[CISCO-SCA] Suspected Phishing Domain

alert any $HOME_NET any -> $HOME_NET any (msg:"[CISCO-SCA] Suspected Phishing Domain"; program:cisco-sca_data; content:"
| 22
| cisco_sca_data_type
| 22 3a 20 22
| alert
| 22
| "; content:"
| 22
| type
| 22 3a 20 22
| Suspected Phishing Domain
| 22
| "; classtype:trojan-activity; reference:url,www.cisco.com/c/dam/en/us/td/docs/security/stealthwatch/cloud/reference/Alerts_and_Observations_DV_2_4.pdf; sid:5010611; rev:1;)