🐾 - 🔒 TLS connection to (sni) - www.handybackup.net - File Sharing solution 🗃 - Possible Leak 🚱 - seen in 🔒 RagnarLocker Attack - Suricata Rule 3300599 (pawpatrules)

🐾 - 🔒 TLS connection to (sni) - www.handybackup.net - File Sharing solution 🗃 - Possible Leak 🚱 - seen in 🔒 RagnarLocker Attack

SID: 3300599Rev: 80 viewsHistory

Sourcepawpatrules

CreatedMarch 10, 2022

UpdatedSeptember 16, 2025

Classificationbad-unknown

alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - 🔒 TLS connection to (sni) - www.handybackup.net - File Sharing solution 🗃 - Possible Leak 🚱 - seen in 🔒 RagnarLocker Attack"; flow:to_server, stateless; tls_sni; content:"www.handybackup.net"; nocase; pcre:"/(^|\.)www\.handybackup\.net$/"; metadata:created_at 2022_03_10, updated_at 2025_09_16; sid:3300599; rev:8; classtype:bad-unknown;)

🐾 - 🔒 TLS connection to (sni) - www.handybackup.net - File Sharing solution 🗃 - Possible Leak 🚱 - seen in 🔒 RagnarLocker Attack

Metadata

Comments (0)