""ET POLICY IP Check Domain (icanhazip. com in HTTP Host)""

SID: 2017398

Revision: 3

Class Type: attempted-recon

Metadata: created_at 2013_08_30, updated_at 2018_07_31

Reference:

Protocol: tcp

Source Network: $HOME_NET

Source Port: any

Destination Network: $EXTERNAL_NET

Destination Port: $HTTP_PORTS

Flow: established,to_server

Contents:

  • Value: "icanhazip.com"

Within:

PCRE: "/^Host\x3a\s*?(?:[^\r\n]+?.)?icanhazip.com(?:\x3a\d{1,5})?\r$/Hmi"

Special Options:

  • http_header

source