# Scenario: The Suspicious Login

**Background**: You are a SOC Analyst. You received an alert about "Cleartext Credentials" on the network. You open the PCAP file in Wireshark.

## Investigation Data
*   **Packet 12**: Protocol: HTTP. Source: 192.168.1.105. Dest: 104.21.55.2.
*   **Info**: POST /login.php HTTP/1.1
*   **Packet 12 Details**:
    *   Form item: "username" = "admin"
    *   Form item: "password" = "SuperSecret123"

## Analysis
1.  The user logged into a website using **HTTP**, not HTTPS.
2.  Because it was HTTP, the data was sent in **Plaintext**.
3.  Anyone on the same WiFi could have captured this packet and stolen the credentials.

## Mitigation
*   Always enforce **HTTPS** (TLS/SSL).
*   Use certificate pinning.
*   Educate users to look for the "Padlock" icon.