[Snort-sigs] Low hanging fruit - inforet

lists at ...3397... lists at ...3397...
Wed Aug 29 15:34:10 EDT 2012

On 08/29/12 14:27, James Lay wrote:
> Pretty sure these will change to something else over time.  Maybe 
> useful, maybe not :)

This is associated with a Blackhole mailing campaign purporting to originate
from IRS (typical); I starting seeing this on the 27th, IMHO I'm not sure it's
worth inclusion because it changes on a per-campaign basis (photo.htm,
upload.htm, inforet.html, etc etc)

I saw it with hxxp://metrotienda.netai.net/inforet.html


More information about the Snort-sigs mailing list