Cool Exploit Kit v2

*There is an updated version of this query*

Thanks to @Set_Abominae for pointing this out.

Per @kafeine’s blog post, Cool EK updated.

HTTP Request Method = GET
HTTP URI contains “/news/”
Regex HTTP URI for ^http:\/\/[a-f0-9]{13}\.

See examples of Cool Exploit Kit v2 on UrlQuery.net

Comments are closed.