[Emerging-Sigs] FPs on sid 2028883

Erich.Lerch at bit.admin.ch Erich.Lerch at bit.admin.ch
Thu Oct 24 03:15:24 HDT 2019


Hi

We're getting several alerts per day from SID 2028883.
All seem to be legit PNG downloads (HTTP).

I can consistently reproduce the FP, e.g. with:

hxxp://www.bernau[.]ch/images/content/banner/facebooklogo.png
hxxp://www.sporthandel-liebermann-server.de/media/image/19/13/e4/Schnee8brecThR2axfi.png

Do others see this behavior too?

Cheers,
Erich



More information about the Emerging-sigs mailing list