alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET DELETED Blink.com related Backdoor Checkin"; flow:established,to_server; content:"/?vn="; nocase; http_uri; content:"&partner="; nocase; http_uri; content:"&ptag="; nocase; http_uri; content:"&b="; nocase; http_uri; content:"&se="; nocase; http_uri; content:"&au="; nocase; flowbits:set,ET.blink.get; classtype:trojan-activity; sid:2007805; rev:4; metadata:created_at 2010_07_30, signature_severity Unknown, updated_at 2019_07_26;)