""ET WEB_SERVER HTTP Request to a *.33db9538.com domain - Anuna Checkin - Compromised PHP Site""
SID: 2023231
Revision: 2
Class Type: bad-unknown
Metadata: affected_product Apache_HTTP_server, affected_product PHP, attack_target Web_Server, created_at 2016_09_15, deployment Datacenter, signature_severity Critical, updated_at 2022_11_21
Reference:
Protocol: tcp
Source Network: $HTTP_SERVERS
Source Port: any
Destination Network: $EXTERNAL_NET
Destination Port: $HTTP_PORTS
Flow: to_server,established
Contents:
- Value: "33db9538.com"
Within:
PCRE: "/^Host\x3a\x20[^\r\n]+33db953.com[\r\n]$/Hmi"
Special Options:
- http_header