alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET SCAN Wapiti Web Server Vulnerability Scan"; flow:established,to_server; http.start; content:"GET /"; startswith; content:"?http|3A|//www.google."; within:100; nocase; http.user_agent; content:"Python-httplib2"; fast_pattern; startswith; reference:url,wapiti.sourceforge.net/; classtype:attempted-recon; sid:2008417; rev:11; metadata:created_at 2010_07_30, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_10;)