[Emerging-Sigs] GBot Rule

eltra1n larry.wichman at gmail.com
Fri Oct 29 11:22:30 EDT 2010


Hey all - I captured this today. Can someone write a rule to look for the
GBot user agent string?

User-Agent: gbot/2.3

Here is full captured packet:

GET /images/dating1.jpg?tq=pdT%2Ffq%2BTyQUW6KEaKyA%3D HTTP/1.0
Connection: close
Host: freeonlinedatingtips.net
Accept: /
User-Agent: gbot/2.3
HTTP/1.1 302 Moved Temporarily
Content-Length: 0
Location: /images/dating1.jpg?tq=pdT%2Ffq%2BTyQUW6KEaKyA%3D?03937120
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20101029/2e1519da/attachment.html


More information about the Emerging-sigs mailing list