alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO BitCoin"; flow:established,to_server; http.uri; content:"/api/work/getwork?"; fast_pattern; startswith; http.header; content:"bitcoinplus.com"; threshold:type limit, count 2, seconds 300, track by_src; classtype:coin-mining; sid:2013059; rev:5; metadata:created_at 2011_06_17, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_12;)