[Emerging-Sigs] gooqlepics.com Sig

Michael Lubinski michael.lubinski at gmail.com
Tue Jul 26 20:25:59 EDT 2011


how does this work.

alert tcp $HOME_NET any -> any 53 (msg:"Possible Malicous Domain,
gooqlepics.com"; flow:established,to_server; content:"0a 67 6f 6f 71 6c 65
70 69 63 73 03 63 6f 6d 00" reference:
http://blog.armorize.com/2011/07/willysycom-mass-injection-ongoing.html
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.emergingthreats.net/pipermail/emerging-sigs/attachments/20110726/a378a3b7/attachment.html


More information about the Emerging-sigs mailing list