AT related malicious URL (sadxq.shkul.com/DHX5gHumBjuUprgB?q=Y2xpZW50LXJlcXVlc3QtaWQ9Y2RkMjUyN2QtMjI3OS00NTJjLWI3M2EtNzBiNTJhMmNiNzQ0JmNsaWVudF9pZD00NzY1NDQ1Yi0zMmM2LTQ5YjAtODNlNi0xZDkzNzY1Mjc2Y2EmbWt0PWVuLVVTJm5vbmNlPTYzOTE3OTMzNjQ2OTk0MDgxNi5NbU5oWW1NeVpEY3RZakpoTkMwMFptRm1MVGc1WmpndE16VXdNVEJrWkdabU16TmhaamhoTm1NeE1tUXRNMkZoTnkwME5qVXhMV0ZsTkdVdFpUYzFNbVptT1RBeVpXSmgmcmVkaXJlY3RfdXJpPWh0dHBzJTNBJTJGJTJGd3d3Lm9mZmljZS5jb20lMkZsYW5kaW5ndjImcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3QmcmVzcG9uc2VfdHlwZT1jb2RlK2lkX3Rva2VuJnNjb3BlPW9wZW5pZCtwcm9maWxlK2h0dHBzJTNBJTJGJTJGd3d3Lm9mZmljZS5jb20lMkZ2MiUyRk9mZmljZUhvbWUuQWxsJnN0YXRlPU1fNGpnV1JBY1NBY3VxOHBRQi16R3oyMktxaEVSdWVMdjExR0ZfSHVMcHd4Yl9wbFoyZDlUNjRndTdkOGdfUG01Q01qdXFrNGllVllhR1E4Rk5GZ2lUUVJrOVVNUG54YUZTTEdxQzY3UWhCQWs1a19taktkVS1JMmMzYmxHRnB6Nkc5YWdwMzlqTTJqMTBua0wxX0tNV3duZzk2MDhEZlkwX3VfTjFoaEJuWlY5UllsSzBTZ18xaFVBUVdITkwyX01mbUtfTWVCLVJKbmVaaWJJLVFmam1JX1Q1eU1ZM1VBdUNiLWhVRkMxcUpxdkViLXVmLUtzS05UdFVMUEFjZVZ1ZkNqd3U4MXppSFhyMS1iV3RkNEJlVWZXQ28xNjAxRW9LbjRiUTdoYVg3NUxkTGxhMmhnXzZxSmpEZzdKbFlUSHhUdEp5V1ZlckNpVHdnQVIzZnlnRVo3SG5hRVFJQnNiQ1VqUDhtT21ROUFybEtITGc0ZHhvand1eGJOc2NFZWdwV3Z5Mm9CMG5FQ3I3S2licE9ROTVqdnZxajRTU05VbXExQTZaU2hEMTgmdWlfbG9jYWxlcz1lbi1VUyZ4LWNsaWVudC1TS1U9SURfTkVUOF8wJngtY2xpZW50LXZlcj04LjE0LjAuMA%3D%3D)

SID: 6015551Rev: 1EnabledDerived3 views
History
Fileantiphishing.rules
CreatedJune 25, 2026
UpdatedJune 25, 2026
Classificationsocial-engineering
alert http $HOME_NET any -> any any (msg:"AT related malicious URL (sadxq.shkul.com/DHX5gHumBjuUprgB?q=Y2xpZW50LXJlcXVlc3QtaWQ9Y2RkMjUyN2QtMjI3OS00NTJjLWI3M2EtNzBiNTJhMmNiNzQ0JmNsaWVudF9pZD00NzY1NDQ1Yi0zMmM2LTQ5YjAtODNlNi0xZDkzNzY1Mjc2Y2EmbWt0PWVuLVVTJm5vbmNlPTYzOTE3OTMzNjQ2OTk0MDgxNi5NbU5oWW1NeVpEY3RZakpoTkMwMFptRm1MVGc1WmpndE16VXdNVEJrWkdabU16TmhaamhoTm1NeE1tUXRNMkZoTnkwME5qVXhMV0ZsTkdVdFpUYzFNbVptT1RBeVpXSmgmcmVkaXJlY3RfdXJpPWh0dHBzJTNBJTJGJTJGd3d3Lm9mZmljZS5jb20lMkZsYW5kaW5ndjImcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3QmcmVzcG9uc2VfdHlwZT1jb2RlK2lkX3Rva2VuJnNjb3BlPW9wZW5pZCtwcm9maWxlK2h0dHBzJTNBJTJGJTJGd3d3Lm9mZmljZS5jb20lMkZ2MiUyRk9mZmljZUhvbWUuQWxsJnN0YXRlPU1fNGpnV1JBY1NBY3VxOHBRQi16R3oyMktxaEVSdWVMdjExR0ZfSHVMcHd4Yl9wbFoyZDlUNjRndTdkOGdfUG01Q01qdXFrNGllVllhR1E4Rk5GZ2lUUVJrOVVNUG54YUZTTEdxQzY3UWhCQWs1a19taktkVS1JMmMzYmxHRnB6Nkc5YWdwMzlqTTJqMTBua0wxX0tNV3duZzk2MDhEZlkwX3VfTjFoaEJuWlY5UllsSzBTZ18xaFVBUVdITkwyX01mbUtfTWVCLVJKbmVaaWJJLVFmam1JX1Q1eU1ZM1VBdUNiLWhVRkMxcUpxdkViLXVmLUtzS05UdFVMUEFjZVZ1ZkNqd3U4MXppSFhyMS1iV3RkNEJlVWZXQ28xNjAxRW9LbjRiUTdoYVg3NUxkTGxhMmhnXzZxSmpEZzdKbFlUSHhUdEp5V1ZlckNpVHdnQVIzZnlnRVo3SG5hRVFJQnNiQ1VqUDhtT21ROUFybEtITGc0ZHhvand1eGJOc2NFZWdwV3Z5Mm9CMG5FQ3I3S2licE9ROTVqdnZxajRTU05VbXExQTZaU2hEMTgmdWlfbG9jYWxlcz1lbi1VUyZ4LWNsaWVudC1TS1U9SURfTkVUOF8wJngtY2xpZW50LXZlcj04LjE0LjAuMA%3D%3D)"; flow:established,to_server; http.uri; content:"/DHX5gHumBjuUprgB?q=Y2xpZW50LXJlcXVlc3QtaWQ9Y2RkMjUyN2QtMjI3OS00NTJjLWI3M2EtNzBiNTJhMmNiNzQ0JmNsaWVudF9pZD00NzY1NDQ1Yi0zMmM2LTQ5YjAtODNlNi0xZDkzNzY1Mjc2Y2EmbWt0PWVuLVVTJm5vbmNlPTYzOTE3OTMzNjQ2OTk0MDgxNi5NbU5oWW1NeVpEY3RZakpoTkMwMFptRm1MVGc1WmpndE16VXdNVEJrWkdabU16TmhaamhoTm1NeE1tUXRNMkZoTnkwME5qVXhMV0ZsTkdVdFpUYzFNbVptT1RBeVpXSmgmcmVkaXJlY3RfdXJpPWh0dHBzJTNBJTJGJTJGd3d3Lm9mZmljZS5jb20lMkZsYW5kaW5ndjImcmVzcG9uc2VfbW9kZT1mb3JtX3Bvc3QmcmVzcG9uc2VfdHlwZT1jb2RlK2lkX3Rva2VuJnNjb3BlPW9wZW5pZCtwcm9maWxlK2h0dHBzJTNBJTJGJTJGd3d3Lm9mZmljZS5jb20lMkZ2MiUyRk9mZmljZUhvbWUuQWxsJnN0YXRlPU1fNGpnV1JBY1NBY3VxOHBRQi16R3oyMktxaEVSdWVMdjExR0ZfSHVMcHd4Yl9wbFoyZDlUNjRndTdkOGdfUG01Q01qdXFrNGllVllhR1E4Rk5GZ2lUUVJrOVVNUG54YUZTTEdxQzY3UWhCQWs1a19taktkVS1JMmMzYmxHRnB6Nkc5YWdwMzlqTTJqMTBua0wxX0tNV3duZzk2MDhEZlkwX3VfTjFoaEJuWlY5UllsSzBTZ18xaFVBUVdITkwyX01mbUtfTWVCLVJKbmVaaWJJLVFmam1JX1Q1eU1ZM1VBdUNiLWhVRkMxcUpxdkViLXVmLUtzS05UdFVMUEFjZVZ1ZkNqd3U4MXppSFhyMS1iV3RkNEJlVWZXQ28xNjAxRW9LbjRiUTdoYVg3NUxkTGxhMmhnXzZxSmpEZzdKbFlUSHhUdEp5V1ZlckNpVHdnQVIzZnlnRVo3SG5hRVFJQnNiQ1VqUDhtT21ROUFybEtITGc0ZHhvand1eGJOc2NFZWdwV3Z5Mm9CMG5FQ3I3S2licE9ROTVqdnZxajRTU05VbXExQTZaU2hEMTgmdWlfbG9jYWxlcz1lbi1VUyZ4LWNsaWVudC1TS1U9SURfTkVUOF8wJngtY2xpZW50LXZlcj04LjE0LjAuMA%3D%3D"; startswith; fast_pattern; http.host; content:"sadxq.shkul.com"; endswith; reference:url,openphish.com; reference:url,julioliraup.github.io/AT/signature.html?sid=6015551; classtype:social-engineering; sid:6015551; rev:1; metadata:signature_severity Major, created_et 2026_06_25, updated_et 2026_06_25;)

References

urlopenphish.com
urljulioliraup.github.io/AT/signature.html?sid=6015551

Metadata

signature severityMajor
created et2026_06_25
updated et2026_06_25

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!