[***] Results from Oinkmaster started Sun Dec 5 21:00:01 2004 [***]
[---] Removed rules: [---]
-> Removed from bleeding-policy.rules (4):
alert tcp $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any
(msg:"BLEEDING-EDGE Policy Makelovenotspam.com Screensaver Target Download";
content:"<mlns><targets location="; nocase; content:"<target id=\""; nocase;
content:"<key name=\"hits\" value=\""; nocase;
reference:url,www.makelovenotspam.com; flow:from_server,established;
sid:2001561; rev:2;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Policy Makelovenotspam.com Screensaver Download";
uricontent:"/screensavers/MLNS_screensaver"; nocase;
reference:url,www.makelovenotspam.com; flow:to_server,established; sid:2001558;
rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Policy Makelovenotspam.com Screensaver Target Request";
uricontent:"/xml/"; nocase; content:"Host\: backend.makelovenotspam.com";
nocase; content:"User-Agent\: Shockwave Flash"; nocase;
reference:url,www.makelovenotspam.com; flow:to_server,established; sid:2001560;
rev:1;)
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS
(msg:"BLEEDING-EDGE Policy Makelovenotspam.com Screensaver Country Code Update
Download"; uricontent:"/intl/static/countries.xml"; nocase; content:"Host\:
makelovenotspam.com"; nocase; content:"User-Agent\: Shockwave Flash"; nocase;
reference:url,www.makelovenotspam.com; flow:to_server,established; sid:2001559;
rev:1;)
[---] Removed non-rule lines: [---]
-> Removed from bleeding-policy.rules (1):
# MLNS = Makelovenotspam.com - by Matt Jonkman
-> Removed from bleeding-sid-msg.map (4):
2001558 || BLEEDING-EDGE Policy Makelovenotspam.com Screensaver
Download || url,www.makelovenotspam.com
2001559 || BLEEDING-EDGE Policy Makelovenotspam.com Screensaver Country
Code Update Download || url,www.makelovenotspam.com
2001560 || BLEEDING-EDGE Policy Makelovenotspam.com Screensaver Target
Request || url,www.makelovenotspam.com
2001561 || BLEEDING-EDGE Policy Makelovenotspam.com Screensaver Target
Download || url,www.makelovenotspam.com
[*] Added files: [*]
None.
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
