alert http1 $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET WEB_SPECIFIC_APPS Blog Spam Insert Attempt"; flow:established,to_server; http.header_names; content:"|0d 0a|x-aaaaaaaaa"; nocase; reference:url,spamhuntress.com/2005/05/14/new-block-for-bulgarians/; reference:url,lists.geeklog.net/pipermail/geeklog-spam/2005-June/000020.html; reference:url,www.webmasterworld.com/forum92/3683.htm; classtype:web-application-attack; sid:2002069; rev:11; metadata:created_at 2010_07_30, signature_severity Major, updated_at 2024_05_07;)