Re: Hacked sites: "dropbox" V.2

[Reindl Harald]

Am 30.10.2014 um 16:56 schrieb Marieke Janssen:

uri    AXB_URI_MLW_DROPBOX    /\/dropbox\/(document|doc|invoice)\.php$/
score  AXB_URI_MLW_DROPBOX    100

uri   RH_URI_MLW_GOOGLEBOX1 /\/googlebox\/(document|doc|invoice)\.php$/
score RH_URI_MLW_GOOGLEBOX1 100

added invoice.php

Am 22.10.2014 um 11:47 schrieb Axb:

uri    AXB_URI_MLW_DROPBOX    /\/dropbox\/doc\.php$/
score  AXB_URI_MLW_DROPBOX    25.0

this rule will probably loose it's teeth pretty fast....

thanks, the same applies to "googlebox"

uri   RH_URI_MLW_GOOGLEBOX1 /\/googlebox\/document\.php$/
score RH_URI_MLW_GOOGLEBOX1 100
uri   RH_URI_MLW_GOOGLEBOX2 /\/googlebox\/doc\.php$/
score RH_URI_MLW_GOOGLEBOX2 100

uri   RH_URI_MLW_BANKING /\/banking\/(document|doc|invoice)\.php$/
score RH_URI_MLW_BANKING 100

and the next one with "Payment Advice" subjects recently hitted our postmaster account, same scheme

signature.asc
Description: OpenPGP digital signature