Rule History

SID: 903206904 • Source: sslbl/ssl-fp-blacklist

Versions (3)

Version DetailsCurrent

Rev: 1 • Jun 25, 2025, 11:40 AM

Message:

SSLBL: Malicious SSL certificate detected (LummaStealer C&C)

Rule:

alert tls $EXTERNAL_NET any -> $HOME_NET any (msg:"SSLBL: Malicious SSL certificate detected (LummaStealer C&C)"; tls_cert_fingerprint; content:"dd:99:06:fe:bd:8b:c0:3a:7e:5c:5f:85:9e:78:8c:4b:f3:30:c0:70"; reference:url, sslbl.abuse.ch/ssl-certificates/sha1/dd9906febd8bc03a7e5c5f859e788c4bf330c070/; sid:903206904; rev:1;)

Created:

Jun 25, 2025, 11:40 AM

Updated:

Jun 25, 2025, 11:40 AM

DB Created:

Jul 17, 2025, 2:34 PM

DB Updated:

Jul 17, 2025, 2:34 PM

Filename:

sslblacklist_tls_cert.rules