Looks like the gist of the rule is a pattern similar
to <iframe src=:
which this sight has, but does not appear to be
malevolent. I can send libpcap file if necessary. I
have 1673 of these this month.
SRC: GET
/boxserver/content.js?mboxClient=cnet&mboxHost=www.tv.com&mbox=tv-fd-signup&mboxCount=1&mboxSession=1126627963617-516864&mboxFirstPageInVisit=true&mboxPC=1125083325593-273075&mboxPage=1126627963617-516864&mboxURL=http%3A//www.tv.com/&mboxReferrer=&mboxVersion=14
HTTP/1.1
SRC: Accept: */*
SRC: Referer: http://www.tv.com/
SRC: Accept-Language: en-us
SRC: Accept-Encoding: gzip, deflate
SRC: User-Agent: Mozilla/4.0 (compatible; MSIE 5.5;
Windows NT 5.0)
SRC: Host: mbox2.offermatica.com
SRC: Connection: Keep-Alive
SRC:
SRC:
DST: HTTP/1.1 200 OK
DST: X-Powered-By: Servlet 2.4;
Tomcat-5.0.28/JBoss-3.2.6 (build: CVSTag=JBoss_3_2_6
date=200410140106)
DST: pragma: no-cache
DST: Content-Type: text/JavaScript;charset=ISO-8859-1
DST: Content-Length: 315
DST: Date: Tue, 13 Sep 2005 16:12:21 GMT
DST: Server: Apache-Coyote/1.1
DST:
DST: var
mboxCurrentId='tv-fd-signup';mboxs[mboxCurrentId].setActivateAction(mboxs[mboxCurrentId].hide);document.write('<div
style="visibility: hidden; display: none"><iframe
src="javascript:false;" width="0" height="0"
onload="mboxActivateById(\'tv-fd-signup\')"></iframe></div>');mboxs['tv-fd-signup'].cancelTimeout();
__________________________________
Yahoo! Mail - PC Magazine Editors' Choice 2005
http://mail.yahoo.com
-------------------------------------------------------
SF.Net email is sponsored by:
Tame your development challenges with Apache's Geronimo App Server. Download
it for free - -and be entered to win a 42" plasma tv or your very own
Sony(tm)PSP. Click here to play: http://sourceforge.net/geronimo.php
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
