alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Fake/Rogue AV Landing Page Encountered"; flow:established,to_server; http.uri; content:".php?"; nocase; content:"land="; fast_pattern; nocase; content:"affid="; nocase; pcre:"/\.php\?(?:land=\d+|affid=\d{5})&(?:land=\d+|affid=\d{5})$/i"; reference:url,en.wikipedia.org/wiki/Scareware; classtype:trojan-activity; sid:2010347; rev:8; metadata:created_at 2010_07_30, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_19;)