alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET EXPLOIT_KIT KaiXin Secondary Landing Page"; flow:to_server,established; http.uri; content:"/win.html"; fast_pattern; endswith; http.header; pcre:"/Host\x3a\x20(?P<refhost>[^\x3a\r\n]+)(?:\x3a\d{1,5})?\r\n.*?\r\nReferer\x3a\x20https?\x3a\x2f\x2f(?P=refhost)(?:\x3a\d{1,5})?\/?/si"; http.host; content:!"www.carrona.org"; classtype:exploit-kit; sid:2021293; rev:6; metadata:created_at 2015_06_18, signature_severity Major, updated_at 2020_11_02;)