#alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET TROJAN Obfuscated Javascript Often Used in the Blackhole Exploit Kit 3"; flow:established,from_server; content:"Content-Type|3a 20|text/html"; content:"|0d 0a|"; within:500; content:"