""ET DOS User-Agent used in known DDoS Attacks Detected inbound 2""

SID: 2011824

Revision: 3

Class Type: denial-of-service

Metadata: created_at 2010_10_18, updated_at 2014_09_12

Reference:

• Link

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: any

Destination Network: $HOME_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

• Value: "User-agent|3a| Opera/9.02 (Windows NT 5.1|3b| U|3b| ru)"

Within:

PCRE:

Special Options:

• http_header

source