyZXNwb25zZV90eXBlPWNvZGUlMjBpZF90b2tlbiZzY29wZT1vcGVuaWQlMjBwcm9maWxlJTIwaHR0cHMlM0ElMkYlMkZ3d3cub2ZmaWNlLmNvbSUyRnYyJTJGT2ZmaWNlSG9tZS5BbGwmcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3Qmbm9uY2U9NjM5MjMzMzQzNjE3MzM1OTkyLk1XUTVZVFl5WlRRdE5qTTVZeTAwTnpRMkxXRTFOVGN0TkRFd01XTTJNV00wTUdRd1l6WTVZVGs1TkRndFpUSmpNUzAwT0RJMkxUaGxaRE10WW1aaVpUUmxabUpoTVdSaSZ1aV9sb2NhbGVzPWVuLUNBJm1rdD1lbi1DQSZjbGllbnQtcmVxdWVzdC1pZD1kOTA1MzQxNS02ZjZjLTRjZGQtODJiNi01ZmY2OWFhMmVjZGImc2l3YT0xJnNpd2c9MSZzdGF0ZT1OYjFvSHJrYlZGT3F5Z3ZySkVHU3Nja3A2eTJYVEFYRUxKOVhBY3V1dF9UYWZOUHl6STJhWks5eGoxa0NfQjhaSTU3R01QQzc0TUJmSXZpWVdyaFNCdHRTaXY1eXJtQmpuVVFpSjNkMmtvR1M1Z1ZyMVl6VkhlMlFyVDlVRkFfTldmUHI3M2M2bkFwWUdUOGtvcnVMbF94UUxZWmlCazh5UFRKbzQ2UDZfUUwtNy1pTC1QOER6SnhYeUtWWV9OM182SFBEUEhxc3BrdmdKbzZGc0o5OFJpS2Y0Ty1SRURNcU8wcVNidnA1RE5aLUZMaGpkMWZyOU5ESkQ4dWdzbW95NTBkc2RISUh4NUxqbTFFbWktdzRuUnlGOTNGTHBGZi1YeDJ2dElEWDFubE1lSkJhVk4xcFdQVlp5Y012QnpzMGxvMjRFOGp4N05OYmZMS0tYUTFYTkVYQjF4anpnUjZxaVZGZVV0anhwMUg0M0FDejNRX3JKX3YtSHhyeWlqcU1HQ1A2cDhMaHNxQXpNSEZCcFE1S0otQldqV0dZQTBTdVQ2V1dsYVNFdkJGanBPU1VFN3dmRUlKaDBJbjRaTFlpJngtY2xpZW50LVNLVT1JRF9ORVQ4XzAmeC1jbGllbnQtdmVyPTguMTYuMC4w"; startswith; fast_pattern; http.host; content:"login-microsoft-online.no-reply-highflyer-awardco-com.workers.dev"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6013981; classtype:social-engineering; sid:6013981; rev:1; metadata:signature_severity Major, created_et 2026_08_26;)

References

urlopenphish.com
urljulioliraup.github.io/AT/signature.html?sid=6013981

Metadata

signature severityMajor
created et2026_08_26

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!