SourTrade cloaking - referral to lookalike crypto/trading brand domain
Detects a multi-stage network activity pattern characteristic of 'SourTrade' cloaking. The rule tracks an initial HTTP request with a referral to a known lookalike crypto/trading domain, followed by the fetching of a client-side JavaScript fingerprinting script, and finally, a subsequent HTTP response that appears to be a near-empty decoy page (used to mask malicious content from crawlers).
Suricata
