[Snort-users] IPHONE user agent?

Jeff Kell jeff-kell at ...6282...
Sat Dec 1 23:23:53 EST 2012


On 12/1/2012 11:10 PM, Jeff Kell wrote:
> This "BLACKLIST User-Agent known malicious user-agent string IPHONE" sig
> is going off all over the place.  Appears to be real iPhones (?)
>
> Clarification?  Looks like a pre-baked detection criteria...

This appears to be a legit ESPN app with that string in the User-agent.

Jeff





More information about the Snort-users mailing list