curben
/
phishing-filter
mirror of https://gitlab.com/malware-filter/phishing-filter
1
0
Fork 0
Code Issues Releases Wiki Activity
phishing-filter/dist/phishing-filter-snort3.rules

8595 lines
2.0 MiB
Plaintext
Raw Normal View History

feat: add Snort3 ruleset
2021-03-19 19:03:25 +00:00
# Title: Phishing URL Snort3 Ruleset
Filter updated: Sun, 26 Sep 2021 12:01:30 +0000
2021-09-26 12:01:30 +00:00
# Updated: Sun, 26 Sep 2021 12:01:22 +0000
feat: add Snort3 ruleset
2021-03-19 19:03:25 +00:00
# Expires: 1 day (update frequency)
# Homepage: https://gitlab.com/curben/phishing-filter
# License: https://gitlab.com/curben/phishing-filter#license
# Source: https://www.phishtank.com/ & https://openphish.com/
Filter updated: Fri, 02 Apr 2021 12:06:43 UTC
2021-04-02 12:06:43 +00:00
# Notice: https://curben.gitlab.io/phishing-filter-mirror is moved to https://curben.gitlab.io/malware-filter
Filter updated: Fri, 24 Sep 2021 00:01:50 +0000
2021-09-24 00:01:51 +00:00
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"000098.ihostfull.com",nocase; classtype:attempted-recon; sid:200000001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"006.zzz.com.ua",nocase; classtype:attempted-recon; sid:200000002; rev:1;)
Filter updated: Sun, 26 Sep 2021 12:01:30 +0000
2021-09-26 12:01:30 +00:00
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"00hw1.mjt.lu",nocase; classtype:attempted-recon; sid:200000003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0103023segurity.byethost14.com",nocase; classtype:attempted-recon; sid:200000004; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"02-billing-support.org",nocase; classtype:attempted-recon; sid:200000005; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"036.trendsbygwen.com",nocase; classtype:attempted-recon; sid:200000006; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"06btevocale.qlihost.ru",nocase; classtype:attempted-recon; sid:200000007; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"07dd96.htmlcomponentservice.com",nocase; classtype:attempted-recon; sid:200000008; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0941ce23b87674e83d9a5ccbd65b9fe5-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200000009; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0bs.de",nocase; classtype:attempted-recon; sid:200000010; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0ddbdb7c8f4432481.temporary.link",nocase; classtype:attempted-recon; sid:200000011; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0f243f4a77683abfc0e2cad4fe6570d63eaca83e.000webhostapp.com",nocase; classtype:attempted-recon; sid:200000012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0faa1bbe3578b9623adc96038420d8e6-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200000013; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0i.is",nocase; classtype:attempted-recon; sid:200000014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0tnr44.stat-pulse.com",nocase; classtype:attempted-recon; sid:200000015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0xpnkh.raphitari.com",nocase; classtype:attempted-recon; sid:200000016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1.shacky6tens.one",nocase; classtype:attempted-recon; sid:200000017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"101.32.192.174",nocase; classtype:attempted-recon; sid:200000018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"102update1.creatorlink.net",nocase; classtype:attempted-recon; sid:200000019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"103.114.16.4",nocase; classtype:attempted-recon; sid:200000020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"104.168.173.244",nocase; classtype:attempted-recon; sid:200000021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"104.168.173.248",nocase; classtype:attempted-recon; sid:200000022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"104thphoenix.com",nocase; classtype:attempted-recon; sid:200000023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"106.12.192.247",nocase; classtype:attempted-recon; sid:200000024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"107.172.198.119",nocase; classtype:attempted-recon; sid:200000025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"10xdoge.org",nocase; classtype:attempted-recon; sid:200000026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"11111.leissx1.com",nocase; classtype:attempted-recon; sid:200000027; rev:1;)
Filter updated: Sat, 25 Sep 2021 00:01:48 +0000
2021-09-25 00:01:48 +00:00
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"113.125.21.66",nocase; classtype:attempted-recon; sid:200000028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"119.28.91.122",nocase; classtype:attempted-recon; sid:200000029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"119.8.55.19",nocase; classtype:attempted-recon; sid:200000030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"11bp7.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"11dbs.com",nocase; classtype:attempted-recon; sid:200000032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"11owd.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"11wgz.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"121techyard.com",nocase; classtype:attempted-recon; sid:200000035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"122zh.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"124.156.136.189",nocase; classtype:attempted-recon; sid:200000037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1249d4d7.6u56u665y6h45g45tg3.pages.dev",nocase; classtype:attempted-recon; sid:200000038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"124wi.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"127qs.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000040; rev:1;)
Filter updated: Sun, 26 Sep 2021 00:02:13 +0000
2021-09-26 00:02:13 +00:00
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"12a1j.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"12fmu.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"12gxe.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"12jnv.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"12jz9.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"12lb1.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"12lk2.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"12mak.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"12mo7.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"12mob.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"12oei.trk.elasticemail.com",nocase; classtype:attempted-recon; sid:200000051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"130.211.30.154",nocase; classtype:attempted-recon; sid:200000052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"132artisan.lavanup.com",nocase; classtype:attempted-recon; sid:200000053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"13721372.32304ey.ninishop.org",nocase; classtype:attempted-recon; sid:200000054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"139.59.49.220",nocase; classtype:attempted-recon; sid:200000055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"14.63.195.13",nocase; classtype:attempted-recon; sid:200000056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"140.trendsbygwen.com",nocase; classtype:attempted-recon; sid:200000057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"141.164.59.176",nocase; classtype:attempted-recon; sid:200000058; rev:1;)
Filter updated: Sat, 25 Sep 2021 12:01:35 +0000
2021-09-25 12:01:36 +00:00
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"148.66.3.194",nocase; classtype:attempted-recon; sid:200000059; rev:1;)
Filter updated: Sun, 26 Sep 2021 12:01:30 +0000
2021-09-26 12:01:30 +00:00
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"148.72.157.11",nocase; classtype:attempted-recon; sid:200000060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"149.210.143.165",nocase; classtype:attempted-recon; sid:200000061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"152-70-128-242.cprapid.com",nocase; classtype:attempted-recon; sid:200000062; rev:1;)
Filter updated: Sun, 26 Sep 2021 00:02:13 +0000
2021-09-26 00:02:13 +00:00
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"154.30.211.130.bc.googleusercontent.com",nocase; classtype:attempted-recon; sid:200000063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"157.240.194.18",nocase; classtype:attempted-recon; sid:200000064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"157.240.194.35",nocase; classtype:attempted-recon; sid:200000065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"159.203.115.201",nocase; classtype:attempted-recon; sid:200000066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"159.65.133.234",nocase; classtype:attempted-recon; sid:200000067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"161.35.140.54",nocase; classtype:attempted-recon; sid:200000068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"162.241.87.196",nocase; classtype:attempted-recon; sid:200000069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"165.22.103.235",nocase; classtype:attempted-recon; sid:200000070; rev:1;)
Filter updated: Sun, 26 Sep 2021 12:01:30 +0000
2021-09-26 12:01:30 +00:00
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1667365.com",nocase; classtype:attempted-recon; sid:200000071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"172.217.21.162",nocase; classtype:attempted-recon; sid:200000072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"172.86.125.196",nocase; classtype:attempted-recon; sid:200000073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"173.212.239.242",nocase; classtype:attempted-recon; sid:200000074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"173.232.146.126",nocase; classtype:attempted-recon; sid:200000075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"176-119-1-189.cprapid.com",nocase; classtype:attempted-recon; sid:200000076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"176.121.14.53",nocase; classtype:attempted-recon; sid:200000077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"17896-2008.s1.webspace.re",nocase; classtype:attempted-recon; sid:200000078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"180betper.blogspot.com",nocase; classtype:attempted-recon; sid:200000079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"183709ef9b6572a103f79032b1586b81-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200000080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"185.177.54.1",nocase; classtype:attempted-recon; sid:200000081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"185.177.54.2",nocase; classtype:attempted-recon; sid:200000082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"185.177.54.9",nocase; classtype:attempted-recon; sid:200000083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"18614247159c.byethost24.com",nocase; classtype:attempted-recon; sid:200000084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"188.166.40.187",nocase; classtype:attempted-recon; sid:200000085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"188.225.40.227",nocase; classtype:attempted-recon; sid:200000086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"188.72.187.185",nocase; classtype:attempted-recon; sid:200000087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"188.93.233.146",nocase; classtype:attempted-recon; sid:200000088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"188.93.233.68",nocase; classtype:attempted-recon; sid:200000089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"188elexusbet.blogspot.com",nocase; classtype:attempted-recon; sid:200000090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"190854.8b.io",nocase; classtype:attempted-recon; sid:200000091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"192.210.243.179",nocase; classtype:attempted-recon; sid:200000092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"193.135.153.242",nocase; classtype:attempted-recon; sid:200000093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"198.46.177.67",nocase; classtype:attempted-recon; sid:200000094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1artemisbet.blogspot.com",nocase; classtype:attempted-recon; sid:200000095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1dom.club",nocase; classtype:attempted-recon; sid:200000096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1inich.exchange",nocase; classtype:attempted-recon; sid:200000097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1m5yp.csb.app",nocase; classtype:attempted-recon; sid:200000098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1millionnfts.art",nocase; classtype:attempted-recon; sid:200000099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1ncih.exchange",nocase; classtype:attempted-recon; sid:200000100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1ogin-microsoftqinpbfhejkkpbeq-furdxysscvftlnjd-qfcrydbfrcbsfso.netlify.app",nocase; classtype:attempted-recon; sid:200000101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1onlinebancogalicia.vzpla.net",nocase; classtype:attempted-recon; sid:200000102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1repair.co.uk",nocase; classtype:attempted-recon; sid:200000103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1sultanbet.blogspot.com",nocase; classtype:attempted-recon; sid:200000104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1und1center.tumblr.com",nocase; classtype:attempted-recon; sid:200000105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1w5v7.weblium.site",nocase; classtype:attempted-recon; sid:200000106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2.136.95.251",nocase; classtype:attempted-recon; sid:200000107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"20.90.154.8",nocase; classtype:attempted-recon; sid:200000108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2021attintellectualproperty.webflow.io",nocase; classtype:attempted-recon; sid:200000109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"20257719.com",nocase; classtype:attempted-recon; sid:200000110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"205.204.101.13",nocase; classtype:attempted-recon; sid:200000111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"206.189.85.218",nocase; classtype:attempted-recon; sid:200000112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"208.82.115.230",nocase; classtype:attempted-recon; sid:200000113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"209.97.188.25",nocase; classtype:attempted-recon; sid:200000114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"21234.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200000115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"212897764576871473832-dot-bn058.csb.app",nocase; classtype:attempted-recon; sid:200000116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"217.151.153.188",nocase; classtype:attempted-recon; sid:200000117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"217651.8b.io",nocase; classtype:attempted-recon; sid:200000118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"222.231.3.128",nocase; classtype:attempted-recon; sid:200000119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"22222.leissx2.com",nocase; classtype:attempted-recon; sid:200000120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"222289.ihostfull.com",nocase; classtype:attempted-recon; sid:200000121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"23341.ihostfull.com",nocase; classtype:attempted-recon; sid:200000122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"24-gb.blogspot.com",nocase; classtype:attempted-recon; sid:200000123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2482689012.yolasite.com",nocase; classtype:attempted-recon; sid:200000124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"24a69f75.orson.website",nocase; classtype:attempted-recon; sid:200000125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2524santan-d-er0.hostfree.pw",nocase; classtype:attempted-recon; sid:200000126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"25tnr.app.link",nocase; classtype:attempted-recon; sid:200000127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"264js.skipdns.link",nocase; classtype:attempted-recon; sid:200000128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"299kensingtonroad.my.webex.com",nocase; classtype:attempted-recon; sid:200000129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2fa.bthei.com",nocase; classtype:attempted-recon; sid:200000130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2ffth.csb.app",nocase; classtype:attempted-recon; sid:200000131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2muoqba.000webhostapp.com",nocase; classtype:attempted-recon; sid:200000132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2na.io",nocase; classtype:attempted-recon; sid:200000133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2pil.ru",nocase; classtype:attempted-recon; sid:200000134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2qibxad421.site44.com",nocase; classtype:attempted-recon; sid:200000135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2qnzq.skipdns.link",nocase; classtype:attempted-recon; sid:200000136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"2wnrlyj.xyz",nocase; classtype:attempted-recon; sid:200000137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3.19.71.11",nocase; classtype:attempted-recon; sid:200000138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3007284159.com",nocase; classtype:attempted-recon; sid:200000139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3012365.com",nocase; classtype:attempted-recon; sid:200000140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"30v0jdqba94.typeform.com",nocase; classtype:attempted-recon; sid:200000141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"30ywc.codesandbox.io",nocase; classtype:attempted-recon; sid:200000142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"31.13.71.1",nocase; classtype:attempted-recon; sid:200000143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"31134.ihostfull.com",nocase; classtype:attempted-recon; sid:200000144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"31jan.page.link",nocase; classtype:attempted-recon; sid:200000145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"32541514546544.hyperphp.com",nocase; classtype:attempted-recon; sid:200000146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"33333.leissx3.com",nocase; classtype:attempted-recon; sid:200000147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"34.76.47.182",nocase; classtype:attempted-recon; sid:200000148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3456654456765.hyperphp.com",nocase; classtype:attempted-recon; sid:200000149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3456765434.hyperphp.com",nocase; classtype:attempted-recon; sid:200000150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"35.186.228.86",nocase; classtype:attempted-recon; sid:200000151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"35.199.84.117",nocase; classtype:attempted-recon; sid:200000152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3541164541541445.hyperphp.com",nocase; classtype:attempted-recon; sid:200000153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"366486d4d9b41b8ed89201b3f4bc4cd9-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200000154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"37kdkt4z2tzdq7pnedcg6gbute-adwhj77lcyoafdy-www-exodus-com.translate.goog",nocase; classtype:attempted-recon; sid:200000155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"386f9e87.ithemeshosting.com.php73-39.lan3-1.websitetestlink.com",nocase; classtype:attempted-recon; sid:200000156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"38awdrt.xyz",nocase; classtype:attempted-recon; sid:200000157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3a10a178.s6t6sj4s46tu4sys54y5.pages.dev",nocase; classtype:attempted-recon; sid:200000158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3bgqg.app.link",nocase; classtype:attempted-recon; sid:200000159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3ff7c459-86b2-4f6d-b6b0-ba6402ef6cb0.htmlcomponentservice.com",nocase; classtype:attempted-recon; sid:200000160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3glite.wapka.co",nocase; classtype:attempted-recon; sid:200000161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3j124.csb.app",nocase; classtype:attempted-recon; sid:200000162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3khx4xj.xyz",nocase; classtype:attempted-recon; sid:200000163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3mvirugambakkam.com",nocase; classtype:attempted-recon; sid:200000164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3name.com",nocase; classtype:attempted-recon; sid:200000165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3ngq0.skipdns.link",nocase; classtype:attempted-recon; sid:200000166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3no.ro",nocase; classtype:attempted-recon; sid:200000167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3o2.co",nocase; classtype:attempted-recon; sid:200000168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3oyynxmehx7.typeform.com",nocase; classtype:attempted-recon; sid:200000169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3q3.de",nocase; classtype:attempted-recon; sid:200000170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3sekabet.blogspot.com",nocase; classtype:attempted-recon; sid:200000171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3wondersexpeditions.com",nocase; classtype:attempted-recon; sid:200000172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3yteacv.xyz",nocase; classtype:attempted-recon; sid:200000173; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4115511456415145.hyperphp.com",nocase; classtype:attempted-recon; sid:200000174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"414614415641654.hyperphp.com",nocase; classtype:attempted-recon; sid:200000175; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4234655432432gal.eshost.com.ar",nocase; classtype:attempted-recon; sid:200000176; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"42k8m.skipdns.link",nocase; classtype:attempted-recon; sid:200000177; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"43-245-61-213.cprapid.com",nocase; classtype:attempted-recon; sid:200000178; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4404trck.com",nocase; classtype:attempted-recon; sid:200000179; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"44444.leissx4.com",nocase; classtype:attempted-recon; sid:200000180; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"44514156145145.hyperphp.com",nocase; classtype:attempted-recon; sid:200000181; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"45.200.124.118",nocase; classtype:attempted-recon; sid:200000182; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"45.40.130.40",nocase; classtype:attempted-recon; sid:200000183; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"45.76.76.126",nocase; classtype:attempted-recon; sid:200000184; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"45.91.225.229",nocase; classtype:attempted-recon; sid:200000185; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4565434344354.hyperphp.com",nocase; classtype:attempted-recon; sid:200000186; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4565465565433.hyperphp.com",nocase; classtype:attempted-recon; sid:200000187; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"45help43.creatorlink.net",nocase; classtype:attempted-recon; sid:200000188; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"47.57.15.46",nocase; classtype:attempted-recon; sid:200000189; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"47.89.152.194",nocase; classtype:attempted-recon; sid:200000190; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"47.99.172.49",nocase; classtype:attempted-recon; sid:200000191; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"472a4262-a2a1-4785-b3aa-4816cba070ed.htmlcomponentservice.com",nocase; classtype:attempted-recon; sid:200000192; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"48tlp.codesandbox.io",nocase; classtype:attempted-recon; sid:200000193; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"49.235.62.58",nocase; classtype:attempted-recon; sid:200000194; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4datasolution.com",nocase; classtype:attempted-recon; sid:200000195; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4ea81b21bbd213fef855e114424d147f-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200000196; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4jv02.app.link",nocase; classtype:attempted-recon; sid:200000197; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4l7rtd.hyperphp.com",nocase; classtype:attempted-recon; sid:200000198; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4lxkd.r.ag.d.sendibm3.com",nocase; classtype:attempted-recon; sid:200000199; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4pjqi.skipdns.link",nocase; classtype:attempted-recon; sid:200000200; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4sekabet.blogspot.com",nocase; classtype:attempted-recon; sid:200000201; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"4zwkx.codesandbox.io",nocase; classtype:attempted-recon; sid:200000202; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"502c2dae4e5cfad452551b5d7032b151-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200000203; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"51.222.193.66",nocase; classtype:attempted-recon; sid:200000204; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"51.255.64.58",nocase; classtype:attempted-recon; sid:200000205; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5145365411654.hyperphp.com",nocase; classtype:attempted-recon; sid:200000206; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5164845456464.hyperphp.com",nocase; classtype:attempted-recon; sid:200000207; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"52.206.121.186",nocase; classtype:attempted-recon; sid:200000208; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"53411545416514.hyperphp.com",nocase; classtype:attempted-recon; sid:200000209; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"54145451353212.hyperphp.com",nocase; classtype:attempted-recon; sid:200000210; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"54154514564564.hyperphp.com",nocase; classtype:attempted-recon; sid:200000211; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"54314324212214.hyperphp.com",nocase; classtype:attempted-recon; sid:200000212; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"545415645665145.hyperphp.com",nocase; classtype:attempted-recon; sid:200000213; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5454451456445.hyperphp.com",nocase; classtype:attempted-recon; sid:200000214; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"545644546451441.hyperphp.com",nocase; classtype:attempted-recon; sid:200000215; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5481818174145614.hyperphp.com",nocase; classtype:attempted-recon; sid:200000216; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"54fa3ab2df92b2a2ac008992e729203a-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200000217; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"54sadwd.j3byerqkbs.workers.dev",nocase; classtype:attempted-recon; sid:200000218; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"551b17fcd31380a7695b3a079e5973f0office.compremuitomais.com.br",nocase; classtype:attempted-recon; sid:200000219; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"55454615466641.hyperphp.com",nocase; classtype:attempted-recon; sid:200000220; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"556554354654345.hyperphp.com",nocase; classtype:attempted-recon; sid:200000221; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"55bgf.csb.app",nocase; classtype:attempted-recon; sid:200000222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"55jkomtn2w3.typeform.com",nocase; classtype:attempted-recon; sid:200000223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"56146251545.hyperphp.com",nocase; classtype:attempted-recon; sid:200000224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5615464545642.hyperphp.com",nocase; classtype:attempted-recon; sid:200000225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"563908.selcdn.ru",nocase; classtype:attempted-recon; sid:200000226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"563910.selcdn.ru",nocase; classtype:attempted-recon; sid:200000227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"565441514551444.hyperphp.com",nocase; classtype:attempted-recon; sid:200000228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"566656565564415.hyperphp.com",nocase; classtype:attempted-recon; sid:200000229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"56669663.hyperphp.com",nocase; classtype:attempted-recon; sid:200000230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"567656474653364.hyperphp.com",nocase; classtype:attempted-recon; sid:200000231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"567656575654657.hyperphp.com",nocase; classtype:attempted-recon; sid:200000232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"567765654456.hyperphp.com",nocase; classtype:attempted-recon; sid:200000233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5758496488684.hyperphp.com",nocase; classtype:attempted-recon; sid:200000234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"57754114545454.hyperphp.com",nocase; classtype:attempted-recon; sid:200000235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"579026.selcdn.ru",nocase; classtype:attempted-recon; sid:200000236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"595618.selcdn.ru",nocase; classtype:attempted-recon; sid:200000237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"597924.selcdn.ru",nocase; classtype:attempted-recon; sid:200000238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"598503.selcdn.ru",nocase; classtype:attempted-recon; sid:200000239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"598507.selcdn.ru",nocase; classtype:attempted-recon; sid:200000240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"599116.selcdn.ru",nocase; classtype:attempted-recon; sid:200000241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5a9df6761251a805681d59e162d86423-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200000242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5b0f6cb9-0485-4fc7-9775-eb74bb45bbf6.htmlcomponentservice.com",nocase; classtype:attempted-recon; sid:200000243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5e841ae2.srvr-cloudmail-srvr6765e7tg.pages.dev",nocase; classtype:attempted-recon; sid:200000244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5ff9bedcda4386938.temporary.link",nocase; classtype:attempted-recon; sid:200000245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5pl.us",nocase; classtype:attempted-recon; sid:200000246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5thavegroominglounge.com",nocase; classtype:attempted-recon; sid:200000247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5x726-alternate.app.link",nocase; classtype:attempted-recon; sid:200000248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"60minutesoffame.com",nocase; classtype:attempted-recon; sid:200000249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"6131365.com",nocase; classtype:attempted-recon; sid:200000250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"6151365.com",nocase; classtype:attempted-recon; sid:200000251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"61da8ae6.6u6566hrrthsh45.pages.dev",nocase; classtype:attempted-recon; sid:200000252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"629afe26.orson.website",nocase; classtype:attempted-recon; sid:200000253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"63454545645454.hyperphp.com",nocase; classtype:attempted-recon; sid:200000254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"6372365.com",nocase; classtype:attempted-recon; sid:200000255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"638ca12d-ba2f-451c-8418-faf56b7de7ff.htmlcomponentservice.com",nocase; classtype:attempted-recon; sid:200000256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"650vm.app.link",nocase; classtype:attempted-recon; sid:200000257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"655566564564.hyperphp.com",nocase; classtype:attempted-recon; sid:200000258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"6574.ihostfull.com",nocase; classtype:attempted-recon; sid:200000259; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"66.29.149.217",nocase; classtype:attempted-recon; sid:200000260; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"66.29.149.238",nocase; classtype:attempted-recon; sid:200000261; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"66.42.59.83",nocase; classtype:attempted-recon; sid:200000262; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"66.49.196.115",nocase; classtype:attempted-recon; sid:200000263; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"6600035.com",nocase; classtype:attempted-recon; sid:200000264; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"661544415541455.hyperphp.com",nocase; classtype:attempted-recon; sid:200000265; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"66666.leissx6.com",nocase; classtype:attempted-recon; sid:200000266; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"67d799f0-7b49-48fb-ac08-8954e4a48b81-a0fe.viosoria-das.ga",nocase; classtype:attempted-recon; sid:200000267; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"68.178.252.133",nocase; classtype:attempted-recon; sid:200000268; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"688745.hyperphp.com",nocase; classtype:attempted-recon; sid:200000269; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"6b6ee980cb147a4ec53464500670dd46-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200000270; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"6c7f0acc.sibforms.com",nocase; classtype:attempted-recon; sid:200000271; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"6e33r.codesandbox.io",nocase; classtype:attempted-recon; sid:200000272; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"70.40.208.244",nocase; classtype:attempted-recon; sid:200000273; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"7002x0788s6.typeform.com",nocase; classtype:attempted-recon; sid:200000274; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"72.11.143.173",nocase; classtype:attempted-recon; sid:200000275; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"738vjijegloopmglobald833bkcmue3778ewebprokl3e.weebly.com",nocase; classtype:attempted-recon; sid:200000276; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"768675643546534.hyperphp.com",nocase; classtype:attempted-recon; sid:200000277; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"77777.leissx7.com",nocase; classtype:attempted-recon; sid:200000278; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"779zt.csb.app",nocase; classtype:attempted-recon; sid:200000279; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"78.108.89.240",nocase; classtype:attempted-recon; sid:200000280; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"7a4298b9.sso-mail-secure234ds23d23wd1.pages.dev",nocase; classtype:attempted-recon; sid:200000281; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"7d54v.app.link",nocase; classtype:attempted-recon; sid:200000282; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"7ku50.csb.app",nocase; classtype:attempted-recon; sid:200000283; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"7p1qy.skipdns.link",nocase; classtype:attempted-recon; sid:200000284; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"7wr4u.csb.app",nocase; classtype:attempted-recon; sid:200000285; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"7yu3v.csb.app",nocase; classtype:attempted-recon; sid:200000286; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"800emailsupport.com",nocase; classtype:attempted-recon; sid:200000287; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"8010361370310234068010361370310234.blogspot.be",nocase; classtype:attempted-recon; sid:200000288; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"82.165.27.36",nocase; classtype:attempted-recon; sid:200000289; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"853.trendsbygwen.com",nocase; classtype:attempted-recon; sid:200000290; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"856966555.hyperphp.com",nocase; classtype:attempted-recon; sid:200000291; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"866614545641445.hyperphp.com",nocase; classtype:attempted-recon; sid:200000292; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"8765423564342.hyperphp.com",nocase; classtype:attempted-recon; sid:200000293; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"87656765564534.hyperphp.com",nocase; classtype:attempted-recon; sid:200000294; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"8765913c501c2e58a4af1bbee1458ea4-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200000295; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"878e1f3529847f4cdc43407202af3901-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200000296; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"88444.ihostfull.com",nocase; classtype:attempted-recon; sid:200000297; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"88888.leissx8.com",nocase; classtype:attempted-recon; sid:200000298; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"8dw5g.codesandbox.io",nocase; classtype:attempted-recon; sid:200000299; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"8hsfskj-alternate.app.link",nocase; classtype:attempted-recon; sid:200000300; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"90a6903b-75ff-445e-893e-c69d2807dd96.htmlcomponentservice.com",nocase; classtype:attempted-recon; sid:200000301; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"92075944.com",nocase; classtype:attempted-recon; sid:200000302; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"934354637282-343432.com",nocase; classtype:attempted-recon; sid:200000303; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"96414154511454.hyperphp.com",nocase; classtype:attempted-recon; sid:200000304; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"965823.ihostfull.com",nocase; classtype:attempted-recon; sid:200000305; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"96968.hyperphp.com",nocase; classtype:attempted-recon; sid:200000306; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"969896.ihostfull.com",nocase; classtype:attempted-recon; sid:200000307; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"98635.ihostfull.com",nocase; classtype:attempted-recon; sid:200000308; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"99000.ihostfull.com",nocase; classtype:attempted-recon; sid:200000309; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"9a658b0e03b628a9c8dca6f0ac68117e-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200000310; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"9bc8459f5401575658f78d584973748f-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200000311; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"9c9855c9c198acd14ca8c88da20e8ad5-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200000312; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"9d62cfee-59b3-42a8-9542-4b3a32692792.htmlcomponentservice.com",nocase; classtype:attempted-recon; sid:200000313; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"9khnh.app.link",nocase; classtype:attempted-recon; sid:200000314; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"9xnog.csb.app",nocase; classtype:attempted-recon; sid:200000315; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a-25ghjud872.byethost13.com",nocase; classtype:attempted-recon; sid:200000316; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a-25ghjud89.byethost3.com",nocase; classtype:attempted-recon; sid:200000317; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a0581702.xsph.ru",nocase; classtype:attempted-recon; sid:200000318; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a6f82af5baec4689a43fb46da5b682e7-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200000319; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aabpjs.covidharsh.com",nocase; classtype:attempted-recon; sid:200000320; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aacfrh.cloudanation.com",nocase; classtype:attempted-recon; sid:200000321; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aaekt.app.link",nocase; classtype:attempted-recon; sid:200000322; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aainacreation.co.in",nocase; classtype:attempted-recon; sid:200000323; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aaipsds.org",nocase; classtype:attempted-recon; sid:200000324; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aarogyamcafe.com",nocase; classtype:attempted-recon; sid:200000325; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"abagency.rw",nocase; classtype:attempted-recon; sid:200000326; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"abamazproduct.net",nocase; classtype:attempted-recon; sid:200000327; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"abapplianceservicefl.com",nocase; classtype:attempted-recon; sid:200000328; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"abcarmsk.ru",nocase; classtype:attempted-recon; sid:200000329; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"abdcenter.rhinosme-stagging.com",nocase; classtype:attempted-recon; sid:200000330; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"abdernameanmoins.moonfruit.com",nocase; classtype:attempted-recon; sid:200000331; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"abjmjx.covidharsh.com",nocase; classtype:attempted-recon; sid:200000332; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"abrprn.libcloudspid.com",nocase; classtype:attempted-recon; sid:200000333; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"absolute-insights.com",nocase; classtype:attempted-recon; sid:200000334; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"absolutepleasure.com.my",nocase; classtype:attempted-recon; sid:200000335; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"abszolutauto.hu",nocase; classtype:attempted-recon; sid:200000336; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"abtekdoor.com",nocase; classtype:attempted-recon; sid:200000337; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"academiamoviles.com",nocase; classtype:attempted-recon; sid:200000338; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"acala.legal",nocase; classtype:attempted-recon; sid:200000339; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accesidca.zyrosite.com",nocase; classtype:attempted-recon; sid:200000340; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accessed109.dns2.us",nocase; classtype:attempted-recon; sid:200000341; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accestransfilboncoin.000webhostapp.com",nocase; classtype:attempted-recon; sid:200000342; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accn.careord.com",nocase; classtype:attempted-recon; sid:200000343; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"account-validation.btcfuturos.com",nocase; classtype:attempted-recon; sid:200000344; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"account.herephyshy.info",nocase; classtype:attempted-recon; sid:200000345; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"account.signin.totally-tubular.net",nocase; classtype:attempted-recon; sid:200000346; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accountliveout.freecluster.eu",nocase; classtype:attempted-recon; sid:200000347; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts-autoscout24.de",nocase; classtype:attempted-recon; sid:200000348; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.amazorr.co.jp.oneke-ai.com",nocase; classtype:attempted-recon; sid:200000349; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.com.es",nocase; classtype:attempted-recon; sid:200000350; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accountupdateofifice.finecashflow.com",nocase; classtype:attempted-recon; sid:200000351; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accountverifisv.hostfree.pw",nocase; classtype:attempted-recon; sid:200000352; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accountverifisv1.hostfree.pw",nocase; classtype:attempted-recon; sid:200000353; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accts-validtion55akda.cf",nocase; classtype:attempted-recon; sid:200000354; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aceon.cacrzurd.com",nocase; classtype:attempted-recon; sid:200000355; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"acessobbauto.com",nocase; classtype:attempted-recon; sid:200000356; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"acessobradesco.digital",nocase; classtype:attempted-recon; sid:200000357; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"achalasiapedia.com",nocase; classtype:attempted-recon; sid:200000358; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"achillestendonrupturepedia.com",nocase; classtype:attempted-recon; sid:200000359; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"acle.mtyn.cl",nocase; classtype:attempted-recon; sid:200000360; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"acoen.careord.com",nocase; classtype:attempted-recon; sid:200000361; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"acount090387.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200000362; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"act67.freecluster.eu",nocase; classtype:attempted-recon; sid:200000363; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"actionnaireparis.zyrosite.com",nocase; classtype:attempted-recon; sid:200000364; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"activartransferenciainternacional.com",nocase; classtype:attempted-recon; sid:200000365; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"activate-hulu-com-activate.sitey.me",nocase; classtype:attempted-recon; sid:200000366; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"active-page-term-dashboard-advanced.my.id",nocase; classtype:attempted-recon; sid:200000367; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"active-page-term-dashboard-inc.my.id",nocase; classtype:attempted-recon; sid:200000368; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"active-secure-page.000webhostapp.com",nocase; classtype:attempted-recon; sid:200000369; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"activicionrealy.byethost31.com",nocase; classtype:attempted-recon; sid:200000370; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"actplan.eu",nocase; classtype:attempted-recon; sid:200000371; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"acttivvar2909904.hostkda.com",nocase; classtype:attempted-recon; sid:200000372; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"actualbanrservas.eshost.com.ar",nocase; classtype:attempted-recon; sid:200000373; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"actualisation.ddns.net",nocase; classtype:attempted-recon; sid:200000374; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"actualizaban0954.hostkda.com",nocase; classtype:attempted-recon; sid:200000375; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"actualizaban4568.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200000376; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"actualizaciondefirma.co",nocase; classtype:attempted-recon; sid:200000377; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"actvsanteruy.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200000378; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"acuavalle.gov.co",nocase; classtype:attempted-recon; sid:200000379; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"acune.cacrzurd.com",nocase; classtype:attempted-recon; sid:200000380; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adamfeber.com",nocase; classtype:attempted-recon; sid:200000381; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adanon.com",nocase; classtype:attempted-recon; sid:200000382; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adcloudserver.com",nocase; classtype:attempted-recon; sid:200000383; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adilabadplanning.in",nocase; classtype:attempted-recon; sid:200000384; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adityaschooljabalpur.com",nocase; classtype:attempted-recon; sid:200000385; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adlxkw.covidharsh.com",nocase; classtype:attempted-recon; sid:200000386; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"admin-formserviceupdates.weeblysite.com",nocase; classtype:attempted-recon; sid:200000387; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"admin.baragor.se",nocase; classtype:attempted-recon; sid:200000388; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"admin.dreamploy.com",nocase; classtype:attempted-recon; sid:200000389; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"admin.indramayukab.go.id",nocase; classtype:attempted-recon; sid:200000390; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"admin.ipaoo.fr",nocase; classtype:attempted-recon; sid:200000391; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"admin.sitesumo.com",nocase; classtype:attempted-recon; sid:200000392; rev:1;)
Filter updated: Sun, 26 Sep 2021 00:02:13 +0000
2021-09-26 00:02:13 +00:00
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adminpostalessl.zyrosite.com",nocase; classtype:attempted-recon; sid:200000393; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adpunemploymentclaims.sharefile.com",nocase; classtype:attempted-recon; sid:200000394; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ads-google-think.blogspot.com",nocase; classtype:attempted-recon; sid:200000395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adsaccountbusinesscampaigncreditcoupon.com",nocase; classtype:attempted-recon; sid:200000396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adsbusinesscouponcreditcampaign.com",nocase; classtype:attempted-recon; sid:200000397; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adscampaignbusinesscreditcoupon.com",nocase; classtype:attempted-recon; sid:200000398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adscouponsbusinessaccount.com",nocase; classtype:attempted-recon; sid:200000399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"advenations.com",nocase; classtype:attempted-recon; sid:200000400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"advent.ist",nocase; classtype:attempted-recon; sid:200000401; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adx-exchancesegu2bn-gibcx.com",nocase; classtype:attempted-recon; sid:200000402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aebksvvbiatxhxsykhucgpmtid-dot-gowa11111111.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200000403; rev:1;)
Filter updated: Sun, 26 Sep 2021 12:01:30 +0000
2021-09-26 12:01:30 +00:00
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aenth.com",nocase; classtype:attempted-recon; sid:200000404; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aeoc.cacrzurd.com",nocase; classtype:attempted-recon; sid:200000405; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aeomencarndmsuocaroam.com",nocase; classtype:attempted-recon; sid:200000406; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aeon.cn.casrcd.com",nocase; classtype:attempted-recon; sid:200000407; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aepwfh.covidharsh.com",nocase; classtype:attempted-recon; sid:200000408; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aerflofans.com",nocase; classtype:attempted-recon; sid:200000409; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aeroclubmondovi.it",nocase; classtype:attempted-recon; sid:200000410; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aerorescate.co",nocase; classtype:attempted-recon; sid:200000411; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aestheticar.com.sg",nocase; classtype:attempted-recon; sid:200000412; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aeznus.allkaanet.com",nocase; classtype:attempted-recon; sid:200000413; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"afdfji.tk",nocase; classtype:attempted-recon; sid:200000414; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"afterward-qa.digitaladditive.io",nocase; classtype:attempted-recon; sid:200000415; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"afxdns.covidharsh.com",nocase; classtype:attempted-recon; sid:200000416; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agri72.fr",nocase; classtype:attempted-recon; sid:200000417; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agribisnis.faperta.ulm.ac.id",nocase; classtype:attempted-recon; sid:200000418; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agricol148.temp.swtest.ru",nocase; classtype:attempted-recon; sid:200000419; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agricola-avisosx.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200000420; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agricolabc.hostfree.pw",nocase; classtype:attempted-recon; sid:200000421; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agricolasvsub.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200000422; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agricolaweb.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200000423; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agricolbankofi.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200000424; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agricolieba800.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200000425; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"agrimetiersmartinique.fr",nocase; classtype:attempted-recon; sid:200000426; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ah.com.ge",nocase; classtype:attempted-recon; sid:200000427; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ahaganrtewebb.byethost6.com",nocase; classtype:attempted-recon; sid:200000428; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ahartlawnscaping.com",nocase; classtype:attempted-recon; sid:200000429; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aid-validation-human.run-us-west2.goorm.io",nocase; classtype:attempted-recon; sid:200000430; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ailzux.top",nocase; classtype:attempted-recon; sid:200000431; rev:1;)
Filter updated: Sun, 26 Sep 2021 00:02:13 +0000
2021-09-26 00:02:13 +00:00
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aimocean.top",nocase; classtype:attempted-recon; sid:200000432; rev:1;)
Filter updated: Sun, 26 Sep 2021 12:01:30 +0000
2021-09-26 12:01:30 +00:00
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"air-lccticket.xyz",nocase; classtype:attempted-recon; sid:200000433; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ak-bars-lichnyj-kabinet.ru",nocase; classtype:attempted-recon; sid:200000434; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"akanksha3012.github.io",nocase; classtype:attempted-recon; sid:200000435; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aki-totalmw.com",nocase; classtype:attempted-recon; sid:200000436; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aktualizacja.jst.pl",nocase; classtype:attempted-recon; sid:200000437; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alareentading-catalog.page.tl",nocase; classtype:attempted-recon; sid:200000438; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alaskanmalamute.us",nocase; classtype:attempted-recon; sid:200000439; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"albel.intnet.mu",nocase; classtype:attempted-recon; sid:200000440; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aldana.in",nocase; classtype:attempted-recon; sid:200000441; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alerpro191.hostfree.pw",nocase; classtype:attempted-recon; sid:200000442; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alert-bankingonline.com",nocase; classtype:attempted-recon; sid:200000443; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alert-boi.net",nocase; classtype:attempted-recon; sid:200000444; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alerts-payee-new.com",nocase; classtype:attempted-recon; sid:200000445; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alertsnet.byethost7.com",nocase; classtype:attempted-recon; sid:200000446; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alfaauv.com",nocase; classtype:attempted-recon; sid:200000447; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alfacomputers.be",nocase; classtype:attempted-recon; sid:200000448; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alfaindustrials.co.uk",nocase; classtype:attempted-recon; sid:200000449; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alfasupport.ru",nocase; classtype:attempted-recon; sid:200000450; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"algoass.co.za",nocase; classtype:attempted-recon; sid:200000451; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"algotextil.com.br",nocase; classtype:attempted-recon; sid:200000452; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alias-secureservernet.200835.prohoster.biz",nocase; classtype:attempted-recon; sid:200000453; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alicesecurity.ro",nocase; classtype:attempted-recon; sid:200000454; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aliciabot.azurewebsites.net",nocase; classtype:attempted-recon; sid:200000455; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alienuniversal-earthassociation.org",nocase; classtype:attempted-recon; sid:200000456; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aliexpressi.cam",nocase; classtype:attempted-recon; sid:200000457; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aljrfu.cloudanation.com",nocase; classtype:attempted-recon; sid:200000458; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alkautsar.or.id",nocase; classtype:attempted-recon; sid:200000459; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alkawaterdiy.com",nocase; classtype:attempted-recon; sid:200000460; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alkhalilgraphics.com",nocase; classtype:attempted-recon; sid:200000461; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alkren.pinkmoonltd.com",nocase; classtype:attempted-recon; sid:200000462; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allcaredentalcentre.in",nocase; classtype:attempted-recon; sid:200000463; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alldayhoodie.ca",nocase; classtype:attempted-recon; sid:200000464; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegr0-order.pl-id08842906.xyz",nocase; classtype:attempted-recon; sid:200000465; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegre-order.pl-id08842906.xyz",nocase; classtype:attempted-recon; sid:200000466; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegro-order.pl-id06057206.xyz",nocase; classtype:attempted-recon; sid:200000467; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegro-order.pl-id49214593.xyz",nocase; classtype:attempted-recon; sid:200000468; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegro-order.pl-id60554791.xyz",nocase; classtype:attempted-recon; sid:200000469; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegro-order.pl-id65592797.xyz",nocase; classtype:attempted-recon; sid:200000470; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegro-order.pl-id69372827.xyz",nocase; classtype:attempted-recon; sid:200000471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegro-order.pl-id74829541.xyz",nocase; classtype:attempted-recon; sid:200000472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegro.paym32.info",nocase; classtype:attempted-recon; sid:200000473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegro.pl01.me",nocase; classtype:attempted-recon; sid:200000474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegro.qumucloud.com",nocase; classtype:attempted-recon; sid:200000475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegrolokalnie-pl.id-836272.pw",nocase; classtype:attempted-recon; sid:200000476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allegrolokalnie.store",nocase; classtype:attempted-recon; sid:200000477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allianzbankmypostweb.datlas.it",nocase; classtype:attempted-recon; sid:200000478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allusions.servebeer.com",nocase; classtype:attempted-recon; sid:200000479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allweednedislove.byethost6.com",nocase; classtype:attempted-recon; sid:200000480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alonazohar.co.il",nocase; classtype:attempted-recon; sid:200000481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alpha-mail-server2.ddns.info",nocase; classtype:attempted-recon; sid:200000482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alquileres.com.py",nocase; classtype:attempted-recon; sid:200000483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alquilervillora.net",nocase; classtype:attempted-recon; sid:200000484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alservic-tirmiles.blogspot.com",nocase; classtype:attempted-recon; sid:200000485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alsofft.com",nocase; classtype:attempted-recon; sid:200000486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alsope.covidharsh.com",nocase; classtype:attempted-recon; sid:200000487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"altami.biz.ua",nocase; classtype:attempted-recon; sid:200000488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alumdecor.ru",nocase; classtype:attempted-recon; sid:200000489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alumnimkn.ulm.ac.id",nocase; classtype:attempted-recon; sid:200000490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"am.mskms.top",nocase; classtype:attempted-recon; sid:200000491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaazoo.top",nocase; classtype:attempted-recon; sid:200000492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amacon.serviy-jp.cc",nocase; classtype:attempted-recon; sid:200000493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaens.ortsdf3.top",nocase; classtype:attempted-recon; sid:200000494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaeous.qwrg7.top",nocase; classtype:attempted-recon; sid:200000495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaesu.uirtnh5.top",nocase; classtype:attempted-recon; sid:200000496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaeuo.tromfd3.xyz",nocase; classtype:attempted-recon; sid:200000497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaexc.bfhhj2.top",nocase; classtype:attempted-recon; sid:200000498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaicon-update.njbxss.ga",nocase; classtype:attempted-recon; sid:200000499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaicon-update.xjzzqg.ga",nocase; classtype:attempted-recon; sid:200000500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amanikibera.co.ke",nocase; classtype:attempted-recon; sid:200000501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amanue.opqwv5.top",nocase; classtype:attempted-recon; sid:200000502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amanznon.co.zp.pnzshop.com",nocase; classtype:attempted-recon; sid:200000503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amanzon.co.ip.lezhongtao.com.cn",nocase; classtype:attempted-recon; sid:200000504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amanzon.co.ip.vupshop.com",nocase; classtype:attempted-recon; sid:200000505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amarillovision.net",nocase; classtype:attempted-recon; sid:200000506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaterasu.de",nocase; classtype:attempted-recon; sid:200000507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaueo.nerfgd6.xyz",nocase; classtype:attempted-recon; sid:200000508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amauser.memberupdata.top",nocase; classtype:attempted-recon; sid:200000509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaxcarrentals.com.au",nocase; classtype:attempted-recon; sid:200000510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amayzo.com",nocase; classtype:attempted-recon; sid:200000511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaz0.jpj.wlxio.com.cn",nocase; classtype:attempted-recon; sid:200000512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazamo.co.jp.mastercardnortniahnewestphalialauasi.ml",nocase; classtype:attempted-recon; sid:200000513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazedelectrical.com.au",nocase; classtype:attempted-recon; sid:200000514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazno.j.primyonline.net.cn",nocase; classtype:attempted-recon; sid:200000515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazno.jjp.ldexpo.com.cn",nocase; classtype:attempted-recon; sid:200000516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaznon.co.ip.dfdshop.com",nocase; classtype:attempted-recon; sid:200000517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaznon.co.ip.qumshop.com",nocase; classtype:attempted-recon; sid:200000518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaznon.co.ip.tgvshop.com",nocase; classtype:attempted-recon; sid:200000519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amaznon.co.ip.yiy1hp.cn",nocase; classtype:attempted-recon; sid:200000520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazoe.sonou.xyz",nocase; classtype:attempted-recon; sid:200000521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazoe.soonn.xyz",nocase; classtype:attempted-recon; sid:200000522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazom.ahmengcheng.cn",nocase; classtype:attempted-recon; sid:200000523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazom.bhcqms.rest",nocase; classtype:attempted-recon; sid:200000524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazom.bophpj.shop",nocase; classtype:attempted-recon; sid:200000525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazom.chxkmw.rest",nocase; classtype:attempted-recon; sid:200000526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazom.fhwlmk.rest",nocase; classtype:attempted-recon; sid:200000527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazom.gmhsyx.cn",nocase; classtype:attempted-recon; sid:200000528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazom.ideainternational.cn",nocase; classtype:attempted-recon; sid:200000529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazom.phkqmm.rest",nocase; classtype:attempted-recon; sid:200000530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazom.rhphmt.rest",nocase; classtype:attempted-recon; sid:200000531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-co-jp.wzq997.top",nocase; classtype:attempted-recon; sid:200000532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-co-jp.youtian8332.vip",nocase; classtype:attempted-recon; sid:200000533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-co-jp.youtian8351.vip",nocase; classtype:attempted-recon; sid:200000534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-co-jp.youtian8353.vip",nocase; classtype:attempted-recon; sid:200000535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-co-jp.youtian8356.vip",nocase; classtype:attempted-recon; sid:200000536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-co.1asrss.cn",nocase; classtype:attempted-recon; sid:200000537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-co.5deij1.cn",nocase; classtype:attempted-recon; sid:200000538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-co.jgdcqc.cn",nocase; classtype:attempted-recon; sid:200000539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-co.kk0nrs.cn",nocase; classtype:attempted-recon; sid:200000540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-co.p3nivl0.cn",nocase; classtype:attempted-recon; sid:200000541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-co.rgkcbf.cn",nocase; classtype:attempted-recon; sid:200000542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-co.vvckrz.cn",nocase; classtype:attempted-recon; sid:200000543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-co.xsyidna.cn",nocase; classtype:attempted-recon; sid:200000544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-co.ynrkzn.cn",nocase; classtype:attempted-recon; sid:200000545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-co.yxrszx.cn",nocase; classtype:attempted-recon; sid:200000546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-gcatech.com",nocase; classtype:attempted-recon; sid:200000547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-jp.nllk.shop",nocase; classtype:attempted-recon; sid:200000548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-prime.a3bpk6.cn",nocase; classtype:attempted-recon; sid:200000549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon-prime.aq03oh.cn",nocase; classtype:attempted-recon; sid:200000550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.co.ip.pucoda.cn",nocase; classtype:attempted-recon; sid:200000551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.co.ip.tgor.cn",nocase; classtype:attempted-recon; sid:200000552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.gbvazsz.cn",nocase; classtype:attempted-recon; sid:200000553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazon.haowec.club",nocase; classtype:attempted-recon; sid:200000554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazonfieuytqwsdjfg.xyz",nocase; classtype:attempted-recon; sid:200000555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazonlogistics-ap-northeast-1.amazonlogistics.jp",nocase; classtype:attempted-recon; sid:200000556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazoo.jp.triumbest.net.cn",nocase; classtype:attempted-recon; sid:200000557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amazpo.piojp.adminos.net.cn",nocase; classtype:attempted-recon; sid:200000558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amber.com.ph",nocase; classtype:attempted-recon; sid:200000559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ambienteprotegido.foregon.com",nocase; classtype:attempted-recon; sid:200000560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ambitious-teaching.surge.sh",nocase; classtype:attempted-recon; sid:200000561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amcgardiennage.com",nocase; classtype:attempted-recon; sid:200000562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameport.dattaweb.com",nocase; classtype:attempted-recon; sid:200000563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameport.org",nocase; classtype:attempted-recon; sid:200000564; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"americanexprzss.cn",nocase; classtype:attempted-recon; sid:200000565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"americanexpxzess.cn",nocase; classtype:attempted-recon; sid:200000566; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"americatxexpress.cn",nocase; classtype:attempted-recon; sid:200000567; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"americatxexpress.com",nocase; classtype:attempted-recon; sid:200000568; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"americcovcare.com",nocase; classtype:attempted-recon; sid:200000569; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"americcovrescue.com",nocase; classtype:attempted-recon; sid:200000570; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amerinie47.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200000571; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameueaom.ecrajf.cn",nocase; classtype:attempted-recon; sid:200000572; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameueaom.sabrinasherwo3.cn",nocase; classtype:attempted-recon; sid:200000573; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameueaom.shengjiazx.cn",nocase; classtype:attempted-recon; sid:200000574; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameueaom.szjamiebloome2.cn",nocase; classtype:attempted-recon; sid:200000575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameueaom.szrikoda.cn",nocase; classtype:attempted-recon; sid:200000576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameueaom.szvernejudith2.cn",nocase; classtype:attempted-recon; sid:200000577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameueaom.tiantiangxjs18.cn",nocase; classtype:attempted-recon; sid:200000578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameueaom.tongjun208.cn",nocase; classtype:attempted-recon; sid:200000579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameueaom.twinkleting.cn",nocase; classtype:attempted-recon; sid:200000580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameueaom.wd3v6v.cn",nocase; classtype:attempted-recon; sid:200000581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameueaom.xiaofu3368.cn",nocase; classtype:attempted-recon; sid:200000582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameueaom.xiniucnc.cn",nocase; classtype:attempted-recon; sid:200000583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameueaom.xiwuehgn.cn",nocase; classtype:attempted-recon; sid:200000584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameueaom.yamatake123.cn",nocase; classtype:attempted-recon; sid:200000585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameueaom.yqxinou.cn",nocase; classtype:attempted-recon; sid:200000586; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ameueaom.yudingda123.cn",nocase; classtype:attempted-recon; sid:200000587; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezen.co.jp.a0u0f4j.cn",nocase; classtype:attempted-recon; sid:200000588; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amezon.infotpcard.shop",nocase; classtype:attempted-recon; sid:200000589; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amguevara.com",nocase; classtype:attempted-recon; sid:200000590; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amidabuli.com",nocase; classtype:attempted-recon; sid:200000591; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amitydiamonds.com",nocase; classtype:attempted-recon; sid:200000592; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ammaz0m.co.jp.x5w5ne.cn",nocase; classtype:attempted-recon; sid:200000593; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ammmaz0.jp.jiajiaxing.net.cn",nocase; classtype:attempted-recon; sid:200000594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amous.servepics.com",nocase; classtype:attempted-recon; sid:200000595; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amozanm-rrbrb.cc",nocase; classtype:attempted-recon; sid:200000596; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amozanm-rrere.cc",nocase; classtype:attempted-recon; sid:200000597; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amprojanitorial.com",nocase; classtype:attempted-recon; sid:200000598; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ams-eg.com",nocase; classtype:attempted-recon; sid:200000599; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amtodnshi63.aonmthis.top",nocase; classtype:attempted-recon; sid:200000600; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amuazan-9ufd.mx1q.com",nocase; classtype:attempted-recon; sid:200000601; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amybwt.covidharsh.com",nocase; classtype:attempted-recon; sid:200000602; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amzno.fg-e.org.cn",nocase; classtype:attempted-recon; sid:200000603; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amznoa.china-schools.net.cn",nocase; classtype:attempted-recon; sid:200000604; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amznon.co.jp.amzoccount.online",nocase; classtype:attempted-recon; sid:200000605; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amznoo.evhuangxuntn.net.cn",nocase; classtype:attempted-recon; sid:200000606; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amzona.tal0la9.cn",nocase; classtype:attempted-recon; sid:200000607; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amzonweuysdgfsdjkfgh.xyz",nocase; classtype:attempted-recon; sid:200000608; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amzoz.jp.3dstation.net.cn",nocase; classtype:attempted-recon; sid:200000609; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amzyio.jp.hk-mail.net.cn",nocase; classtype:attempted-recon; sid:200000610; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anabolic-online.com",nocase; classtype:attempted-recon; sid:200000611; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"analyticsfantasticv1.azurewebsites.net",nocase; classtype:attempted-recon; sid:200000612; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anama.qwlju.cn",nocase; classtype:attempted-recon; sid:200000613; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anamoreno27041.vzpla.net",nocase; classtype:attempted-recon; sid:200000614; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anandsr-dev.github.io",nocase; classtype:attempted-recon; sid:200000615; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anarchitecturestudio.com",nocase; classtype:attempted-recon; sid:200000616; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anazno.co.ip.6.cn",nocase; classtype:attempted-recon; sid:200000617; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"andersonstrategic.com.au",nocase; classtype:attempted-recon; sid:200000618; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"andhraelec.com",nocase; classtype:attempted-recon; sid:200000619; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"andishenegah.ir",nocase; classtype:attempted-recon; sid:200000620; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"andre-leone.format.com",nocase; classtype:attempted-recon; sid:200000621; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"angularjs-qgoay2.stackblitz.io",nocase; classtype:attempted-recon; sid:200000622; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anj-azakp.run.goorm.io",nocase; classtype:attempted-recon; sid:200000623; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anjalijha167.github.io",nocase; classtype:attempted-recon; sid:200000624; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anjuliveda.de",nocase; classtype:attempted-recon; sid:200000625; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anmzon.co.ip.tdapfki.cn",nocase; classtype:attempted-recon; sid:200000626; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"annmozan.co.jo.hmibi3q.cn",nocase; classtype:attempted-recon; sid:200000627; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anrazon.szzuosi.cn",nocase; classtype:attempted-recon; sid:200000628; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"antaresns.com",nocase; classtype:attempted-recon; sid:200000629; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anthonyajohnson.com",nocase; classtype:attempted-recon; sid:200000630; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"antiguatabernaqueirolo.com",nocase; classtype:attempted-recon; sid:200000631; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anvpwy.covidharsh.com",nocase; classtype:attempted-recon; sid:200000632; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anzaon.co.jp.accoutsafety.xyz",nocase; classtype:attempted-recon; sid:200000633; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anzhelika25genesh.com",nocase; classtype:attempted-recon; sid:200000634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aocn.careord.com",nocase; classtype:attempted-recon; sid:200000635; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aoeecsmc.aovmeo.com",nocase; classtype:attempted-recon; sid:200000636; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aolupdateterms.weebly.com",nocase; classtype:attempted-recon; sid:200000637; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aomces.aovmeo.com",nocase; classtype:attempted-recon; sid:200000638; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aomnzcz.000webhostapp.com",nocase; classtype:attempted-recon; sid:200000639; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aomsce.aovmeo.com",nocase; classtype:attempted-recon; sid:200000640; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aonn-jp-addmazsdon.shop",nocase; classtype:attempted-recon; sid:200000641; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aoyeanm.yeovessn.com",nocase; classtype:attempted-recon; sid:200000642; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apaic.net",nocase; classtype:attempted-recon; sid:200000643; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apbxkc.covidharsh.com",nocase; classtype:attempted-recon; sid:200000644; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"api.exqodus.com",nocase; classtype:attempted-recon; sid:200000645; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"api.stasto.eu",nocase; classtype:attempted-recon; sid:200000646; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apicola.eu",nocase; classtype:attempted-recon; sid:200000647; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apidgornagenesh.com",nocase; classtype:attempted-recon; sid:200000648; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apoga.net",nocase; classtype:attempted-recon; sid:200000649; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app-dec-access.com",nocase; classtype:attempted-recon; sid:200000650; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app-informativo-online.com",nocase; classtype:attempted-recon; sid:200000651; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app-metam.top",nocase; classtype:attempted-recon; sid:200000652; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app-opensea.io",nocase; classtype:attempted-recon; sid:200000653; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.duel.network",nocase; classtype:attempted-recon; sid:200000654; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.infomovil.digital",nocase; classtype:attempted-recon; sid:200000655; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.n26.com.sicurezzadeldati.com",nocase; classtype:attempted-recon; sid:200000656; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.n26.com.verificatoinformazioni.com",nocase; classtype:attempted-recon; sid:200000657; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.stathisroussos.gr",nocase; classtype:attempted-recon; sid:200000658; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.sugarsync.com",nocase; classtype:attempted-recon; sid:200000659; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.yusraglobai.com",nocase; classtype:attempted-recon; sid:200000660; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app28.greenmail.co.in",nocase; classtype:attempted-recon; sid:200000661; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app44666604777.blogspot.com",nocase; classtype:attempted-recon; sid:200000662; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app66560000.blogspot.com",nocase; classtype:attempted-recon; sid:200000663; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appatualizecef.com",nocase; classtype:attempted-recon; sid:200000664; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appcaixaassinatura.com",nocase; classtype:attempted-recon; sid:200000665; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appcefseguros.me",nocase; classtype:attempted-recon; sid:200000666; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appeal-page-unpublish1107276.web.app",nocase; classtype:attempted-recon; sid:200000667; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appeal-page-unpublish182759.web.app",nocase; classtype:attempted-recon; sid:200000668; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appeal-page-unpublish1827890.web.app",nocase; classtype:attempted-recon; sid:200000669; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appeal-page-unpublish187-36ac4.web.app",nocase; classtype:attempted-recon; sid:200000670; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appeal-page-unpublish18769.web.app",nocase; classtype:attempted-recon; sid:200000671; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appieid.us.com",nocase; classtype:attempted-recon; sid:200000672; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apple.com.services-and-support.com",nocase; classtype:attempted-recon; sid:200000673; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apple.qrlid.com",nocase; classtype:attempted-recon; sid:200000674; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"applebankny.com",nocase; classtype:attempted-recon; sid:200000675; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appleverificationalert.com",nocase; classtype:attempted-recon; sid:200000676; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aprilia69genesh.com",nocase; classtype:attempted-recon; sid:200000677; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apruiz09genesh.com",nocase; classtype:attempted-recon; sid:200000678; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aqse.in",nocase; classtype:attempted-recon; sid:200000679; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aqtv.tv",nocase; classtype:attempted-recon; sid:200000680; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aquapura-eg.com",nocase; classtype:attempted-recon; sid:200000681; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arafathrumman.github.io",nocase; classtype:attempted-recon; sid:200000682; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arawan45.com",nocase; classtype:attempted-recon; sid:200000683; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arcacg.com",nocase; classtype:attempted-recon; sid:200000684; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"archivio-lucaborgioli.belortoscana.it",nocase; classtype:attempted-recon; sid:200000685; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"archivio-supporto.sitoper.it",nocase; classtype:attempted-recon; sid:200000686; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arcomindia.com",nocase; classtype:attempted-recon; sid:200000687; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areacliente-verificar-tarjeta-caixabank.com",nocase; classtype:attempted-recon; sid:200000688; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areueaom.06k315.cn",nocase; classtype:attempted-recon; sid:200000689; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areueaom.0yuec0.cn",nocase; classtype:attempted-recon; sid:200000690; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areueaom.5xz6zx.cn",nocase; classtype:attempted-recon; sid:200000691; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areueaom.dnoq3t.cn",nocase; classtype:attempted-recon; sid:200000692; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areueaom.mmn3xl.cn",nocase; classtype:attempted-recon; sid:200000693; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areueaom.o8tv56.cn",nocase; classtype:attempted-recon; sid:200000694; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"areyourobotornot.blogspot.com",nocase; classtype:attempted-recon; sid:200000695; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"argenahomebanqbe.com",nocase; classtype:attempted-recon; sid:200000696; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"argus-garage-doors-repair.com",nocase; classtype:attempted-recon; sid:200000697; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arihantpharmacy.com",nocase; classtype:attempted-recon; sid:200000698; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arislm.com",nocase; classtype:attempted-recon; sid:200000699; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"armansafavi.nyc",nocase; classtype:attempted-recon; sid:200000700; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"armatheatre.org",nocase; classtype:attempted-recon; sid:200000701; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arnczom.co.jp.s9qh7ud.cn",nocase; classtype:attempted-recon; sid:200000702; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arnzn-co.y3e7pq2.cn",nocase; classtype:attempted-recon; sid:200000703; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aromatic.webenliven.in",nocase; classtype:attempted-recon; sid:200000704; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aroueaom.hcchzd.cn",nocase; classtype:attempted-recon; sid:200000705; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arquimbau.clinicaspresidental.com",nocase; classtype:attempted-recon; sid:200000706; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arris.surveysparrow.com",nocase; classtype:attempted-recon; sid:200000707; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arrizonaa.com",nocase; classtype:attempted-recon; sid:200000708; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arrow.kvalitne.cz",nocase; classtype:attempted-recon; sid:200000709; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arrowcase.com",nocase; classtype:attempted-recon; sid:200000710; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arsnzam.000webhostapp.com",nocase; classtype:attempted-recon; sid:200000711; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"artekcamp.tumblr.com",nocase; classtype:attempted-recon; sid:200000712; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"artemisbetguncel.blogspot.com",nocase; classtype:attempted-recon; sid:200000713; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"artemissbet.blogspot.com",nocase; classtype:attempted-recon; sid:200000714; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"artesimpresas.com",nocase; classtype:attempted-recon; sid:200000715; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"articles.investing-fund.com",nocase; classtype:attempted-recon; sid:200000716; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"artificial-connect.de",nocase; classtype:attempted-recon; sid:200000717; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"artificialconnect.de",nocase; classtype:attempted-recon; sid:200000718; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"artogesres.byethost7.com",nocase; classtype:attempted-recon; sid:200000719; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aruba-iv.blogspot.com",nocase; classtype:attempted-recon; sid:200000720; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ascensoresyaireacondicionado.com",nocase; classtype:attempted-recon; sid:200000721; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ascent-scaffolding.co.uk",nocase; classtype:attempted-recon; sid:200000722; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asdkjalasjdkhfad.byethost33.com",nocase; classtype:attempted-recon; sid:200000723; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aseg.gob.mx",nocase; classtype:attempted-recon; sid:200000724; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asesoriaforonda.com",nocase; classtype:attempted-recon; sid:200000725; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asf.mfvhnrt17z.workers.dev",nocase; classtype:attempted-recon; sid:200000726; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asgard-ampqy.run-us-west2.goorm.io",nocase; classtype:attempted-recon; sid:200000727; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ash14213.mfs.gg",nocase; classtype:attempted-recon; sid:200000728; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ashleygracebridal.com",nocase; classtype:attempted-recon; sid:200000729; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asiadiscoversolutions.azureedge.net",nocase; classtype:attempted-recon; sid:200000730; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asiandrama.ge",nocase; classtype:attempted-recon; sid:200000731; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asiastarchsolutions.com",nocase; classtype:attempted-recon; sid:200000732; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asistente6645.sytes.net",nocase; classtype:attempted-recon; sid:200000733; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asistentevirtual.byethost22.com",nocase; classtype:attempted-recon; sid:200000734; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"askarmotorluaraclar.com",nocase; classtype:attempted-recon; sid:200000735; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asmfol.covidharsh.com",nocase; classtype:attempted-recon; sid:200000736; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asociacionvalleitata.cl",nocase; classtype:attempted-recon; sid:200000737; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asorange.fr",nocase; classtype:attempted-recon; sid:200000738; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asp403r.paperless.com.pe",nocase; classtype:attempted-recon; sid:200000739; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"assets.cdnxz.com",nocase; classtype:attempted-recon; sid:200000740; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"assistance-paiement-securise-leboncoin.com",nocase; classtype:attempted-recon; sid:200000741; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"assistenzaintesaonline.com",nocase; classtype:attempted-recon; sid:200000742; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"assorted-part.surge.sh",nocase; classtype:attempted-recon; sid:200000743; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"assumed-offline-drops-events.trycloudflare.com",nocase; classtype:attempted-recon; sid:200000744; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"astorehub.com",nocase; classtype:attempted-recon; sid:200000745; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"astrohemalath.com",nocase; classtype:attempted-recon; sid:200000746; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asyabahisgiris1.blogspot.com",nocase; classtype:attempted-recon; sid:200000747; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atendentedaycoval.no.comunidades.net",nocase; classtype:attempted-recon; sid:200000748; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atendimento-aocliente.com",nocase; classtype:attempted-recon; sid:200000749; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atendimento-digital.ga",nocase; classtype:attempted-recon; sid:200000750; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atendimentoltau24hrs.com",nocase; classtype:attempted-recon; sid:200000751; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ativacao-online73681.com",nocase; classtype:attempted-recon; sid:200000752; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atsportsclub.com",nocase; classtype:attempted-recon; sid:200000753; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"att.usersupport.net",nocase; classtype:attempted-recon; sid:200000754; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attached-file.gq",nocase; classtype:attempted-recon; sid:200000755; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attcom-prod06a.adobecqms.net",nocase; classtype:attempted-recon; sid:200000756; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attdomainsservices.weebly.com",nocase; classtype:attempted-recon; sid:200000757; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atthffkjfkjfff.weebly.com",nocase; classtype:attempted-recon; sid:200000758; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attnet.hyperphp.com",nocase; classtype:attempted-recon; sid:200000759; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attnet4.aidaform.com",nocase; classtype:attempted-recon; sid:200000760; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attonlineverify.weebly.com",nocase; classtype:attempted-recon; sid:200000761; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attservicesgs.heteml.net",nocase; classtype:attempted-recon; sid:200000762; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attverificationlinkserver.weebly.com",nocase; classtype:attempted-recon; sid:200000763; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atualizacao-online547864.com",nocase; classtype:attempted-recon; sid:200000764; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atualizaonline2533.com",nocase; classtype:attempted-recon; sid:200000765; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atualizarcartaoltaujulho.com",nocase; classtype:attempted-recon; sid:200000766; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"au.rei-npo.org",nocase; classtype:attempted-recon; sid:200000767; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aubootlegger.com",nocase; classtype:attempted-recon; sid:200000768; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aulavirtualecuador.com",nocase; classtype:attempted-recon; sid:200000769; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aupay.auone.jp.gemiterf.gq",nocase; classtype:attempted-recon; sid:200000770; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aupay.conectauone.top",nocase; classtype:attempted-recon; sid:200000771; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aupay.walleauoneauto.shop",nocase; classtype:attempted-recon; sid:200000772; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aupay.wallet.adminauto.shop",nocase; classtype:attempted-recon; sid:200000773; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aushotel.es",nocase; classtype:attempted-recon; sid:200000774; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auth-doc-prohealthpartners.ml",nocase; classtype:attempted-recon; sid:200000775; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auth-entication-required-pay-pal-services.000webhostapp.com",nocase; classtype:attempted-recon; sid:200000776; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auth-webmailakeonetcom.yolasite.com",nocase; classtype:attempted-recon; sid:200000777; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"authenbp.temp.swtest.ru",nocase; classtype:attempted-recon; sid:200000778; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"authenticationteam.creatorlink.net",nocase; classtype:attempted-recon; sid:200000779; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"authorisemytransfer.com",nocase; classtype:attempted-recon; sid:200000780; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"authpay-paxful.com.diitbd.com",nocase; classtype:attempted-recon; sid:200000781; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"authuxeehmutconjxmailssocl.web.app",nocase; classtype:attempted-recon; sid:200000782; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auto24.email",nocase; classtype:attempted-recon; sid:200000783; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autoatendimento.caixaresidencial.com.br",nocase; classtype:attempted-recon; sid:200000784; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autodiscover.gre.ac.uk",nocase; classtype:attempted-recon; sid:200000785; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autodiscover.ryder-dutton.co.uk",nocase; classtype:attempted-recon; sid:200000786; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autodiscover.sandrsecurity.com",nocase; classtype:attempted-recon; sid:200000787; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autoexprs.com",nocase; classtype:attempted-recon; sid:200000788; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autolikesfree.net",nocase; classtype:attempted-recon; sid:200000789; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autominsercive.shop",nocase; classtype:attempted-recon; sid:200000790; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autorizador5.com.br",nocase; classtype:attempted-recon; sid:200000791; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autoscurt24.de",nocase; classtype:attempted-recon; sid:200000792; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autosrobadoschile.com",nocase; classtype:attempted-recon; sid:200000793; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"autoworxchicago.com",nocase; classtype:attempted-recon; sid:200000794; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"avadvertising.in",nocase; classtype:attempted-recon; sid:200000795; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"avashya.com",nocase; classtype:attempted-recon; sid:200000796; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ave.ddnsking.com",nocase; classtype:attempted-recon; sid:200000797; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ave.servehalflife.com",nocase; classtype:attempted-recon; sid:200000798; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"avfallsapp.bozzanova.net",nocase; classtype:attempted-recon; sid:200000799; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"avioni.ru",nocase; classtype:attempted-recon; sid:200000800; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"avishar.ir",nocase; classtype:attempted-recon; sid:200000801; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"avispichinchwe.byethost18.com",nocase; classtype:attempted-recon; sid:200000802; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"avito247onlinepayment.ru",nocase; classtype:attempted-recon; sid:200000803; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"avotresante.ca",nocase; classtype:attempted-recon; sid:200000804; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"awakcm.oozingcloud.com",nocase; classtype:attempted-recon; sid:200000805; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"awgxwv.covidharsh.com",nocase; classtype:attempted-recon; sid:200000806; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"awptdh.webwave.dev",nocase; classtype:attempted-recon; sid:200000807; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aws-ppnet.net",nocase; classtype:attempted-recon; sid:200000808; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"axe.su",nocase; classtype:attempted-recon; sid:200000809; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"axieinfinity.gift",nocase; classtype:attempted-recon; sid:200000810; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"axieinfinity.su",nocase; classtype:attempted-recon; sid:200000811; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"axonicaxonic.info",nocase; classtype:attempted-recon; sid:200000812; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"axxcticionesco30.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200000813; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ayazmasud.buet.ac.bd",nocase; classtype:attempted-recon; sid:200000814; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aywalo.cloudanation.com",nocase; classtype:attempted-recon; sid:200000815; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"azaharpanama.com",nocase; classtype:attempted-recon; sid:200000816; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"azb3s.cf",nocase; classtype:attempted-recon; sid:200000817; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"azcosmn.aomeson.com",nocase; classtype:attempted-recon; sid:200000818; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aziziproperties.com",nocase; classtype:attempted-recon; sid:200000819; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"azosimoveis.com",nocase; classtype:attempted-recon; sid:200000820; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"b-jy0.online",nocase; classtype:attempted-recon; sid:200000821; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"b059c86968a6427389952025bcee9886.svc.dynamics.com",nocase; classtype:attempted-recon; sid:200000822; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"b1144fd15e2f46c05260572855a89a8d-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200000823; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"b1uipxjwz8d.typeform.com",nocase; classtype:attempted-recon; sid:200000824; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"b2bchdistribution.app.link",nocase; classtype:attempted-recon; sid:200000825; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"b339769d305817ab6ebae32a17c720aa-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200000826; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"b4e921f0.sso-mailsrvr-4344e5teed.pages.dev",nocase; classtype:attempted-recon; sid:200000827; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"b96f7f93.sibforms.com",nocase; classtype:attempted-recon; sid:200000828; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"b97bca39.srvr-cloudmail-srvr6754e5rte.pages.dev",nocase; classtype:attempted-recon; sid:200000829; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"babyinch.app",nocase; classtype:attempted-recon; sid:200000830; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"baca-game.com",nocase; classtype:attempted-recon; sid:200000831; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"baccredomatic.crowdicity.com",nocase; classtype:attempted-recon; sid:200000832; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"backupemnuvem.com.br",nocase; classtype:attempted-recon; sid:200000833; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"backyardkilimani.com",nocase; classtype:attempted-recon; sid:200000834; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bacsituvan24h.com",nocase; classtype:attempted-recon; sid:200000835; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"badgeentry.top",nocase; classtype:attempted-recon; sid:200000836; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bag-macben.eu",nocase; classtype:attempted-recon; sid:200000837; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bail-services.i.ng",nocase; classtype:attempted-recon; sid:200000838; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bakerrecklaw.com",nocase; classtype:attempted-recon; sid:200000839; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"baliayurveda.thatsend.dev",nocase; classtype:attempted-recon; sid:200000840; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"balloonexperienceholland.eu",nocase; classtype:attempted-recon; sid:200000841; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bambootrial.top",nocase; classtype:attempted-recon; sid:200000842; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banca-en-lnterbank.aprobada-app.xyz",nocase; classtype:attempted-recon; sid:200000843; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancainterbankpeweb.callingbell.com.bd",nocase; classtype:attempted-recon; sid:200000844; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancainternet-lnterbancape.com",nocase; classtype:attempted-recon; sid:200000845; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancalnternet-interbank.pe-h.com",nocase; classtype:attempted-recon; sid:200000846; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancalnternet-lnterbank.pe-lh.com",nocase; classtype:attempted-recon; sid:200000847; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancapichiflowwd.byethost31.com",nocase; classtype:attempted-recon; sid:200000848; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancapichincha.hostkda.com",nocase; classtype:attempted-recon; sid:200000849; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancapichionliw.byethost4.com",nocase; classtype:attempted-recon; sid:200000850; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporinternet-interbank.pe-logn.com",nocase; classtype:attempted-recon; sid:200000851; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporinternet-netinterbankpe11.com",nocase; classtype:attempted-recon; sid:200000852; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporinternet.interbrnpe.com",nocase; classtype:attempted-recon; sid:200000853; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporinternet.lnterbank-grupo.lntorkal.com",nocase; classtype:attempted-recon; sid:200000854; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporinternet.lnterbank.grupodigital.bnxoperu.com",nocase; classtype:attempted-recon; sid:200000855; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporlnternet-interbank.pe-gg.com",nocase; classtype:attempted-recon; sid:200000856; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporlnternet-interbank.pe-pl.com",nocase; classtype:attempted-recon; sid:200000857; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporlnternet.lnterbank.banceninternet.com",nocase; classtype:attempted-recon; sid:200000858; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaporlnternet.smovil.digital",nocase; classtype:attempted-recon; sid:200000859; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancaprinternet-interbank.pe-ids.com",nocase; classtype:attempted-recon; sid:200000860; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancevirtual.hostkda.com",nocase; classtype:attempted-recon; sid:200000861; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banco-proamerica.2host.me",nocase; classtype:attempted-recon; sid:200000862; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancogalicia.byethost6.com",nocase; classtype:attempted-recon; sid:200000863; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancoiing.site44.com",nocase; classtype:attempted-recon; sid:200000864; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancoiinng.site44.com",nocase; classtype:attempted-recon; sid:200000865; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancomercantil-org.haxsecurity.org",nocase; classtype:attempted-recon; sid:200000866; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banconacional22.sytes.net",nocase; classtype:attempted-recon; sid:200000867; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banconacional8721.medianewsonline.com",nocase; classtype:attempted-recon; sid:200000868; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banconacionalbinc.webnode.com.co",nocase; classtype:attempted-recon; sid:200000869; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banconacionaldecostaricabx.webnode.com.co",nocase; classtype:attempted-recon; sid:200000870; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancoonline.2host.me",nocase; classtype:attempted-recon; sid:200000871; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancopichinchae9.byethost9.com",nocase; classtype:attempted-recon; sid:200000872; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancopromerica00.byethost4.com",nocase; classtype:attempted-recon; sid:200000873; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancopromericac0.byethost7.com",nocase; classtype:attempted-recon; sid:200000874; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancopromericaon.byethost33.com",nocase; classtype:attempted-recon; sid:200000875; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancopromericass.byethost7.com",nocase; classtype:attempted-recon; sid:200000876; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bancwebpichi.byethost8.com",nocase; classtype:attempted-recon; sid:200000877; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bangladesh-association.com",nocase; classtype:attempted-recon; sid:200000878; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bangpromex1.webcindario.com",nocase; classtype:attempted-recon; sid:200000879; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bangrove-ad.com",nocase; classtype:attempted-recon; sid:200000880; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banhywkaie.com",nocase; classtype:attempted-recon; sid:200000881; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banistmo.byethost18.com",nocase; classtype:attempted-recon; sid:200000882; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bank-of-america-secure00.dns05.com",nocase; classtype:attempted-recon; sid:200000883; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bankapolska.com",nocase; classtype:attempted-recon; sid:200000884; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bankaribe01.byethost4.com",nocase; classtype:attempted-recon; sid:200000885; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bankia-933966.ingress-earth.easywp.com",nocase; classtype:attempted-recon; sid:200000886; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bankiigalicia.ihostfull.com",nocase; classtype:attempted-recon; sid:200000887; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banking.n26.com.verificaanagrafici.com",nocase; classtype:attempted-recon; sid:200000888; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bankingalicias.ihostfull.com",nocase; classtype:attempted-recon; sid:200000889; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bankngaliciaa.ihostfull.com",nocase; classtype:attempted-recon; sid:200000890; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bankpromer1ca.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200000891; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bannerchampnyc.com",nocase; classtype:attempted-recon; sid:200000892; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banpichinchaweba.byethost11.com",nocase; classtype:attempted-recon; sid:200000893; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banpichinchweban.byethost17.com",nocase; classtype:attempted-recon; sid:200000894; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banprome.byethost7.com",nocase; classtype:attempted-recon; sid:200000895; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banpromeca12.byethost18.com",nocase; classtype:attempted-recon; sid:200000896; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banreservard2021.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200000897; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"banreservasdigital.com",nocase; classtype:attempted-recon; sid:200000898; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"baradua.it",nocase; classtype:attempted-recon; sid:200000899; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"barocheck.kr",nocase; classtype:attempted-recon; sid:200000900; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"barziz.com",nocase; classtype:attempted-recon; sid:200000901; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bas9casc3.qwe-dasd-asd.workers.dev",nocase; classtype:attempted-recon; sid:200000902; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"basic-connect.ch",nocase; classtype:attempted-recon; sid:200000903; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"basicxacs.cyou",nocase; classtype:attempted-recon; sid:200000904; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"basopkingsantge.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200000905; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"batonrougecargo3830849217.grupokampu.com.pe",nocase; classtype:attempted-recon; sid:200000906; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bay81.com",nocase; classtype:attempted-recon; sid:200000907; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bay81studios.com",nocase; classtype:attempted-recon; sid:200000908; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bbcartoes.net",nocase; classtype:attempted-recon; sid:200000909; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bbncrr.webcindario.com",nocase; classtype:attempted-recon; sid:200000910; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bbsuporteacesso24horas.com",nocase; classtype:attempted-recon; sid:200000911; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bc.lbclbcpaiement.com",nocase; classtype:attempted-recon; sid:200000912; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bc.lebcpaiementlbc.com",nocase; classtype:attempted-recon; sid:200000913; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bc1.paiementervice.com",nocase; classtype:attempted-recon; sid:200000914; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bc3.lbcvirementlbc.com",nocase; classtype:attempted-recon; sid:200000915; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bccminevglobal.com",nocase; classtype:attempted-recon; sid:200000916; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bciwebcyete.000webhostapp.com",nocase; classtype:attempted-recon; sid:200000917; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bcp.futbolfinanciero.com.pe",nocase; classtype:attempted-recon; sid:200000918; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bcpbetazonasegurabetaviabcp.com",nocase; classtype:attempted-recon; sid:200000919; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bcpclientesinfobetasegvra.online",nocase; classtype:attempted-recon; sid:200000920; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bcpjobs.com",nocase; classtype:attempted-recon; sid:200000921; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bcpzonasegurabetaspe.com",nocase; classtype:attempted-recon; sid:200000922; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bcpzonaseguro.viabpc.com",nocase; classtype:attempted-recon; sid:200000923; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bcpzonsegurabeta-vlabcp-com.dtuofus.com",nocase; classtype:attempted-recon; sid:200000924; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bcpzonsegurabeta-vlabcp-com.gurldiro.com",nocase; classtype:attempted-recon; sid:200000925; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bcvsalvador2021.hostfree.pw",nocase; classtype:attempted-recon; sid:200000926; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bdkclientes.com",nocase; classtype:attempted-recon; sid:200000927; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bdnmmp.top",nocase; classtype:attempted-recon; sid:200000928; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bdxxmg.top",nocase; classtype:attempted-recon; sid:200000929; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beast-win.ru",nocase; classtype:attempted-recon; sid:200000930; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beautiful-villani.192-210-132-118.plesk.page",nocase; classtype:attempted-recon; sid:200000931; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bebe1age.com",nocase; classtype:attempted-recon; sid:200000932; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bedah-investasi.muaraenimkab.go.id",nocase; classtype:attempted-recon; sid:200000933; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beetriyadh.com",nocase; classtype:attempted-recon; sid:200000934; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beloanvi333.byethost7.com",nocase; classtype:attempted-recon; sid:200000935; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bemardistribuidora.com.ar",nocase; classtype:attempted-recon; sid:200000936; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"benamejicityofbaseball.com",nocase; classtype:attempted-recon; sid:200000937; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bendigobank.com.au.review-security.info",nocase; classtype:attempted-recon; sid:200000938; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beneluxa.eu",nocase; classtype:attempted-recon; sid:200000939; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"benjasdsdhsdhsdjsdjs.my-board.org",nocase; classtype:attempted-recon; sid:200000940; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"benjim.com",nocase; classtype:attempted-recon; sid:200000941; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"benotea.com",nocase; classtype:attempted-recon; sid:200000942; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"benrefamdksi.blogspot.com",nocase; classtype:attempted-recon; sid:200000943; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beppo.com.br",nocase; classtype:attempted-recon; sid:200000944; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bequeenspoons.com",nocase; classtype:attempted-recon; sid:200000945; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ber-vel.com",nocase; classtype:attempted-recon; sid:200000946; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bergenfamiilycenter.org",nocase; classtype:attempted-recon; sid:200000947; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"berketurizm.com",nocase; classtype:attempted-recon; sid:200000948; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bestbenefitsnow.life",nocase; classtype:attempted-recon; sid:200000949; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bestbusinessplantemplates.com",nocase; classtype:attempted-recon; sid:200000950; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bestbuyturizm.com.tr",nocase; classtype:attempted-recon; sid:200000951; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bestfive.main.jp",nocase; classtype:attempted-recon; sid:200000952; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bestofdance.com",nocase; classtype:attempted-recon; sid:200000953; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"besttest.synergize.co",nocase; classtype:attempted-recon; sid:200000954; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bet.travel",nocase; classtype:attempted-recon; sid:200000955; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betaic-bf.com",nocase; classtype:attempted-recon; sid:200000956; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betaildragon-mon-site-web-cheetah-1.cheetah.builderall.com",nocase; classtype:attempted-recon; sid:200000957; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus.club",nocase; classtype:attempted-recon; sid:200000958; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus.me",nocase; classtype:attempted-recon; sid:200000959; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus020.blogspot.com",nocase; classtype:attempted-recon; sid:200000960; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus021.blogspot.com",nocase; classtype:attempted-recon; sid:200000961; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus09.blogspot.com",nocase; classtype:attempted-recon; sid:200000962; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus111.blogspot.com",nocase; classtype:attempted-recon; sid:200000963; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus199.blogspot.com",nocase; classtype:attempted-recon; sid:200000964; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus2020.blogspot.com",nocase; classtype:attempted-recon; sid:200000965; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus2021.blogspot.com",nocase; classtype:attempted-recon; sid:200000966; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus20211.blogspot.com",nocase; classtype:attempted-recon; sid:200000967; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus20213.blogspot.com",nocase; classtype:attempted-recon; sid:200000968; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus223.blogspot.com",nocase; classtype:attempted-recon; sid:200000969; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus224.blogspot.com",nocase; classtype:attempted-recon; sid:200000970; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus23.blogspot.com",nocase; classtype:attempted-recon; sid:200000971; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus30.blogspot.com",nocase; classtype:attempted-recon; sid:200000972; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus31.blogspot.com",nocase; classtype:attempted-recon; sid:200000973; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus311.blogspot.com",nocase; classtype:attempted-recon; sid:200000974; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus312.blogspot.com",nocase; classtype:attempted-recon; sid:200000975; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus33.blogspot.com",nocase; classtype:attempted-recon; sid:200000976; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus331.blogspot.com",nocase; classtype:attempted-recon; sid:200000977; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus332.blogspot.com",nocase; classtype:attempted-recon; sid:200000978; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus57.blogspot.com",nocase; classtype:attempted-recon; sid:200000979; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus777.blogspot.com",nocase; classtype:attempted-recon; sid:200000980; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasuscom.blogspot.com",nocase; classtype:attempted-recon; sid:200000981; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirdi.blogspot.com",nocase; classtype:attempted-recon; sid:200000982; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgiri.blogspot.com",nocase; classtype:attempted-recon; sid:200000983; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgiris.club",nocase; classtype:attempted-recon; sid:200000984; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgiris11.blogspot.com",nocase; classtype:attempted-recon; sid:200000985; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirisadresi.blogspot.com",nocase; classtype:attempted-recon; sid:200000986; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirisadresimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200000987; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirisburasi.blogspot.com",nocase; classtype:attempted-recon; sid:200000988; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirisburasi3.blogspot.com",nocase; classtype:attempted-recon; sid:200000989; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirisburasi4.blogspot.com",nocase; classtype:attempted-recon; sid:200000990; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirisimiz1.blogspot.com",nocase; classtype:attempted-recon; sid:200000991; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirmek.blogspot.com",nocase; classtype:attempted-recon; sid:200000992; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirmek1.blogspot.com",nocase; classtype:attempted-recon; sid:200000993; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirmekicin.blogspot.com",nocase; classtype:attempted-recon; sid:200000994; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusgirsenesende.blogspot.com",nocase; classtype:attempted-recon; sid:200000995; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusguncelgirisimiz4.blogspot.com",nocase; classtype:attempted-recon; sid:200000996; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasuslink1.blogspot.com",nocase; classtype:attempted-recon; sid:200000997; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasuslinkgir.blogspot.com",nocase; classtype:attempted-recon; sid:200000998; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasuslinkgiris.blogspot.com",nocase; classtype:attempted-recon; sid:200000999; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusorjinal1.blogspot.com",nocase; classtype:attempted-recon; sid:200001000; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusorjinals.blogspot.com",nocase; classtype:attempted-recon; sid:200001001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasussgir.blogspot.com",nocase; classtype:attempted-recon; sid:200001002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasussgiris.blogspot.com",nocase; classtype:attempted-recon; sid:200001003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusss.blogspot.com",nocase; classtype:attempted-recon; sid:200001004; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusturkeygiris.blogspot.com",nocase; classtype:attempted-recon; sid:200001005; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusturkiye.blogspot.com",nocase; classtype:attempted-recon; sid:200001006; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusturkiyee.blogspot.com",nocase; classtype:attempted-recon; sid:200001007; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusum1.blogspot.com",nocase; classtype:attempted-recon; sid:200001008; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasusuyelik.com",nocase; classtype:attempted-recon; sid:200001009; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasviiabcp.site",nocase; classtype:attempted-recon; sid:200001010; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betcupgiris1.blogspot.com",nocase; classtype:attempted-recon; sid:200001011; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betcupgiris2.blogspot.com",nocase; classtype:attempted-recon; sid:200001012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betcupgirisadresimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200001013; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betcupgirisadresimiz1.blogspot.com",nocase; classtype:attempted-recon; sid:200001014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betcupgiriss1.blogspot.com",nocase; classtype:attempted-recon; sid:200001015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betcupum.blogspot.com",nocase; classtype:attempted-recon; sid:200001016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betebet122.blogspot.com",nocase; classtype:attempted-recon; sid:200001017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betebetgirisim.blogspot.com",nocase; classtype:attempted-recon; sid:200001018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betebetgirisimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200001019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betpergir4.blogspot.com",nocase; classtype:attempted-recon; sid:200001020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betpergiris3.blogspot.com",nocase; classtype:attempted-recon; sid:200001021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betpergirisadresimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200001022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betqiuqiu.com",nocase; classtype:attempted-recon; sid:200001023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betterbodynet.acemlnc.com",nocase; classtype:attempted-recon; sid:200001024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betvoysitesi.com",nocase; classtype:attempted-recon; sid:200001025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bexwebmailupdate.web.app",nocase; classtype:attempted-recon; sid:200001026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beyondoutdoor.com.au",nocase; classtype:attempted-recon; sid:200001027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bezperervno.in.net",nocase; classtype:attempted-recon; sid:200001028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bfnotion.ru",nocase; classtype:attempted-recon; sid:200001029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bfsystem.net",nocase; classtype:attempted-recon; sid:200001030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bg5t.gratishosting.cl",nocase; classtype:attempted-recon; sid:200001031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bg5t.rf.gd",nocase; classtype:attempted-recon; sid:200001032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bgmddjczwgtrlwxjhyfahvfuku-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200001033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bgms.cit.net",nocase; classtype:attempted-recon; sid:200001034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bgt1.byethost15.com",nocase; classtype:attempted-recon; sid:200001035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bh068.app.link",nocase; classtype:attempted-recon; sid:200001036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bharathi1809.github.io",nocase; classtype:attempted-recon; sid:200001037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bharatlaboratory.com",nocase; classtype:attempted-recon; sid:200001038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bharattank.me",nocase; classtype:attempted-recon; sid:200001039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bhavin0077.github.io",nocase; classtype:attempted-recon; sid:200001040; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bhfurniture.com.vn",nocase; classtype:attempted-recon; sid:200001041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bibirbajurijuri1.ga",nocase; classtype:attempted-recon; sid:200001042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bibirpetualang3.ml",nocase; classtype:attempted-recon; sid:200001043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bibirpetualang4.ml",nocase; classtype:attempted-recon; sid:200001044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bibirpetualang5.ml",nocase; classtype:attempted-recon; sid:200001045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bibirpetualang6.ml",nocase; classtype:attempted-recon; sid:200001046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"biblio-emi.md",nocase; classtype:attempted-recon; sid:200001047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bibwebshop.com",nocase; classtype:attempted-recon; sid:200001048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bicicentroslezama.com",nocase; classtype:attempted-recon; sid:200001049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bienlinea.com",nocase; classtype:attempted-recon; sid:200001050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bigboxevents.com",nocase; classtype:attempted-recon; sid:200001051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bigskinscsgodota.net.ru",nocase; classtype:attempted-recon; sid:200001052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bik-alert.com",nocase; classtype:attempted-recon; sid:200001053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bilgincam.com.tr",nocase; classtype:attempted-recon; sid:200001054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"billing-errorhelp.com",nocase; classtype:attempted-recon; sid:200001055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"billingfailure-o2.com",nocase; classtype:attempted-recon; sid:200001056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bimoitua.byethost6.com",nocase; classtype:attempted-recon; sid:200001057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"binarybenliveload.com",nocase; classtype:attempted-recon; sid:200001058; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"binomo-registration.com",nocase; classtype:attempted-recon; sid:200001059; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"binoroas.com",nocase; classtype:attempted-recon; sid:200001060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"biquyetcongai.com",nocase; classtype:attempted-recon; sid:200001061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"biswasgroceryandcafe.com",nocase; classtype:attempted-recon; sid:200001062; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.orlen-btk.xyz",nocase; classtype:attempted-recon; sid:200001063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitalchile.cl",nocase; classtype:attempted-recon; sid:200001064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitbaink.web.app",nocase; classtype:attempted-recon; sid:200001065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitferronort.blogspot.com",nocase; classtype:attempted-recon; sid:200001066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bithunnb.web.app",nocase; classtype:attempted-recon; sid:200001067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitpecta.com",nocase; classtype:attempted-recon; sid:200001068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitstarz-kasino.com",nocase; classtype:attempted-recon; sid:200001069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitzclusive.com",nocase; classtype:attempted-recon; sid:200001070; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bixbet.org",nocase; classtype:attempted-recon; sid:200001071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bixlerdesignbuild.com",nocase; classtype:attempted-recon; sid:200001072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bizlinktek.com",nocase; classtype:attempted-recon; sid:200001073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bizzcityinfo.com",nocase; classtype:attempted-recon; sid:200001074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bk.fkip.ulm.ac.id",nocase; classtype:attempted-recon; sid:200001075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"black-base.ru",nocase; classtype:attempted-recon; sid:200001076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"black-queen-d446.mylogindhlupdate.workers.dev",nocase; classtype:attempted-recon; sid:200001077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blanchevetements.com",nocase; classtype:attempted-recon; sid:200001078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bliiss.shop",nocase; classtype:attempted-recon; sid:200001079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blocks.rn86.ru",nocase; classtype:attempted-recon; sid:200001080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blog.cotiabank.paypal-login.us",nocase; classtype:attempted-recon; sid:200001081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blog.fatimaesportes.com.br",nocase; classtype:attempted-recon; sid:200001082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blog.olx.pl.fastpayments.biz",nocase; classtype:attempted-recon; sid:200001083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blog.powerlexis.ru",nocase; classtype:attempted-recon; sid:200001084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blog.premiershop.com.br",nocase; classtype:attempted-recon; sid:200001085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blog.tienghanthaybeo.com",nocase; classtype:attempted-recon; sid:200001086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blog.visionconsulting.ro",nocase; classtype:attempted-recon; sid:200001087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blog.weiwanjia.com",nocase; classtype:attempted-recon; sid:200001088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blogdoaltivo.com.br",nocase; classtype:attempted-recon; sid:200001089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bloomay.co",nocase; classtype:attempted-recon; sid:200001090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blubrown.com",nocase; classtype:attempted-recon; sid:200001091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bluntlogsdhls.b-cdn.net",nocase; classtype:attempted-recon; sid:200001092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"blusyne.lt",nocase; classtype:attempted-recon; sid:200001093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bmartfurniture.com",nocase; classtype:attempted-recon; sid:200001094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bmcfprqnatxlygnsttecjixltl-dot-gowa11111111.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200001095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bnacion.byethost7.com",nocase; classtype:attempted-recon; sid:200001096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bnacionmovil.zonaseguramovil.digital",nocase; classtype:attempted-recon; sid:200001097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bnconacional.odoo.com",nocase; classtype:attempted-recon; sid:200001098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bndigitalpersonas.com",nocase; classtype:attempted-recon; sid:200001099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"boaswp.com",nocase; classtype:attempted-recon; sid:200001100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bodysuited.com",nocase; classtype:attempted-recon; sid:200001101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bogdonovlerer.com",nocase; classtype:attempted-recon; sid:200001102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"boiclub.com",nocase; classtype:attempted-recon; sid:200001103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"boipelohlatshwayo.com",nocase; classtype:attempted-recon; sid:200001104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bokep-viral-pkg.duckdns.org",nocase; classtype:attempted-recon; sid:200001105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bokep-xnxx7.jkub.com",nocase; classtype:attempted-recon; sid:200001106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bokepress2020.dns2.us",nocase; classtype:attempted-recon; sid:200001107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bokgabanesolutions.co.za",nocase; classtype:attempted-recon; sid:200001108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"boliviaayudaa.blogspot.com",nocase; classtype:attempted-recon; sid:200001109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bolong3d.com",nocase; classtype:attempted-recon; sid:200001110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"boma-ren.firebaseapp.com",nocase; classtype:attempted-recon; sid:200001111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bomfretetransportes.com.br",nocase; classtype:attempted-recon; sid:200001112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bonds-oldschools-runescapes.com",nocase; classtype:attempted-recon; sid:200001113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bono-lnterbankpe.com",nocase; classtype:attempted-recon; sid:200001114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"boogeyedindignantly.info",nocase; classtype:attempted-recon; sid:200001115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"book.uz",nocase; classtype:attempted-recon; sid:200001116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bookersbridge.com",nocase; classtype:attempted-recon; sid:200001117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bookfbs.evangsamuelministries.com",nocase; classtype:attempted-recon; sid:200001118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"booking-order.pl-id46112767.xyz",nocase; classtype:attempted-recon; sid:200001119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"booking.abqarie.com",nocase; classtype:attempted-recon; sid:200001120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"booking.pl-id30542198.xyz",nocase; classtype:attempted-recon; sid:200001121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"booking.pl-id32513080.xyz",nocase; classtype:attempted-recon; sid:200001122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"booking.pl-id54418881.xyz",nocase; classtype:attempted-recon; sid:200001123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"booking.pl-id65592797.xyz",nocase; classtype:attempted-recon; sid:200001124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"booswk.com",nocase; classtype:attempted-recon; sid:200001125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bosameri.onlinebusiness.sg",nocase; classtype:attempted-recon; sid:200001126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bosnewpaye.com",nocase; classtype:attempted-recon; sid:200001127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bosquechispazos.com",nocase; classtype:attempted-recon; sid:200001128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bosspandemicgrant.com",nocase; classtype:attempted-recon; sid:200001129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bottesdoc.my-free.website",nocase; classtype:attempted-recon; sid:200001130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bovicor.pl",nocase; classtype:attempted-recon; sid:200001131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"boxes.com.py",nocase; classtype:attempted-recon; sid:200001132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bpd4893.7r6q.mcgarth.com.au",nocase; classtype:attempted-recon; sid:200001133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bpl.kr",nocase; classtype:attempted-recon; sid:200001134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"br194.teste.website",nocase; classtype:attempted-recon; sid:200001135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"br4.in",nocase; classtype:attempted-recon; sid:200001136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"br622.teste.website",nocase; classtype:attempted-recon; sid:200001137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"braccwe.com",nocase; classtype:attempted-recon; sid:200001138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bracows.com",nocase; classtype:attempted-recon; sid:200001139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bradesco1.com",nocase; classtype:attempted-recon; sid:200001140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bradescobonusaqui.io",nocase; classtype:attempted-recon; sid:200001141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"branic.eu",nocase; classtype:attempted-recon; sid:200001142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brannellyoutdoor.com.au",nocase; classtype:attempted-recon; sid:200001143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brassunnysolar.blogspot.com",nocase; classtype:attempted-recon; sid:200001144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bravofoodskitchen.co.za",nocase; classtype:attempted-recon; sid:200001145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brawcws.com",nocase; classtype:attempted-recon; sid:200001146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brawrds.com",nocase; classtype:attempted-recon; sid:200001147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"breakevents.de",nocase; classtype:attempted-recon; sid:200001148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"breakingthelimits.com",nocase; classtype:attempted-recon; sid:200001149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bridgewatereh.com",nocase; classtype:attempted-recon; sid:200001150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brigida_cossette.gitlab.io",nocase; classtype:attempted-recon; sid:200001151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"broacfe.com",nocase; classtype:attempted-recon; sid:200001152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brodcast6002.blogspot.com",nocase; classtype:attempted-recon; sid:200001153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"broeaw.com",nocase; classtype:attempted-recon; sid:200001154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brooksbrasil.com",nocase; classtype:attempted-recon; sid:200001155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brookssalenz.com",nocase; classtype:attempted-recon; sid:200001156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brooksshoessingapore.com",nocase; classtype:attempted-recon; sid:200001157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brookssoldes.fr",nocase; classtype:attempted-recon; sid:200001158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"broowdea.com",nocase; classtype:attempted-recon; sid:200001159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brouhk.com",nocase; classtype:attempted-recon; sid:200001160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"browdfse.com",nocase; classtype:attempted-recon; sid:200001161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brownstone-wealth.com",nocase; classtype:attempted-recon; sid:200001162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bruno-genthial.mykajabi.com",nocase; classtype:attempted-recon; sid:200001163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brunoalmeidanet.000webhostapp.com",nocase; classtype:attempted-recon; sid:200001164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"brwfeai.com",nocase; classtype:attempted-recon; sid:200001165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bt-105198.square.site",nocase; classtype:attempted-recon; sid:200001166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bt-admin.webflow.io",nocase; classtype:attempted-recon; sid:200001167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bt-openreach.4747-update.com",nocase; classtype:attempted-recon; sid:200001168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bt-telecommunication-102883.square.site",nocase; classtype:attempted-recon; sid:200001169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bt-telecommunication-1053.square.site",nocase; classtype:attempted-recon; sid:200001170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bt-verifybilling.com",nocase; classtype:attempted-recon; sid:200001171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bt-world.webflow.io",nocase; classtype:attempted-recon; sid:200001172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btbusinessbilling.wordpress.com",nocase; classtype:attempted-recon; sid:200001173; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btconnectdacsdesrf.yolasite.com",nocase; classtype:attempted-recon; sid:200001174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btconnectfilesecurebthomelogindropboxinkupdatetdropboxpdf-logss.yolasite.com",nocase; classtype:attempted-recon; sid:200001175; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btconnectfilesecurebthomelogindropboxinupdatetdropboxpdf-logss.yolasite.com",nocase; classtype:attempted-recon; sid:200001176; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btconnectfilesecurebthomelogindropboxlinkupdatetdropboxpdf-logs.yolasite.com",nocase; classtype:attempted-recon; sid:200001177; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btconnectfilesecurebthomeloginpdropboxupdatepdf-logsssss-websit.yolasite.com",nocase; classtype:attempted-recon; sid:200001178; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btconnectfilesecurebthomesloginpdropboxupdatepdf-logsssss-websi.yolasite.com",nocase; classtype:attempted-recon; sid:200001179; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btconnetmicrosftbtupdatesecuregrampdfs-website.yolasite.com",nocase; classtype:attempted-recon; sid:200001180; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bthelphub.weebly.com",nocase; classtype:attempted-recon; sid:200001181; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"btworld.webflow.io",nocase; classtype:attempted-recon; sid:200001182; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"budgetbuys.co.za",nocase; classtype:attempted-recon; sid:200001183; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"buildingtradesnetwork.com",nocase; classtype:attempted-recon; sid:200001184; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"buildium.com.au",nocase; classtype:attempted-recon; sid:200001185; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bujikena.web.app",nocase; classtype:attempted-recon; sid:200001186; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"businessemailss.biz",nocase; classtype:attempted-recon; sid:200001187; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"buyelectronicsnyc.com",nocase; classtype:attempted-recon; sid:200001188; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bw-bank.de.account-next.com",nocase; classtype:attempted-recon; sid:200001189; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bwithive.com",nocase; classtype:attempted-recon; sid:200001190; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"byentinfoterra.byethost7.com",nocase; classtype:attempted-recon; sid:200001191; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"byoko.co.kr",nocase; classtype:attempted-recon; sid:200001192; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"byyebaoblnpbwldxefedhkodpr-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200001193; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"byygw.csb.app",nocase; classtype:attempted-recon; sid:200001194; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bzrider.com",nocase; classtype:attempted-recon; sid:200001195; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bzrsuliflygaflfsleorrpbeqv-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200001196; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c.curiousmorty.be",nocase; classtype:attempted-recon; sid:200001197; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c.jardindemiedo.es",nocase; classtype:attempted-recon; sid:200001198; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c.loveawaits.be",nocase; classtype:attempted-recon; sid:200001199; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c.na70.prod.dfg152.ru",nocase; classtype:attempted-recon; sid:200001200; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c.trofeominero.es",nocase; classtype:attempted-recon; sid:200001201; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c00.us",nocase; classtype:attempted-recon; sid:200001202; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c0d2e1cc795cbf7fc42ca6c427f3e66f.mtmba.ru",nocase; classtype:attempted-recon; sid:200001203; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c0hbz754.caspio.com",nocase; classtype:attempted-recon; sid:200001204; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c1970424.ferozo.com",nocase; classtype:attempted-recon; sid:200001205; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c3cd5ac5.sibforms.com",nocase; classtype:attempted-recon; sid:200001206; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c5lws.app.link",nocase; classtype:attempted-recon; sid:200001207; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c6ebl792.caspio.com",nocase; classtype:attempted-recon; sid:200001208; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c6ebv708.caspio.com",nocase; classtype:attempted-recon; sid:200001209; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c7118bbaa21d429462a378145a66fb9c-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200001210; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c7811.wv2.masterbase.com",nocase; classtype:attempted-recon; sid:200001211; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ca45645fggfi88.gb.net",nocase; classtype:attempted-recon; sid:200001212; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cableresellerdeals.com",nocase; classtype:attempted-recon; sid:200001213; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cache.nebula.phx3.secureserver.net",nocase; classtype:attempted-recon; sid:200001214; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cadacosaalseulloc.cresidusvo.info",nocase; classtype:attempted-recon; sid:200001215; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cafejipretona.com",nocase; classtype:attempted-recon; sid:200001216; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cairoscan.com.eg",nocase; classtype:attempted-recon; sid:200001217; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"caixa-gov.com",nocase; classtype:attempted-recon; sid:200001218; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cajuecastanha.art.br",nocase; classtype:attempted-recon; sid:200001219; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cakesbyannemotha.com",nocase; classtype:attempted-recon; sid:200001220; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"calm-bay-082938110.azurestaticapps.net",nocase; classtype:attempted-recon; sid:200001221; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"calstatela.latefa-ahrrare.com",nocase; classtype:attempted-recon; sid:200001222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"calvinkleinindia.co.in",nocase; classtype:attempted-recon; sid:200001223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"calvinkleinsouthafrica.co.za",nocase; classtype:attempted-recon; sid:200001224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"calzadosiris.com",nocase; classtype:attempted-recon; sid:200001225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"camarapiracicaba.zyrosite.com",nocase; classtype:attempted-recon; sid:200001226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cambodiatraining.com",nocase; classtype:attempted-recon; sid:200001227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"camkayamernsgzenmfhfhahikao.com",nocase; classtype:attempted-recon; sid:200001228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"camperpuro.com",nocase; classtype:attempted-recon; sid:200001229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"canaldenegociosb2b.com.br",nocase; classtype:attempted-recon; sid:200001230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cannellandcoflooring.co.uk",nocase; classtype:attempted-recon; sid:200001231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cantonstreetsocialmedia.com",nocase; classtype:attempted-recon; sid:200001232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cantonsurgery.com",nocase; classtype:attempted-recon; sid:200001233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"capeverderealtors.com",nocase; classtype:attempted-recon; sid:200001234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"capholeful1978.blogspot.be",nocase; classtype:attempted-recon; sid:200001235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"capservice.online",nocase; classtype:attempted-recon; sid:200001236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"caracasmateriais.blogspot.com",nocase; classtype:attempted-recon; sid:200001237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"caraopweveyo.com",nocase; classtype:attempted-recon; sid:200001238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"card-entry-trackid-access-denied.codeanyapp.com",nocase; classtype:attempted-recon; sid:200001239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cartao.bradesclub.com",nocase; classtype:attempted-recon; sid:200001240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"carwash.tv",nocase; classtype:attempted-recon; sid:200001241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"casaapisoseacabamentos.com.br",nocase; classtype:attempted-recon; sid:200001242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"casaverdeatelie.com",nocase; classtype:attempted-recon; sid:200001243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cashbox.com.bd",nocase; classtype:attempted-recon; sid:200001244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cashflowfxonline.com",nocase; classtype:attempted-recon; sid:200001245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"casoamarillox949.byethost14.com",nocase; classtype:attempted-recon; sid:200001246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"casosapple.com-verificacionapple.com",nocase; classtype:attempted-recon; sid:200001247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"castcome.berlinmode.com",nocase; classtype:attempted-recon; sid:200001248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"castennisacademy.be",nocase; classtype:attempted-recon; sid:200001249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"castlemarne.com",nocase; classtype:attempted-recon; sid:200001250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"catalogue-orange.com",nocase; classtype:attempted-recon; sid:200001251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cater456harys.gb.net",nocase; classtype:attempted-recon; sid:200001252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"caterin9302.byethost6.com",nocase; classtype:attempted-recon; sid:200001253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cateringfoodanddrinksupplies777.business.site",nocase; classtype:attempted-recon; sid:200001254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cathedral-sagem-tab-speeches.trycloudflare.com",nocase; classtype:attempted-recon; sid:200001255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"catherinehennig.com",nocase; classtype:attempted-recon; sid:200001256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cavallo.vn",nocase; classtype:attempted-recon; sid:200001257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"caycos.beispielseite-wmka.de",nocase; classtype:attempted-recon; sid:200001258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cb64150.tmweb.ru",nocase; classtype:attempted-recon; sid:200001259; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cbdbyrxjessokcpamoitllthky-dot-gowa11111111.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200001260; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cbkcares.org",nocase; classtype:attempted-recon; sid:200001261; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cbl57.csb.app",nocase; classtype:attempted-recon; sid:200001262; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cbtpg.com",nocase; classtype:attempted-recon; sid:200001263; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ccjrlaw.com",nocase; classtype:attempted-recon; sid:200001264; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cd97574.tmweb.ru",nocase; classtype:attempted-recon; sid:200001265; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cdc.ulm.ac.id",nocase; classtype:attempted-recon; sid:200001266; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cdn-enrelief-taxm-irs-gov.com.irs2.info",nocase; classtype:attempted-recon; sid:200001267; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cdn.via.com",nocase; classtype:attempted-recon; sid:200001268; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ce04337.tmweb.ru",nocase; classtype:attempted-recon; sid:200001269; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cea42u7sa1l.typeform.com",nocase; classtype:attempted-recon; sid:200001270; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cebuphonly.jrzoutsourcingservices.com",nocase; classtype:attempted-recon; sid:200001271; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cedarcp.cl",nocase; classtype:attempted-recon; sid:200001272; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cellidplus.com",nocase; classtype:attempted-recon; sid:200001273; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"celtabet2.blogspot.com",nocase; classtype:attempted-recon; sid:200001274; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"celtabet88.blogspot.com",nocase; classtype:attempted-recon; sid:200001275; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"celtabets.blogspot.com",nocase; classtype:attempted-recon; sid:200001276; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"celtabets2020.blogspot.com",nocase; classtype:attempted-recon; sid:200001277; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cema-fossano.it",nocase; classtype:attempted-recon; sid:200001278; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cemalelektronik.com.tr",nocase; classtype:attempted-recon; sid:200001279; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"centec-am.com.br",nocase; classtype:attempted-recon; sid:200001280; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"center-exodus.com",nocase; classtype:attempted-recon; sid:200001281; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"center-kosher.rol.co.il",nocase; classtype:attempted-recon; sid:200001282; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"center-revertion.000webhostapp.com",nocase; classtype:attempted-recon; sid:200001283; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"center-ucmidasbuy.net",nocase; classtype:attempted-recon; sid:200001284; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"centericmailinwebs.wapka.website",nocase; classtype:attempted-recon; sid:200001285; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"centralconsulta.link",nocase; classtype:attempted-recon; sid:200001286; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"centralsuporteavc.comunidades.net",nocase; classtype:attempted-recon; sid:200001287; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"centre1.bubbleapps.io",nocase; classtype:attempted-recon; sid:200001288; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"centriccenteradmin.wapka.website",nocase; classtype:attempted-recon; sid:200001289; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"centruldepiele.ro",nocase; classtype:attempted-recon; sid:200001290; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"certifica-montepaschii.com",nocase; classtype:attempted-recon; sid:200001291; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cete-lem-fatura.net",nocase; classtype:attempted-recon; sid:200001292; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cew.safewallet.replayattack.us",nocase; classtype:attempted-recon; sid:200001293; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ceyssteam.bos.ru",nocase; classtype:attempted-recon; sid:200001294; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cf50l.csb.app",nocase; classtype:attempted-recon; sid:200001295; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cg-oe.snprobbx.pbz.r.de.a2ip.ru",nocase; classtype:attempted-recon; sid:200001296; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cg00737-wordpress-2.tw1.ru",nocase; classtype:attempted-recon; sid:200001297; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ch-my-mtb.com",nocase; classtype:attempted-recon; sid:200001298; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ch.kontoportal.com",nocase; classtype:attempted-recon; sid:200001299; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ch.marketing-gentleman.io",nocase; classtype:attempted-recon; sid:200001300; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ch.net2care.com",nocase; classtype:attempted-recon; sid:200001301; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ch.tcorner.fr",nocase; classtype:attempted-recon; sid:200001302; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ch.v-update.com",nocase; classtype:attempted-recon; sid:200001303; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chaishaica.com",nocase; classtype:attempted-recon; sid:200001304; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"charming-shamir.107-175-83-11.plesk.page",nocase; classtype:attempted-recon; sid:200001305; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"charperimagedesign.com",nocase; classtype:attempted-recon; sid:200001306; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chat-whatasapp.com",nocase; classtype:attempted-recon; sid:200001307; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chat-whatasqp.com",nocase; classtype:attempted-recon; sid:200001308; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chat-whatsapp.doctorhaddadpediatriayflores.cl",nocase; classtype:attempted-recon; sid:200001309; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chat-whatsapp.vizvaz.com",nocase; classtype:attempted-recon; sid:200001310; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chat-whatsapp0.se.ke",nocase; classtype:attempted-recon; sid:200001311; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chat-whatsappgrupjoinbokepweb.zzux.com",nocase; classtype:attempted-recon; sid:200001312; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chatwhatsappgroups11.otzo.com",nocase; classtype:attempted-recon; sid:200001313; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"check-newpayee-halfax.com",nocase; classtype:attempted-recon; sid:200001314; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"checkpayroll.creatorlink.net",nocase; classtype:attempted-recon; sid:200001315; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chef-shehata.us",nocase; classtype:attempted-recon; sid:200001316; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chefrachel.co.uk",nocase; classtype:attempted-recon; sid:200001317; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chemfas.com",nocase; classtype:attempted-recon; sid:200001318; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cherellll.fr",nocase; classtype:attempted-recon; sid:200001319; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chickenempty.top",nocase; classtype:attempted-recon; sid:200001320; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chikkuthomas.github.io",nocase; classtype:attempted-recon; sid:200001321; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chileanylgroup.cl",nocase; classtype:attempted-recon; sid:200001322; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chileflorerias.com",nocase; classtype:attempted-recon; sid:200001323; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chintamanibeachhouse.com",nocase; classtype:attempted-recon; sid:200001324; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chipichahsldservi.000webhostapp.com",nocase; classtype:attempted-recon; sid:200001325; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chirurgie-estetica.md",nocase; classtype:attempted-recon; sid:200001326; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"choices.serveftp.com",nocase; classtype:attempted-recon; sid:200001327; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"choosefrombazar.com",nocase; classtype:attempted-recon; sid:200001328; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"christwepreach.org",nocase; classtype:attempted-recon; sid:200001329; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chungcuvinhomessmartcity.com.vn",nocase; classtype:attempted-recon; sid:200001330; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chuyennghiep.vn",nocase; classtype:attempted-recon; sid:200001331; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chvers1.cloudns.cl",nocase; classtype:attempted-recon; sid:200001332; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ci69056.tmweb.ru",nocase; classtype:attempted-recon; sid:200001333; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cicoef.top",nocase; classtype:attempted-recon; sid:200001334; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ciet-itac.ca",nocase; classtype:attempted-recon; sid:200001335; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cikaja2863.wixsite.com",nocase; classtype:attempted-recon; sid:200001336; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cilerakinakdeniz.com",nocase; classtype:attempted-recon; sid:200001337; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cincinnatl-test.ebpages.com",nocase; classtype:attempted-recon; sid:200001338; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"citaenlineacr.co",nocase; classtype:attempted-recon; sid:200001339; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"citibankonliine.com",nocase; classtype:attempted-recon; sid:200001340; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cities.servequake.com",nocase; classtype:attempted-recon; sid:200001341; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"citsnet.org",nocase; classtype:attempted-recon; sid:200001342; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"city-of-jazz.de",nocase; classtype:attempted-recon; sid:200001343; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"citycouncil-refund.com",nocase; classtype:attempted-recon; sid:200001344; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cityoutlet.es",nocase; classtype:attempted-recon; sid:200001345; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"civdiff.com",nocase; classtype:attempted-recon; sid:200001346; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ck33675.tmweb.ru",nocase; classtype:attempted-recon; sid:200001347; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ckmadae.com",nocase; classtype:attempted-recon; sid:200001348; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ckwgruppe.service-now.com",nocase; classtype:attempted-recon; sid:200001349; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cla2020gov.com",nocase; classtype:attempted-recon; sid:200001350; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"claim.redirect.tax2refunds.com",nocase; classtype:attempted-recon; sid:200001351; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"claimmzmlbbz1.gq",nocase; classtype:attempted-recon; sid:200001352; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"claimmzmlbbz3.tk",nocase; classtype:attempted-recon; sid:200001353; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"claimmzmlbbz5.tk",nocase; classtype:attempted-recon; sid:200001354; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"claimmzmlbbz8.gq",nocase; classtype:attempted-recon; sid:200001355; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"claims-funds-enczj.run-us-west2.goorm.io",nocase; classtype:attempted-recon; sid:200001356; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"claro-controle-downloader.m4u.com.br",nocase; classtype:attempted-recon; sid:200001357; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"classroomnovel.info",nocase; classtype:attempted-recon; sid:200001358; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"claus.bz",nocase; classtype:attempted-recon; sid:200001359; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clearstageconsulting.com",nocase; classtype:attempted-recon; sid:200001360; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clejohn.hyperphp.com",nocase; classtype:attempted-recon; sid:200001361; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clemensrau.de",nocase; classtype:attempted-recon; sid:200001362; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"click-here.it",nocase; classtype:attempted-recon; sid:200001363; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"click.em32dat.eu",nocase; classtype:attempted-recon; sid:200001364; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"client1.server-eventpubgmobile.com",nocase; classtype:attempted-recon; sid:200001365; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cliente.bradesco.validarcadastros.com",nocase; classtype:attempted-recon; sid:200001366; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clientebnreserva.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200001367; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clientes.bradesco.validarcadastros.com",nocase; classtype:attempted-recon; sid:200001368; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clientesyscaixa4.10001mb.com",nocase; classtype:attempted-recon; sid:200001369; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clients.devtux.com",nocase; classtype:attempted-recon; sid:200001370; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clockblox.000webhostapp.com",nocase; classtype:attempted-recon; sid:200001371; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clone-7473c.web.app",nocase; classtype:attempted-recon; sid:200001372; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloud102.hostgator.com",nocase; classtype:attempted-recon; sid:200001373; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; classtype:attempted-recon; sid:200001374; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloudflare-rbnuo.run.goorm.io",nocase; classtype:attempted-recon; sid:200001375; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloudonline1.eddy1702.de",nocase; classtype:attempted-recon; sid:200001376; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloudshare-account-auth.firebaseapp.com",nocase; classtype:attempted-recon; sid:200001377; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloudsraindrop.com",nocase; classtype:attempted-recon; sid:200001378; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clt1234529.bmetrack.com",nocase; classtype:attempted-recon; sid:200001379; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clt1371667.bmetrack.com",nocase; classtype:attempted-recon; sid:200001380; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clubeamigosdopedrosegundo.com.br",nocase; classtype:attempted-recon; sid:200001381; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clxitatey.com",nocase; classtype:attempted-recon; sid:200001382; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cmciasi.ro",nocase; classtype:attempted-recon; sid:200001383; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cn07057.tmweb.ru",nocase; classtype:attempted-recon; sid:200001384; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cn29946.tmweb.ru",nocase; classtype:attempted-recon; sid:200001385; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cnfirmacci3020.hostfree.pw",nocase; classtype:attempted-recon; sid:200001386; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cnl.snprobbx.pbz.r.de.a2ip.ru",nocase; classtype:attempted-recon; sid:200001387; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co-jp.rekanuikr.jp",nocase; classtype:attempted-recon; sid:200001388; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"co-jp.rekanuikr.shop",nocase; classtype:attempted-recon; sid:200001389; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"coanwilliams.com",nocase; classtype:attempted-recon; sid:200001390; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cocovip.net",nocase; classtype:attempted-recon; sid:200001391; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"codashop-payment.kybolink.cf",nocase; classtype:attempted-recon; sid:200001392; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"codashop-ph2020.ezua.com",nocase; classtype:attempted-recon; sid:200001393; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"codashops.net",nocase; classtype:attempted-recon; sid:200001394; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"codeblue.ch.net2care.com",nocase; classtype:attempted-recon; sid:200001395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"codepasta.app",nocase; classtype:attempted-recon; sid:200001396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"coderslashadmin.com",nocase; classtype:attempted-recon; sid:200001397; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"coin-best.club",nocase; classtype:attempted-recon; sid:200001398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"coincheck-137bc.web.app",nocase; classtype:attempted-recon; sid:200001399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"coinconnectwallet.com",nocase; classtype:attempted-recon; sid:200001400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"coinly.cz",nocase; classtype:attempted-recon; sid:200001401; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"colegiomarques.com.br",nocase; classtype:attempted-recon; sid:200001402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"colorfastinv.com",nocase; classtype:attempted-recon; sid:200001403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"columbiapolska.com",nocase; classtype:attempted-recon; sid:200001404; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"columbus.shortest-route.com",nocase; classtype:attempted-recon; sid:200001405; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"com-ikzc4bsnt.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200001406; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"com-vzla.ru",nocase; classtype:attempted-recon; sid:200001407; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"comboniane.org",nocase; classtype:attempted-recon; sid:200001408; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"comfirmpagecenteridentity.co.vu",nocase; classtype:attempted-recon; sid:200001409; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"comigocombr.creatorlink.net",nocase; classtype:attempted-recon; sid:200001410; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"commandes.site",nocase; classtype:attempted-recon; sid:200001411; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"community-diskussionsforen-probleme-klaren-de.totalh.net",nocase; classtype:attempted-recon; sid:200001412; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"community-ebay-forum-clubs-de.html-5.me",nocase; classtype:attempted-recon; sid:200001413; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"community-ebay-t5-discussions-forum.html-5.me",nocase; classtype:attempted-recon; sid:200001414; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"community-ebay-t6-discussions-forum.22web.org",nocase; classtype:attempted-recon; sid:200001415; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"community-ebay-t7-discussions-forum.html-5.me",nocase; classtype:attempted-recon; sid:200001416; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"compliancetrk.com",nocase; classtype:attempted-recon; sid:200001417; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"complyfin.com",nocase; classtype:attempted-recon; sid:200001418; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"comprensivomarrosso.edu.it",nocase; classtype:attempted-recon; sid:200001419; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"comunicationnationalschool.blogspot.com",nocase; classtype:attempted-recon; sid:200001420; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"comunicazioniarubait.tumblr.com",nocase; classtype:attempted-recon; sid:200001421; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"comunity-isue-ideent-andromeda-41.web.id",nocase; classtype:attempted-recon; sid:200001422; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"con-firma.firebaseapp.com",nocase; classtype:attempted-recon; sid:200001423; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"con-tact.xyz",nocase; classtype:attempted-recon; sid:200001424; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"condocopia.org",nocase; classtype:attempted-recon; sid:200001425; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"coneccionclientesbbv.net",nocase; classtype:attempted-recon; sid:200001426; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"conference.pregnacarenigeria.com",nocase; classtype:attempted-recon; sid:200001427; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirm-my-newpayments.com",nocase; classtype:attempted-recon; sid:200001428; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirm-mynew-payments.com",nocase; classtype:attempted-recon; sid:200001429; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirm-mynew-tranfers.com",nocase; classtype:attempted-recon; sid:200001430; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirm-mynew-transactions.com",nocase; classtype:attempted-recon; sid:200001431; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirm-newpayments.com",nocase; classtype:attempted-recon; sid:200001432; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirm-page-identity.my.id",nocase; classtype:attempted-recon; sid:200001433; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirm-pages-department-2021.biz.id",nocase; classtype:attempted-recon; sid:200001434; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirm-social-required-pages.biz.id",nocase; classtype:attempted-recon; sid:200001435; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirm-your-new-payee.com",nocase; classtype:attempted-recon; sid:200001436; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirm.update.pypl.qs2.co",nocase; classtype:attempted-recon; sid:200001437; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirmaci0n3007.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200001438; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirmati0nwe0b.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200001439; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirmationssan.hostfree.pw",nocase; classtype:attempted-recon; sid:200001440; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirming-page-detect-recover.my.id",nocase; classtype:attempted-recon; sid:200001441; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"congresosba.com.ar",nocase; classtype:attempted-recon; sid:200001442; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"connexion-compte-client.freeweb.pk",nocase; classtype:attempted-recon; sid:200001443; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"connexion-service.com",nocase; classtype:attempted-recon; sid:200001444; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"constitutivelystertors.info",nocase; classtype:attempted-recon; sid:200001445; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"constructoravallereal.com",nocase; classtype:attempted-recon; sid:200001446; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"consulting-gvg.com",nocase; classtype:attempted-recon; sid:200001447; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"contapessoal.digital",nocase; classtype:attempted-recon; sid:200001448; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"contractordoc.com",nocase; classtype:attempted-recon; sid:200001449; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"contratodeparceria.com.br",nocase; classtype:attempted-recon; sid:200001450; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"conway.sa",nocase; classtype:attempted-recon; sid:200001451; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"conxwlts.com",nocase; classtype:attempted-recon; sid:200001452; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"coolstool.net",nocase; classtype:attempted-recon; sid:200001453; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corinnakegel.com",nocase; classtype:attempted-recon; sid:200001454; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"corsipercorrispondenza.com",nocase; classtype:attempted-recon; sid:200001455; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cortijolatapia.com",nocase; classtype:attempted-recon; sid:200001456; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cosemu.com",nocase; classtype:attempted-recon; sid:200001457; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"costanacionalexpre.000webhostapp.com",nocase; classtype:attempted-recon; sid:200001458; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"couchpop.com",nocase; classtype:attempted-recon; sid:200001459; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"courseworkwritingsite.com",nocase; classtype:attempted-recon; sid:200001460; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"courtcase.co.in",nocase; classtype:attempted-recon; sid:200001461; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"coutruoms-davipluhome4.eb2a.com",nocase; classtype:attempted-recon; sid:200001462; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"covaricambi.it",nocase; classtype:attempted-recon; sid:200001463; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"covid-19challengecoin.com",nocase; classtype:attempted-recon; sid:200001464; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"covid-foyyn.run-us-west2.goorm.io",nocase; classtype:attempted-recon; sid:200001465; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"covreliefcare.com",nocase; classtype:attempted-recon; sid:200001466; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cox0.yolasite.com",nocase; classtype:attempted-recon; sid:200001467; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cp45362.tmweb.ru",nocase; classtype:attempted-recon; sid:200001468; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cpanel.173-82-255-26.cprapid.com",nocase; classtype:attempted-recon; sid:200001469; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cpanel.telephone-sfr.com",nocase; classtype:attempted-recon; sid:200001470; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cpanel.thepsychedelics.net",nocase; classtype:attempted-recon; sid:200001471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cpanel10wh.bkk1.cloud.z.com",nocase; classtype:attempted-recon; sid:200001472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cpc-lda.co",nocase; classtype:attempted-recon; sid:200001473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cpc.cx",nocase; classtype:attempted-recon; sid:200001474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cpcalendars.granadoemurahara.com.br",nocase; classtype:attempted-recon; sid:200001475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cpcontacts.granadoemurahara.com.br",nocase; classtype:attempted-recon; sid:200001476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cpu30691.mfs.gg",nocase; classtype:attempted-recon; sid:200001477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cr-mufg.co",nocase; classtype:attempted-recon; sid:200001478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"craigslist.d3t7j05qc58fm2.amplifyapp.com",nocase; classtype:attempted-recon; sid:200001479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cranetech.com.br",nocase; classtype:attempted-recon; sid:200001480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"crazyindiandeals.com",nocase; classtype:attempted-recon; sid:200001481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"crbd.net",nocase; classtype:attempted-recon; sid:200001482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"crcandcrcoh.com",nocase; classtype:attempted-recon; sid:200001483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"create-case.com",nocase; classtype:attempted-recon; sid:200001484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creative-console.com",nocase; classtype:attempted-recon; sid:200001485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativenation.co.kr",nocase; classtype:attempted-recon; sid:200001486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"credicorpfiduciariasa.com",nocase; classtype:attempted-recon; sid:200001487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"credifinanciera.didacsis.com",nocase; classtype:attempted-recon; sid:200001488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"credit-agricole-secteurrecuripass.co14252.tmweb.ru",nocase; classtype:attempted-recon; sid:200001489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"credit-suisse.world",nocase; classtype:attempted-recon; sid:200001490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creditagricole.zyrosite.com",nocase; classtype:attempted-recon; sid:200001491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creditiperhabbogratissicuro100.blogspot.it",nocase; classtype:attempted-recon; sid:200001492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creditopessoalitau.com",nocase; classtype:attempted-recon; sid:200001493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"crimeahealth.ru",nocase; classtype:attempted-recon; sid:200001494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"crimson-koalas.com",nocase; classtype:attempted-recon; sid:200001495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cristinamambrini.com.br",nocase; classtype:attempted-recon; sid:200001496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"crmdocentes.xochicalco.edu.mx",nocase; classtype:attempted-recon; sid:200001497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"crmlavoz.lavozdelinterior.net",nocase; classtype:attempted-recon; sid:200001498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cronologiabacw.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200001499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"crpmoney.com",nocase; classtype:attempted-recon; sid:200001500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"crroweb.emiweb.es",nocase; classtype:attempted-recon; sid:200001501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"crudesoldat.com",nocase; classtype:attempted-recon; sid:200001502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"crypto-rewardclaimzz.tk",nocase; classtype:attempted-recon; sid:200001503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"csemergencylock.typeform.com",nocase; classtype:attempted-recon; sid:200001504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"csgoruny.com",nocase; classtype:attempted-recon; sid:200001505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cslanet.ghalisdestock.ma",nocase; classtype:attempted-recon; sid:200001506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"csss.co.jp",nocase; classtype:attempted-recon; sid:200001507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ct08975.tmweb.ru",nocase; classtype:attempted-recon; sid:200001508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ctcseligibility.com",nocase; classtype:attempted-recon; sid:200001509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cu41047.tmweb.ru",nocase; classtype:attempted-recon; sid:200001510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cubachristianbrotherhood.org",nocase; classtype:attempted-recon; sid:200001511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cuenta0bloqueada.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200001512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cureakyara.com.br",nocase; classtype:attempted-recon; sid:200001513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"curiousawkward.xyz",nocase; classtype:attempted-recon; sid:200001514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"current-att0000.weebly.com",nocase; classtype:attempted-recon; sid:200001515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"currentlycom.odoo.com",nocase; classtype:attempted-recon; sid:200001516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"currentlyfromattverificationupdate1.weebly.com",nocase; classtype:attempted-recon; sid:200001517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"customer-ebay.com",nocase; classtype:attempted-recon; sid:200001518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"customer-verification-service.cloudns.asia",nocase; classtype:attempted-recon; sid:200001519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"customer.paypal.restored.cemaco.vn",nocase; classtype:attempted-recon; sid:200001520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cut.li",nocase; classtype:attempted-recon; sid:200001521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cvkry.snprobbx.pbz.r.de.a2ip.ru",nocase; classtype:attempted-recon; sid:200001522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cx97551.tmweb.ru",nocase; classtype:attempted-recon; sid:200001523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cxmx2020atualizacao.com",nocase; classtype:attempted-recon; sid:200001524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cxnhxiiogwamftdqvcwkryytxm-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200001525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cy7xlpjaxh8.typeform.com",nocase; classtype:attempted-recon; sid:200001526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cybersolution.eu",nocase; classtype:attempted-recon; sid:200001527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cycleonline.top",nocase; classtype:attempted-recon; sid:200001528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cyrela-imoveis.blogspot.com",nocase; classtype:attempted-recon; sid:200001529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cz0centrum.com",nocase; classtype:attempted-recon; sid:200001530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cz84.webeden.co.uk",nocase; classtype:attempted-recon; sid:200001531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"czechineseauction.com",nocase; classtype:attempted-recon; sid:200001532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"czpdora.com.mk",nocase; classtype:attempted-recon; sid:200001533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"czsantand3.byethost7.com",nocase; classtype:attempted-recon; sid:200001534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"d18gc1ytkdv37u.cloudfront.net",nocase; classtype:attempted-recon; sid:200001535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"d1yjjnpx0p53s8.cloudfront.net",nocase; classtype:attempted-recon; sid:200001536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"d38ff0bf.ithemeshosting.com.php73-40.lan3-1.websitetestlink.com",nocase; classtype:attempted-recon; sid:200001537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"d3ncuwwrr82.typeform.com",nocase; classtype:attempted-recon; sid:200001538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"d521e3ba-0de3-4eae-a9a8-bafefca61eda.htmlcomponentservice.com",nocase; classtype:attempted-recon; sid:200001539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"d5wxk.csb.app",nocase; classtype:attempted-recon; sid:200001540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"d6185c60.taonbuy.cn",nocase; classtype:attempted-recon; sid:200001541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"da822325-313f-4f85-b334-d9b00a2d64da.htmlcomponentservice.com",nocase; classtype:attempted-recon; sid:200001542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dadagency.in",nocase; classtype:attempted-recon; sid:200001543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dag-mot-lan.firebaseapp.com",nocase; classtype:attempted-recon; sid:200001544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dailyexclusiveoffer.com",nocase; classtype:attempted-recon; sid:200001545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dailysylheterdinkal.com",nocase; classtype:attempted-recon; sid:200001546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dainellistudio.eu",nocase; classtype:attempted-recon; sid:200001547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dalatngaynay.com",nocase; classtype:attempted-recon; sid:200001548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"danaburkart.com",nocase; classtype:attempted-recon; sid:200001549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"daniel-treufeld.de",nocase; classtype:attempted-recon; sid:200001550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"danielescivoli.it",nocase; classtype:attempted-recon; sid:200001551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"daniellygolden.com",nocase; classtype:attempted-recon; sid:200001552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"danielwritingportfolio.com",nocase; classtype:attempted-recon; sid:200001553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"danitraseoexperts.com",nocase; classtype:attempted-recon; sid:200001554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dappswalletsbrowser.com",nocase; classtype:attempted-recon; sid:200001555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"darah.com.br",nocase; classtype:attempted-recon; sid:200001556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"daressalaamtextilemills.com",nocase; classtype:attempted-recon; sid:200001557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"darmowe-tankowanie.click",nocase; classtype:attempted-recon; sid:200001558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dashe.co",nocase; classtype:attempted-recon; sid:200001559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dataupdaterequired.site44.com",nocase; classtype:attempted-recon; sid:200001560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"datelsolutions.co.uk",nocase; classtype:attempted-recon; sid:200001561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"david-held.com",nocase; classtype:attempted-recon; sid:200001562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"daycharacter.com",nocase; classtype:attempted-recon; sid:200001563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"daycoval.contrato.srv.br",nocase; classtype:attempted-recon; sid:200001564; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"daymarkrecovery-electronic-doc.ga",nocase; classtype:attempted-recon; sid:200001565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dazul.com.ar",nocase; classtype:attempted-recon; sid:200001566; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dbs-votes-friend.com",nocase; classtype:attempted-recon; sid:200001567; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dbs.mc.eu1.kontiki.com",nocase; classtype:attempted-recon; sid:200001568; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dchmisfayfounhklgvutbagkgp-dot-gowa11111111.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200001569; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dcinterservices.cz",nocase; classtype:attempted-recon; sid:200001570; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dcrwkudhpygbmrxkgsuwgryhuu-dot-gowa11111111.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200001571; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dctsolution.net",nocase; classtype:attempted-recon; sid:200001572; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dd90001.github.io",nocase; classtype:attempted-recon; sid:200001573; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ddss23hytgcr.byethost7.com",nocase; classtype:attempted-recon; sid:200001574; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dealerzone.greatnortherncabinetry.com",nocase; classtype:attempted-recon; sid:200001575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dealsmart247.com",nocase; classtype:attempted-recon; sid:200001576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deapplemoundo.blogspot.com",nocase; classtype:attempted-recon; sid:200001577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"decaturilbgc.com",nocase; classtype:attempted-recon; sid:200001578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deciduous-groovy-map.glitch.me",nocase; classtype:attempted-recon; sid:200001579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"declicgestion.fr",nocase; classtype:attempted-recon; sid:200001580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"declined-myaccount.com",nocase; classtype:attempted-recon; sid:200001581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dedicatedpasswor.byethost9.com",nocase; classtype:attempted-recon; sid:200001582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deerectus.com",nocase; classtype:attempted-recon; sid:200001583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deficitdeatencionperu.com",nocase; classtype:attempted-recon; sid:200001584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dejpaad.com",nocase; classtype:attempted-recon; sid:200001585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dekasse-berliner.blogspot.com",nocase; classtype:attempted-recon; sid:200001586; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dekoyol.com",nocase; classtype:attempted-recon; sid:200001587; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"delezhen.mashalezhen.com",nocase; classtype:attempted-recon; sid:200001588; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"delgtr.hyperphp.com",nocase; classtype:attempted-recon; sid:200001589; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"delhiescort69.com",nocase; classtype:attempted-recon; sid:200001590; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"delightontour.com",nocase; classtype:attempted-recon; sid:200001591; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"delivery-support-menu.com",nocase; classtype:attempted-recon; sid:200001592; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"delivery-ukpost.com",nocase; classtype:attempted-recon; sid:200001593; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"delivery4kjdfkjdhfj85ysdg9f.ru",nocase; classtype:attempted-recon; sid:200001594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deloitte-fr.career-inspiration.com",nocase; classtype:attempted-recon; sid:200001595; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"delta.flightstatalert.com",nocase; classtype:attempted-recon; sid:200001596; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deltaflights.org",nocase; classtype:attempted-recon; sid:200001597; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"demallplot-tra.web.app",nocase; classtype:attempted-recon; sid:200001598; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"demiregalos.com.ar",nocase; classtype:attempted-recon; sid:200001599; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"demo.bradescocontrol.vertitecnologia.com.br",nocase; classtype:attempted-recon; sid:200001600; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"demo.prunescape.com.au",nocase; classtype:attempted-recon; sid:200001601; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"demo.samretpechfinance.com",nocase; classtype:attempted-recon; sid:200001602; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"demo.ui-theme.ir",nocase; classtype:attempted-recon; sid:200001603; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"den-brogede-verden.dk",nocase; classtype:attempted-recon; sid:200001604; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"denartcc.org",nocase; classtype:attempted-recon; sid:200001605; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"denuihuongson.com.vn",nocase; classtype:attempted-recon; sid:200001606; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deny-application-access.com",nocase; classtype:attempted-recon; sid:200001607; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dependencia.maktubexperiencias.com",nocase; classtype:attempted-recon; sid:200001608; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"derbycast.com",nocase; classtype:attempted-recon; sid:200001609; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deregister-lbpayee.com",nocase; classtype:attempted-recon; sid:200001610; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deregister-lloyd-unauthorisedaccess.com",nocase; classtype:attempted-recon; sid:200001611; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deregister-unverified-seclloyd.com",nocase; classtype:attempted-recon; sid:200001612; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"derfs.hyperphp.com",nocase; classtype:attempted-recon; sid:200001613; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"derhandwerker.io",nocase; classtype:attempted-recon; sid:200001614; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"derlambank.com",nocase; classtype:attempted-recon; sid:200001615; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"des.camellaschool.edu.ph",nocase; classtype:attempted-recon; sid:200001616; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"design101.com.br",nocase; classtype:attempted-recon; sid:200001617; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"designandcraftsmanship.com",nocase; classtype:attempted-recon; sid:200001618; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"designerlakehouse.com",nocase; classtype:attempted-recon; sid:200001619; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"designvision.com.bd",nocase; classtype:attempted-recon; sid:200001620; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"despertardoshormonios.club",nocase; classtype:attempted-recon; sid:200001621; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"detect-new-payee.com",nocase; classtype:attempted-recon; sid:200001622; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deutsche-waerme.de",nocase; classtype:attempted-recon; sid:200001623; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dev-kijnaaho.pantheonsite.io",nocase; classtype:attempted-recon; sid:200001624; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dev-kijnaako.pantheonsite.io",nocase; classtype:attempted-recon; sid:200001625; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dev-nadaj.orlenpaczka.ce5.pl",nocase; classtype:attempted-recon; sid:200001626; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dev-secu-credit-union.pantheonsite.io",nocase; classtype:attempted-recon; sid:200001627; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dev-www.orlenpaczka.ce5.pl",nocase; classtype:attempted-recon; sid:200001628; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dev.prunescape.com.au",nocase; classtype:attempted-recon; sid:200001629; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dev2087.d1v86sffnlajzm.amplifyapp.com",nocase; classtype:attempted-recon; sid:200001630; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dev394.d3j7w12b27aq3y.amplifyapp.com",nocase; classtype:attempted-recon; sid:200001631; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dev3987.d24e5ec703s80e.amplifyapp.com",nocase; classtype:attempted-recon; sid:200001632; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"developmandate.top",nocase; classtype:attempted-recon; sid:200001633; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deviceviolin.top",nocase; classtype:attempted-recon; sid:200001634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"devote.servehttp.com",nocase; classtype:attempted-recon; sid:200001635; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"devrising.in",nocase; classtype:attempted-recon; sid:200001636; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dexlerholdings.com",nocase; classtype:attempted-recon; sid:200001637; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dexterscommunication.in",nocase; classtype:attempted-recon; sid:200001638; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dg54asdg15g1.agilecrm.com",nocase; classtype:attempted-recon; sid:200001639; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dgfchdjwcf.zyrosite.com",nocase; classtype:attempted-recon; sid:200001640; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dgsols.com",nocase; classtype:attempted-recon; sid:200001641; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dhhblwdh.cf",nocase; classtype:attempted-recon; sid:200001642; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dhhblwdh.ga",nocase; classtype:attempted-recon; sid:200001643; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dhl-ru.com",nocase; classtype:attempted-recon; sid:200001644; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dhl-tracking-id.com.u1459991.cp.regruhosting.ru",nocase; classtype:attempted-recon; sid:200001645; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dhl.recruitmentplatform.com",nocase; classtype:attempted-recon; sid:200001646; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dhlgpi.com",nocase; classtype:attempted-recon; sid:200001647; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"diamond-group.ru",nocase; classtype:attempted-recon; sid:200001648; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"die-post-swiss-id-19782635812.psd2any.com",nocase; classtype:attempted-recon; sid:200001649; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"diepost.ship-s.org",nocase; classtype:attempted-recon; sid:200001650; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"diepost.ship-w.org",nocase; classtype:attempted-recon; sid:200001651; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"digibizads.com",nocase; classtype:attempted-recon; sid:200001652; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"digisails.org",nocase; classtype:attempted-recon; sid:200001653; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"digitalkarachi.pk",nocase; classtype:attempted-recon; sid:200001654; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"digitaltaxmatters.co.uk",nocase; classtype:attempted-recon; sid:200001655; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"digitalwarriors.pk",nocase; classtype:attempted-recon; sid:200001656; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"digiteo.pl",nocase; classtype:attempted-recon; sid:200001657; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dik.si",nocase; classtype:attempted-recon; sid:200001658; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dimgizbmxzk3zqucgsq23gin3jooej65i5tikvfumzksjcead2.g814.cn",nocase; classtype:attempted-recon; sid:200001659; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dimolo.activehosted.com",nocase; classtype:attempted-recon; sid:200001660; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dip-audit.ru",nocase; classtype:attempted-recon; sid:200001661; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"directi-smbc.com",nocase; classtype:attempted-recon; sid:200001662; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"directj-smbc.com",nocase; classtype:attempted-recon; sid:200001663; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"directlighting.es",nocase; classtype:attempted-recon; sid:200001664; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"directlngl.temp.swtest.ru",nocase; classtype:attempted-recon; sid:200001665; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"directo-smbc.com",nocase; classtype:attempted-recon; sid:200001666; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"directsites.site44.com",nocase; classtype:attempted-recon; sid:200001667; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dirtbgoneperth.com",nocase; classtype:attempted-recon; sid:200001668; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"discocrd-nitro.com",nocase; classtype:attempted-recon; sid:200001669; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"discorcl-air.xyz",nocase; classtype:attempted-recon; sid:200001670; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"discord-app.net",nocase; classtype:attempted-recon; sid:200001671; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"discord-halloween.com",nocase; classtype:attempted-recon; sid:200001672; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"discord.givaewey.com",nocase; classtype:attempted-recon; sid:200001673; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"discordgifts.ru.com",nocase; classtype:attempted-recon; sid:200001674; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"discordsub.com",nocase; classtype:attempted-recon; sid:200001675; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"discovercoastalvacations.com",nocase; classtype:attempted-recon; sid:200001676; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"discoverhomesgeorgia.com",nocase; classtype:attempted-recon; sid:200001677; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"discriminationnun.info",nocase; classtype:attempted-recon; sid:200001678; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"diskussionsforen-ebay-de.test105227.test-account.com",nocase; classtype:attempted-recon; sid:200001679; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"disney.plus-de.net",nocase; classtype:attempted-recon; sid:200001680; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"disneyplusfreetrial.co.uk",nocase; classtype:attempted-recon; sid:200001681; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dispatch.hermes-tracking-uk.com",nocase; classtype:attempted-recon; sid:200001682; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"displayplanet.pl",nocase; classtype:attempted-recon; sid:200001683; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"distrial.ec",nocase; classtype:attempted-recon; sid:200001684; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dixdomains.com",nocase; classtype:attempted-recon; sid:200001685; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"djaseel.club",nocase; classtype:attempted-recon; sid:200001686; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"djdhe747474.weebly.com",nocase; classtype:attempted-recon; sid:200001687; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"djeliza.be",nocase; classtype:attempted-recon; sid:200001688; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkb-info.com",nocase; classtype:attempted-recon; sid:200001689; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkb1231ag.site44.com",nocase; classtype:attempted-recon; sid:200001690; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkdwmfteuylsitbrsfojilzhad-dot-gowa11111111.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200001691; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkglobaljobs.com",nocase; classtype:attempted-recon; sid:200001692; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dlcsord-airdrop.com",nocase; classtype:attempted-recon; sid:200001693; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dlink.me",nocase; classtype:attempted-recon; sid:200001694; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dlscord-nltro.xyz",nocase; classtype:attempted-recon; sid:200001695; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dlxdgl.com",nocase; classtype:attempted-recon; sid:200001696; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dn1s29yg3m3.typeform.com",nocase; classtype:attempted-recon; sid:200001697; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doc-auth-prohealthpartners.ml",nocase; classtype:attempted-recon; sid:200001698; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doc-auth-prohealthpartners.tk",nocase; classtype:attempted-recon; sid:200001699; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doc-naphcare.org",nocase; classtype:attempted-recon; sid:200001700; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doc-pasadenaisdshop.com",nocase; classtype:attempted-recon; sid:200001701; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doc38347343.knorish.com",nocase; classtype:attempted-recon; sid:200001702; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docholdersignature001001-ezm47.ondigitalocean.app",nocase; classtype:attempted-recon; sid:200001703; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doclab-console-auth.firebaseapp.com",nocase; classtype:attempted-recon; sid:200001704; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs-verify-c671.thajetiase.workers.dev",nocase; classtype:attempted-recon; sid:200001705; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.pancakeswap.finances.barntochef.com",nocase; classtype:attempted-recon; sid:200001706; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.revv.so",nocase; classtype:attempted-recon; sid:200001707; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docsharex-authorize.firebaseapp.com",nocase; classtype:attempted-recon; sid:200001708; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doctorcomboninos1adb.blogspot.com",nocase; classtype:attempted-recon; sid:200001709; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"document.ucraft.site",nocase; classtype:attempted-recon; sid:200001710; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docusign.hill-top-inn.org",nocase; classtype:attempted-recon; sid:200001711; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dodtqfpyqxxydzrcxvrwuolraq-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200001712; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dofus-touch.shop",nocase; classtype:attempted-recon; sid:200001713; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dofus-touch.store",nocase; classtype:attempted-recon; sid:200001714; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doghouserescue.com",nocase; classtype:attempted-recon; sid:200001715; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dollar-cheetah.net",nocase; classtype:attempted-recon; sid:200001716; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dollar-genius.com",nocase; classtype:attempted-recon; sid:200001717; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dollarbillsquick.com",nocase; classtype:attempted-recon; sid:200001718; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dominioits.com",nocase; classtype:attempted-recon; sid:200001719; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"domy-serramenti.it",nocase; classtype:attempted-recon; sid:200001720; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"domystatlab.com",nocase; classtype:attempted-recon; sid:200001721; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"donedealprojects.com",nocase; classtype:attempted-recon; sid:200001722; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dongsuh.net",nocase; classtype:attempted-recon; sid:200001723; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dopeydog.co.nz",nocase; classtype:attempted-recon; sid:200001724; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doppenbergtripcombined.com",nocase; classtype:attempted-recon; sid:200001725; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dostawaolx.pl",nocase; classtype:attempted-recon; sid:200001726; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dotdre.com",nocase; classtype:attempted-recon; sid:200001727; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doublechecklogin.rf.gd",nocase; classtype:attempted-recon; sid:200001728; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"douuodwoman.com",nocase; classtype:attempted-recon; sid:200001729; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dowaba-s2dhl.blogspot.com",nocase; classtype:attempted-recon; sid:200001730; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doz.tode.cz",nocase; classtype:attempted-recon; sid:200001731; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dpasdasfasfasfas.pages.dev",nocase; classtype:attempted-recon; sid:200001732; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dpcpl.com",nocase; classtype:attempted-recon; sid:200001733; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dpd-billingerror.com",nocase; classtype:attempted-recon; sid:200001734; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dpd-parceltracking-status.com",nocase; classtype:attempted-recon; sid:200001735; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dpd-redelivery-uk.com",nocase; classtype:attempted-recon; sid:200001736; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dpd.dostawa-safety.club",nocase; classtype:attempted-recon; sid:200001737; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dpfoidspoifopdsifpoi.blogspot.com",nocase; classtype:attempted-recon; sid:200001738; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dramelgoza.com",nocase; classtype:attempted-recon; sid:200001739; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drasticexclude.top",nocase; classtype:attempted-recon; sid:200001740; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dratsteamfitter.info",nocase; classtype:attempted-recon; sid:200001741; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dravuczpeter.hu",nocase; classtype:attempted-recon; sid:200001742; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drclaudiophd.mfs.gg",nocase; classtype:attempted-recon; sid:200001743; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dreamalive5.com",nocase; classtype:attempted-recon; sid:200001744; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dreamlearn.ind.in",nocase; classtype:attempted-recon; sid:200001745; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dreammteam.com",nocase; classtype:attempted-recon; sid:200001746; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dremlovebd.com",nocase; classtype:attempted-recon; sid:200001747; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drinks-samples-lewis-optimize.trycloudflare.com",nocase; classtype:attempted-recon; sid:200001748; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"driverschoice.sg",nocase; classtype:attempted-recon; sid:200001749; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drivingschoolglasgow.co.uk",nocase; classtype:attempted-recon; sid:200001750; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drumairabubakar.com",nocase; classtype:attempted-recon; sid:200001751; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ds7.main.jp",nocase; classtype:attempted-recon; sid:200001752; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dsgcbeonline.com",nocase; classtype:attempted-recon; sid:200001753; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dsisecure.laoperaciones.com",nocase; classtype:attempted-recon; sid:200001754; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dskedirekt.web.app",nocase; classtype:attempted-recon; sid:200001755; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dslogix.io",nocase; classtype:attempted-recon; sid:200001756; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dsnitro.xyz",nocase; classtype:attempted-recon; sid:200001757; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dspofipsdoifopsdifposidopfi.blogspot.com",nocase; classtype:attempted-recon; sid:200001758; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dtiblog.com",nocase; classtype:attempted-recon; sid:200001759; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dtrexx.com.ng",nocase; classtype:attempted-recon; sid:200001760; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dublinersalicante.com",nocase; classtype:attempted-recon; sid:200001761; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ducommaquinarias.com",nocase; classtype:attempted-recon; sid:200001762; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dudgital.com",nocase; classtype:attempted-recon; sid:200001763; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"duffelbagadventures.com",nocase; classtype:attempted-recon; sid:200001764; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dukhovnist.in.ua",nocase; classtype:attempted-recon; sid:200001765; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dukkanplus.com",nocase; classtype:attempted-recon; sid:200001766; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"durablepools.com",nocase; classtype:attempted-recon; sid:200001767; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dustdearsxx.com",nocase; classtype:attempted-recon; sid:200001768; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dvdvdv.hyperphp.com",nocase; classtype:attempted-recon; sid:200001769; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dvla.myvehicle-rebate.com",nocase; classtype:attempted-recon; sid:200001770; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dvla.support-schemeuk.com",nocase; classtype:attempted-recon; sid:200001771; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dwrat.andalous.org",nocase; classtype:attempted-recon; sid:200001772; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dwsmqrunescape.com-oo.ru",nocase; classtype:attempted-recon; sid:200001773; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dwz.kr",nocase; classtype:attempted-recon; sid:200001774; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dxixisport.com",nocase; classtype:attempted-recon; sid:200001775; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dydy2.app.link",nocase; classtype:attempted-recon; sid:200001776; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dyn.co",nocase; classtype:attempted-recon; sid:200001777; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dynastyclinic.ae",nocase; classtype:attempted-recon; sid:200001778; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dz1-ndfghsjhks-fnhjdgfjd.s3.eu-west-2.amazonaws.com",nocase; classtype:attempted-recon; sid:200001779; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dzd.rksmb.org",nocase; classtype:attempted-recon; sid:200001780; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e-bancapersonal.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200001781; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e-learningmialmaarifmrk.sch.id",nocase; classtype:attempted-recon; sid:200001782; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e-linda.com",nocase; classtype:attempted-recon; sid:200001783; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e-pointpesmobile.cf",nocase; classtype:attempted-recon; sid:200001784; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e-receipts.co",nocase; classtype:attempted-recon; sid:200001785; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e-registration.co.in",nocase; classtype:attempted-recon; sid:200001786; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e-service.org",nocase; classtype:attempted-recon; sid:200001787; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e-serviceparts.info",nocase; classtype:attempted-recon; sid:200001788; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e487-activate-up-date.eu5.net",nocase; classtype:attempted-recon; sid:200001789; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e4ra.byethost8.com",nocase; classtype:attempted-recon; sid:200001790; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e90056aw.bget.ru",nocase; classtype:attempted-recon; sid:200001791; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eagghci.r.bh.d.sendibt3.com",nocase; classtype:attempted-recon; sid:200001792; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eaor.surveysparrow.com",nocase; classtype:attempted-recon; sid:200001793; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"earlystrategies.com",nocase; classtype:attempted-recon; sid:200001794; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"east-sonnychester.bwpsites.com",nocase; classtype:attempted-recon; sid:200001795; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"easyfixmultiservice.com",nocase; classtype:attempted-recon; sid:200001796; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"easypackagecenter.com",nocase; classtype:attempted-recon; sid:200001797; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"easyquotes4you.com",nocase; classtype:attempted-recon; sid:200001798; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eatshapelove.it",nocase; classtype:attempted-recon; sid:200001799; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eba0200d0c.nxcli.net",nocase; classtype:attempted-recon; sid:200001800; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebanking.ing.be-npx.info",nocase; classtype:attempted-recon; sid:200001801; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebay-communaute-fr-t8-forums-de-discussion.22web.org",nocase; classtype:attempted-recon; sid:200001802; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebay-diskussion-forum-de-app.22web.org",nocase; classtype:attempted-recon; sid:200001803; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebay-diskussion-forum-t1-de.22web.org",nocase; classtype:attempted-recon; sid:200001804; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebay-diskussion-forum-t2-de.html-5.me",nocase; classtype:attempted-recon; sid:200001805; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebay-forums-de-discussion-fr.22web.org",nocase; classtype:attempted-recon; sid:200001806; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebay.com-brand-gwen-food-trailer-37353927.3567102.com",nocase; classtype:attempted-recon; sid:200001807; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebay.com-itm.2387687.xyz",nocase; classtype:attempted-recon; sid:200001808; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebay.payment-issues-help.com",nocase; classtype:attempted-recon; sid:200001809; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebaystore.shop",nocase; classtype:attempted-recon; sid:200001810; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebhwt.com.cn",nocase; classtype:attempted-recon; sid:200001811; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebiz4biz.com.cn",nocase; classtype:attempted-recon; sid:200001812; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebuddynews.com",nocase; classtype:attempted-recon; sid:200001813; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eccobutypolska.com",nocase; classtype:attempted-recon; sid:200001814; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eces-ecole.org",nocase; classtype:attempted-recon; sid:200001815; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"echo-nomic.com",nocase; classtype:attempted-recon; sid:200001816; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"echostar.pl",nocase; classtype:attempted-recon; sid:200001817; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eclipsephotovoltech.com",nocase; classtype:attempted-recon; sid:200001818; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eclipsevpn-new.com",nocase; classtype:attempted-recon; sid:200001819; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ecngx290.inmotionhosting.com",nocase; classtype:attempted-recon; sid:200001820; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ecngx300.inmotionhosting.com",nocase; classtype:attempted-recon; sid:200001821; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ecomcrew.staging.wpengine.com",nocase; classtype:attempted-recon; sid:200001822; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ecomuseodebicorp.com",nocase; classtype:attempted-recon; sid:200001823; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"economiaiocupacio.montcada.cat",nocase; classtype:attempted-recon; sid:200001824; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"economicassistancerelief.xyz",nocase; classtype:attempted-recon; sid:200001825; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"edd-ui3.sitey.me",nocase; classtype:attempted-recon; sid:200001826; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eddcard.pcfpl.com",nocase; classtype:attempted-recon; sid:200001827; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"edges.servehttp.com",nocase; classtype:attempted-recon; sid:200001828; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"edgeurl.com",nocase; classtype:attempted-recon; sid:200001829; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"edgeworkflow12.azurefd.net",nocase; classtype:attempted-recon; sid:200001830; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"edhf0c.webwave.dev",nocase; classtype:attempted-recon; sid:200001831; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"editing-dangerous-mine-minneapolis.trycloudflare.com",nocase; classtype:attempted-recon; sid:200001832; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"educationsgain.com",nocase; classtype:attempted-recon; sid:200001833; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ee-servicehub.com",nocase; classtype:attempted-recon; sid:200001834; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ee-verify-billing-secure.com",nocase; classtype:attempted-recon; sid:200001835; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eey203.top",nocase; classtype:attempted-recon; sid:200001836; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"efarms.com.ng",nocase; classtype:attempted-recon; sid:200001837; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"effbcjuu.ga",nocase; classtype:attempted-recon; sid:200001838; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"effect-print.net",nocase; classtype:attempted-recon; sid:200001839; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"efjefhfhasfdjajsdajdjs.my-board.org",nocase; classtype:attempted-recon; sid:200001840; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"egacal.edu.pe",nocase; classtype:attempted-recon; sid:200001841; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eggbox.top",nocase; classtype:attempted-recon; sid:200001842; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eggmutt.com",nocase; classtype:attempted-recon; sid:200001843; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"egypttodaytravel.net",nocase; classtype:attempted-recon; sid:200001844; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eh5ko.csb.app",nocase; classtype:attempted-recon; sid:200001845; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ehan.org",nocase; classtype:attempted-recon; sid:200001846; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eharmonyservice.com",nocase; classtype:attempted-recon; sid:200001847; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ehealthmax.com",nocase; classtype:attempted-recon; sid:200001848; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"einloggen-zur-sparka.xyz",nocase; classtype:attempted-recon; sid:200001849; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ekabel.hu",nocase; classtype:attempted-recon; sid:200001850; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ekaterinaschol.ru",nocase; classtype:attempted-recon; sid:200001851; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ekobebe.cn",nocase; classtype:attempted-recon; sid:200001852; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ekopups.com.ua",nocase; classtype:attempted-recon; sid:200001853; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ekvarika.ru",nocase; classtype:attempted-recon; sid:200001854; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elbroder.com",nocase; classtype:attempted-recon; sid:200001855; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elchavo8181.byethost8.com",nocase; classtype:attempted-recon; sid:200001856; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"electrocoolhvacr.com",nocase; classtype:attempted-recon; sid:200001857; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"electronic-doc-townofscotlandneck.gq",nocase; classtype:attempted-recon; sid:200001858; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"electronicanehuen.com",nocase; classtype:attempted-recon; sid:200001859; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elektro-live.de",nocase; classtype:attempted-recon; sid:200001860; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elektroonline.pl",nocase; classtype:attempted-recon; sid:200001861; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elektrum.top",nocase; classtype:attempted-recon; sid:200001862; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elettrovisiongroup.com",nocase; classtype:attempted-recon; sid:200001863; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elevatebuilders.lv",nocase; classtype:attempted-recon; sid:200001864; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elexbetgir1.blogspot.com",nocase; classtype:attempted-recon; sid:200001865; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elexbetgirisadresimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200001866; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elexusbetgir1.blogspot.com",nocase; classtype:attempted-recon; sid:200001867; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elexusbetgirissitemiz.blogspot.com",nocase; classtype:attempted-recon; sid:200001868; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elexusbettgiris4.blogspot.com",nocase; classtype:attempted-recon; sid:200001869; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elexusgirisim1.blogspot.com",nocase; classtype:attempted-recon; sid:200001870; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ellatinodigital.com",nocase; classtype:attempted-recon; sid:200001871; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elomo.ro",nocase; classtype:attempted-recon; sid:200001872; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eloncoins.space",nocase; classtype:attempted-recon; sid:200001873; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emahajobs.com",nocase; classtype:attempted-recon; sid:200001874; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"email.2020cycling.cc",nocase; classtype:attempted-recon; sid:200001875; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"email.alsea.com.mx",nocase; classtype:attempted-recon; sid:200001876; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"email.stickercanada.com",nocase; classtype:attempted-recon; sid:200001877; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"email.touchbasepro.com",nocase; classtype:attempted-recon; sid:200001878; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"email302.com",nocase; classtype:attempted-recon; sid:200001879; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emailfilter-update.sitebeat.site",nocase; classtype:attempted-recon; sid:200001880; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emailmarketing.profesionalhosting.com",nocase; classtype:attempted-recon; sid:200001881; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emailsettings.webflow.io",nocase; classtype:attempted-recon; sid:200001882; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emausradio.net",nocase; classtype:attempted-recon; sid:200001883; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"embdestech.co.in",nocase; classtype:attempted-recon; sid:200001884; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emebfsasampaio.creatorlink.net",nocase; classtype:attempted-recon; sid:200001885; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emergencyelectricianfulham.co.uk",nocase; classtype:attempted-recon; sid:200001886; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emilianosibada34.byethost4.com",nocase; classtype:attempted-recon; sid:200001887; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eminore.ir",nocase; classtype:attempted-recon; sid:200001888; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emjel.blogspot.com",nocase; classtype:attempted-recon; sid:200001889; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emo.goodislife.shop",nocase; classtype:attempted-recon; sid:200001890; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emo.hnvwpa.shop",nocase; classtype:attempted-recon; sid:200001891; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emo.qkfyqntu.cn",nocase; classtype:attempted-recon; sid:200001892; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"employee-portal.buildingandearth.com",nocase; classtype:attempted-recon; sid:200001893; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"employmentform.godaddysites.com",nocase; classtype:attempted-recon; sid:200001894; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"empresas-lnterlbnlk-pe.com",nocase; classtype:attempted-recon; sid:200001895; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"empresas.lnterbank.bacazinternet.com",nocase; classtype:attempted-recon; sid:200001896; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"empresas.netinterbank.interbol-portal.com",nocase; classtype:attempted-recon; sid:200001897; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emryq.co.ke",nocase; classtype:attempted-recon; sid:200001898; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emsi-lobo.firebaseapp.com",nocase; classtype:attempted-recon; sid:200001899; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emtiaz310.github.io",nocase; classtype:attempted-recon; sid:200001900; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"en-claims-funds-verify.com",nocase; classtype:attempted-recon; sid:200001901; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"en.akirasushi.com.vn",nocase; classtype:attempted-recon; sid:200001902; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"enbolivia.com",nocase; classtype:attempted-recon; sid:200001903; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"encryptdrive.booogle.net",nocase; classtype:attempted-recon; sid:200001904; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"endpointsportal.au-bbva-bancomerappnomina.cloud.goog",nocase; classtype:attempted-recon; sid:200001905; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"enel.folha.bestserviceit.com.br",nocase; classtype:attempted-recon; sid:200001906; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"energygain.co.uk",nocase; classtype:attempted-recon; sid:200001907; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"energynsolucoes.com.br",nocase; classtype:attempted-recon; sid:200001908; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"engcamp.org",nocase; classtype:attempted-recon; sid:200001909; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"englishstudio.ir",nocase; classtype:attempted-recon; sid:200001910; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"enlineamovilapp-aperu-digtal.comtechsystemsinc.com",nocase; classtype:attempted-recon; sid:200001911; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"enorma.is",nocase; classtype:attempted-recon; sid:200001912; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ensemblearsmundi.com",nocase; classtype:attempted-recon; sid:200001913; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"entreobras.com.ar",nocase; classtype:attempted-recon; sid:200001914; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"enviosc-cl.blogspot.com",nocase; classtype:attempted-recon; sid:200001915; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eo.is",nocase; classtype:attempted-recon; sid:200001916; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eparki.com",nocase; classtype:attempted-recon; sid:200001917; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"epcoscard.com",nocase; classtype:attempted-recon; sid:200001918; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"epersonsalvagricolog.freecluster.eu",nocase; classtype:attempted-recon; sid:200001919; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"epicdankbot.com",nocase; classtype:attempted-recon; sid:200001920; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"epiciek.com",nocase; classtype:attempted-recon; sid:200001921; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eproxy.pusan.ac.kr",nocase; classtype:attempted-recon; sid:200001922; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"equalchances.org",nocase; classtype:attempted-recon; sid:200001923; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"equitydwellings.com",nocase; classtype:attempted-recon; sid:200001924; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"erastylogestle039.clickfunnels.com",nocase; classtype:attempted-recon; sid:200001925; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"erfanpaslar.ir",nocase; classtype:attempted-recon; sid:200001926; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ergfg.hyperphp.com",nocase; classtype:attempted-recon; sid:200001927; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ericoutterson.com",nocase; classtype:attempted-recon; sid:200001928; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"erp.oriontravels.com.bd",nocase; classtype:attempted-recon; sid:200001929; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ersal.wuamerigo.com",nocase; classtype:attempted-recon; sid:200001930; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ertlh.denpasarkota.go.id",nocase; classtype:attempted-recon; sid:200001931; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ertu.streamlink.to",nocase; classtype:attempted-recon; sid:200001932; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ervashipping.com",nocase; classtype:attempted-recon; sid:200001933; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ervices.runescape.com-cn.ru",nocase; classtype:attempted-recon; sid:200001934; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ervices.runescape.com-ov.ru",nocase; classtype:attempted-recon; sid:200001935; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"es-dinahosting-comc28abc41.offzarek.com",nocase; classtype:attempted-recon; sid:200001936; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"es.runescape.com-ov.ru",nocase; classtype:attempted-recon; sid:200001937; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eschoolzones.com",nocase; classtype:attempted-recon; sid:200001938; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"esepozir.myhostpoint.ch",nocase; classtype:attempted-recon; sid:200001939; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"esfera-santander.sytes.net",nocase; classtype:attempted-recon; sid:200001940; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"esgcommercialbrokers.com",nocase; classtype:attempted-recon; sid:200001941; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"essence.co.th",nocase; classtype:attempted-recon; sid:200001942; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"estetika2z.com",nocase; classtype:attempted-recon; sid:200001943; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"estudiomaskin.com",nocase; classtype:attempted-recon; sid:200001944; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etasarla.com",nocase; classtype:attempted-recon; sid:200001945; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisa1.xyz",nocase; classtype:attempted-recon; sid:200001946; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisa22.monster",nocase; classtype:attempted-recon; sid:200001947; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisa23.monster",nocase; classtype:attempted-recon; sid:200001948; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisa25.monster",nocase; classtype:attempted-recon; sid:200001949; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisacd1.monster",nocase; classtype:attempted-recon; sid:200001950; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.1ni2qn.cn",nocase; classtype:attempted-recon; sid:200001951; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.1pbpbw.cn",nocase; classtype:attempted-recon; sid:200001952; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.1w6l2l.cn",nocase; classtype:attempted-recon; sid:200001953; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.1y0p65.cn",nocase; classtype:attempted-recon; sid:200001954; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.1zxdmd0.cn",nocase; classtype:attempted-recon; sid:200001955; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.20aayuy.cn",nocase; classtype:attempted-recon; sid:200001956; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.22e57oz.cn",nocase; classtype:attempted-recon; sid:200001957; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.22jp0s.cn",nocase; classtype:attempted-recon; sid:200001958; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.2zgi12b.cn",nocase; classtype:attempted-recon; sid:200001959; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.316g3ii.cn",nocase; classtype:attempted-recon; sid:200001960; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.5wvxlp.cn",nocase; classtype:attempted-recon; sid:200001961; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.7pc4t5.cn",nocase; classtype:attempted-recon; sid:200001962; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.7tn4nkm.cn",nocase; classtype:attempted-recon; sid:200001963; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.7z9s8ua.cn",nocase; classtype:attempted-recon; sid:200001964; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.8r61ly.cn",nocase; classtype:attempted-recon; sid:200001965; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.9hlk91h.cn",nocase; classtype:attempted-recon; sid:200001966; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.co-info.top",nocase; classtype:attempted-recon; sid:200001967; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.cp-jp.xyz",nocase; classtype:attempted-recon; sid:200001968; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.fn-info.top",nocase; classtype:attempted-recon; sid:200001969; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.kyzqmuh.cn",nocase; classtype:attempted-recon; sid:200001970; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.mfkrgtb.cn",nocase; classtype:attempted-recon; sid:200001971; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.ncdcrca.cn",nocase; classtype:attempted-recon; sid:200001972; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.oml5el8.cn",nocase; classtype:attempted-recon; sid:200001973; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.piswph7.cn",nocase; classtype:attempted-recon; sid:200001974; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.pl87dz.cn",nocase; classtype:attempted-recon; sid:200001975; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.q20cxz5.cn",nocase; classtype:attempted-recon; sid:200001976; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.uhkyzia.cn",nocase; classtype:attempted-recon; sid:200001977; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.uny0h0.cn",nocase; classtype:attempted-recon; sid:200001978; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.uq8uok.cn",nocase; classtype:attempted-recon; sid:200001979; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.uu2sqy.cn",nocase; classtype:attempted-recon; sid:200001980; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.uz7r34.cn",nocase; classtype:attempted-recon; sid:200001981; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.zt110v.cn",nocase; classtype:attempted-recon; sid:200001982; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.jp.zxvzjrd.cn",nocase; classtype:attempted-recon; sid:200001983; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.sk9p95.cn",nocase; classtype:attempted-recon; sid:200001984; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.tbizeow.cn",nocase; classtype:attempted-recon; sid:200001985; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.v63a0z.cn",nocase; classtype:attempted-recon; sid:200001986; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.vfi1oj.cn",nocase; classtype:attempted-recon; sid:200001987; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.vn09i1.cn",nocase; classtype:attempted-recon; sid:200001988; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai.xv4p6t.cn",nocase; classtype:attempted-recon; sid:200001989; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai1.buzz",nocase; classtype:attempted-recon; sid:200001990; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisai2.buzz",nocase; classtype:attempted-recon; sid:200001991; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisaif2.monster",nocase; classtype:attempted-recon; sid:200001992; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisaif3.monster",nocase; classtype:attempted-recon; sid:200001993; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisal.zo6f1i.cn",nocase; classtype:attempted-recon; sid:200001994; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisal.zqydp0.cn",nocase; classtype:attempted-recon; sid:200001995; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-meisia.jp.moluqinglian.club",nocase; classtype:attempted-recon; sid:200001996; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-melsal.teiuxxf.cn",nocase; classtype:attempted-recon; sid:200001997; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-nnelsai.26tlse.cn",nocase; classtype:attempted-recon; sid:200001998; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-nnelsai.6tkmmzb.cn",nocase; classtype:attempted-recon; sid:200001999; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-nnelsai.8il3j4.cn",nocase; classtype:attempted-recon; sid:200002000; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-nnelsai.aikablog.cn",nocase; classtype:attempted-recon; sid:200002001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-nnelsai.ansales.cn",nocase; classtype:attempted-recon; sid:200002002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-nnelsai.hcdot.cn",nocase; classtype:attempted-recon; sid:200002003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-nnelsai.kedgebs.com.cn",nocase; classtype:attempted-recon; sid:200002004; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-nnelsai.nx5rc4h.cn",nocase; classtype:attempted-recon; sid:200002005; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-nnelsai.shengchangc.cn",nocase; classtype:attempted-recon; sid:200002006; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-nnelsai.shizuxiehou.cn",nocase; classtype:attempted-recon; sid:200002007; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-nnelsai.tsyjuf4.cn",nocase; classtype:attempted-recon; sid:200002008; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-nnelsai.v7246.cn",nocase; classtype:attempted-recon; sid:200002009; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-nnelsai.weishangga.cn",nocase; classtype:attempted-recon; sid:200002010; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-nnelsai.xealv6.cn",nocase; classtype:attempted-recon; sid:200002011; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-nnelsai.xinrongcompressor.cn",nocase; classtype:attempted-recon; sid:200002012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-nnelsai.yangyanyanjing.cn",nocase; classtype:attempted-recon; sid:200002013; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-nnelsai.yiqiwangluo111.cn",nocase; classtype:attempted-recon; sid:200002014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc-nnelsai.ymmx796.cn",nocase; classtype:attempted-recon; sid:200002015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.5woh02.cn",nocase; classtype:attempted-recon; sid:200002016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.6zzl78.cn",nocase; classtype:attempted-recon; sid:200002017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.aacwwavi.cn",nocase; classtype:attempted-recon; sid:200002018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.aq01nw.cn",nocase; classtype:attempted-recon; sid:200002019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.cslp0d.cn",nocase; classtype:attempted-recon; sid:200002020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.gv0dngk.cn",nocase; classtype:attempted-recon; sid:200002021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.kmnd1o.cn",nocase; classtype:attempted-recon; sid:200002022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.mzfj88.cn",nocase; classtype:attempted-recon; sid:200002023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.saina1232014.cn",nocase; classtype:attempted-recon; sid:200002024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.sealtrade.cn",nocase; classtype:attempted-recon; sid:200002025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.shlizlou4.cn",nocase; classtype:attempted-recon; sid:200002026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.szclarencefre11.cn",nocase; classtype:attempted-recon; sid:200002027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.tq427r.cn",nocase; classtype:attempted-recon; sid:200002028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.tracyingersol2.cn",nocase; classtype:attempted-recon; sid:200002029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.tracywallis.cn",nocase; classtype:attempted-recon; sid:200002030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.trumanlouisa1.cn",nocase; classtype:attempted-recon; sid:200002031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.tubinqiao.cn",nocase; classtype:attempted-recon; sid:200002032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.tzxinhuijixie.cn",nocase; classtype:attempted-recon; sid:200002033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.uriahstevenso3.cn",nocase; classtype:attempted-recon; sid:200002034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.ux8fyn.cn",nocase; classtype:attempted-recon; sid:200002035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.vitamacmillan2.cn",nocase; classtype:attempted-recon; sid:200002036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.w0l13p.cn",nocase; classtype:attempted-recon; sid:200002037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.whuifeng001.cn",nocase; classtype:attempted-recon; sid:200002038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.yahuayelian.cn",nocase; classtype:attempted-recon; sid:200002039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.ygj1qi.cn",nocase; classtype:attempted-recon; sid:200002040; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.yixin3282.cn",nocase; classtype:attempted-recon; sid:200002041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.yueda5188.cn",nocase; classtype:attempted-recon; sid:200002042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.yuejinshiye.cn",nocase; classtype:attempted-recon; sid:200002043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.yunshizhineng.cn",nocase; classtype:attempted-recon; sid:200002044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.yvei8h.cn",nocase; classtype:attempted-recon; sid:200002045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.zhaizhenli.cn",nocase; classtype:attempted-recon; sid:200002046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.zhugan123.cn",nocase; classtype:attempted-recon; sid:200002047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.zqalvincharlo1.cn",nocase; classtype:attempted-recon; sid:200002048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etc1-nnelsai.zzbeatricedupont.cn",nocase; classtype:attempted-recon; sid:200002049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etcmeisai.uxydnhq.cn",nocase; classtype:attempted-recon; sid:200002050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etcmeisal.nnuvqee.cn",nocase; classtype:attempted-recon; sid:200002051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ethelpay.com",nocase; classtype:attempted-recon; sid:200002052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"etrack05.com",nocase; classtype:attempted-recon; sid:200002053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eu-amazon-creturns.com",nocase; classtype:attempted-recon; sid:200002054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eu.nuvuneu.com",nocase; classtype:attempted-recon; sid:200002055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eugnerally-wixsite-com.filesusr.com",nocase; classtype:attempted-recon; sid:200002056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"euroautomentes.hu",nocase; classtype:attempted-recon; sid:200002057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eusa-lombo.firebaseapp.com",nocase; classtype:attempted-recon; sid:200002058; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evashoes.com.ua",nocase; classtype:attempted-recon; sid:200002059; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eve292929.dothome.co.kr",nocase; classtype:attempted-recon; sid:200002060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"event-garena-ff1231.duckdns.org",nocase; classtype:attempted-recon; sid:200002061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eventmaterialcollect.com",nocase; classtype:attempted-recon; sid:200002062; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eventshopunipingames.duckdns.org",nocase; classtype:attempted-recon; sid:200002063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"everestmotors.com.np",nocase; classtype:attempted-recon; sid:200002064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evershineenterprises.co.in",nocase; classtype:attempted-recon; sid:200002065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evershineuae.net",nocase; classtype:attempted-recon; sid:200002066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evotechss.com",nocase; classtype:attempted-recon; sid:200002067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ewroiuwogdsljgsjfdoguraoie.xyz",nocase; classtype:attempted-recon; sid:200002068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ex-m-0.web.app",nocase; classtype:attempted-recon; sid:200002069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"examinacion78.byethost31.com",nocase; classtype:attempted-recon; sid:200002070; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exchange.pancakeswap.finances.barntochef.com",nocase; classtype:attempted-recon; sid:200002071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exchange.pancakeswap.finances.clanventure.com",nocase; classtype:attempted-recon; sid:200002072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exchange4free.com",nocase; classtype:attempted-recon; sid:200002073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exchangedictionary.com",nocase; classtype:attempted-recon; sid:200002074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exit-coin.com",nocase; classtype:attempted-recon; sid:200002075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exobus.net",nocase; classtype:attempted-recon; sid:200002076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exods.online",nocase; classtype:attempted-recon; sid:200002077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exodus-airdrop.com",nocase; classtype:attempted-recon; sid:200002078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exodus-staking.web.app",nocase; classtype:attempted-recon; sid:200002079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exodusc.com",nocase; classtype:attempted-recon; sid:200002080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exodusl.com",nocase; classtype:attempted-recon; sid:200002081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exoduswl.com",nocase; classtype:attempted-recon; sid:200002082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exodvsweb.com",nocase; classtype:attempted-recon; sid:200002083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exosomes.sale",nocase; classtype:attempted-recon; sid:200002084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exoticautowa.com",nocase; classtype:attempted-recon; sid:200002085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"expeditions-of-e.com",nocase; classtype:attempted-recon; sid:200002086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"expenseeraser.com",nocase; classtype:attempted-recon; sid:200002087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"expire-o2-billingupdate.com",nocase; classtype:attempted-recon; sid:200002088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"extension-metamask.com.rstebet.co.id",nocase; classtype:attempted-recon; sid:200002089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"extension.asue.am",nocase; classtype:attempted-recon; sid:200002090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"extracash-interlbankonline.com",nocase; classtype:attempted-recon; sid:200002091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"extracloud.com.au",nocase; classtype:attempted-recon; sid:200002092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"extravasatingmetalworker.com",nocase; classtype:attempted-recon; sid:200002093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exunbiocell.com",nocase; classtype:attempted-recon; sid:200002094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ey8jl.csb.app",nocase; classtype:attempted-recon; sid:200002095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eye-lucir.com",nocase; classtype:attempted-recon; sid:200002096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ezapostille.com",nocase; classtype:attempted-recon; sid:200002097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ezblox.site",nocase; classtype:attempted-recon; sid:200002098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ezssausage.com",nocase; classtype:attempted-recon; sid:200002099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"f.ls",nocase; classtype:attempted-recon; sid:200002100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"f0582771.xsph.ru",nocase; classtype:attempted-recon; sid:200002101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"f6608ee2-6ff1-4dd3-9f74-4b0a066f219c.id.repl.co",nocase; classtype:attempted-recon; sid:200002102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"f6fr7.codesandbox.io",nocase; classtype:attempted-recon; sid:200002103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"f9w1lned0ruqblxi6jahwotak.filesusr.com",nocase; classtype:attempted-recon; sid:200002104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facabook.in",nocase; classtype:attempted-recon; sid:200002105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facbuck.com",nocase; classtype:attempted-recon; sid:200002106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facealert.fr",nocase; classtype:attempted-recon; sid:200002107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"faceb00k.thrillsnation.com",nocase; classtype:attempted-recon; sid:200002108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebook-alert-content.ml",nocase; classtype:attempted-recon; sid:200002109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebook-login.tbit.vn",nocase; classtype:attempted-recon; sid:200002110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebook-validation-check.ml",nocase; classtype:attempted-recon; sid:200002111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebook-verified-adsmanager39829823.ejournal.unmuha.ac.id",nocase; classtype:attempted-recon; sid:200002112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebook.com-marketplace-93839.mediaryte.co",nocase; classtype:attempted-recon; sid:200002113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebook.com-nwkbaviia.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200002114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebook.com-wd5sulr0f5.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200002115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebook.eventspinff.wtf",nocase; classtype:attempted-recon; sid:200002116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebook.hrbureaugh.com",nocase; classtype:attempted-recon; sid:200002117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facebookbusinessaccount.binamulle.com",nocase; classtype:attempted-recon; sid:200002118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"faceibookii.blogspot.com",nocase; classtype:attempted-recon; sid:200002119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"factoryrider.com",nocase; classtype:attempted-recon; sid:200002120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"facturard.com",nocase; classtype:attempted-recon; sid:200002121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"faithcitychapel.org",nocase; classtype:attempted-recon; sid:200002122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"faizankhan0408.github.io",nocase; classtype:attempted-recon; sid:200002123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"faktypolska7.b-cdn.net",nocase; classtype:attempted-recon; sid:200002124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"faleupas.kissr.com",nocase; classtype:attempted-recon; sid:200002125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"famecala.com",nocase; classtype:attempted-recon; sid:200002126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"famiecomea.com",nocase; classtype:attempted-recon; sid:200002127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fancanseda.com",nocase; classtype:attempted-recon; sid:200002128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fancycricket11.com",nocase; classtype:attempted-recon; sid:200002129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fandeoma.com",nocase; classtype:attempted-recon; sid:200002130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fandocean.com",nocase; classtype:attempted-recon; sid:200002131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fantameca.com",nocase; classtype:attempted-recon; sid:200002132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fanxtv.info",nocase; classtype:attempted-recon; sid:200002133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"farmaclub.com.ec",nocase; classtype:attempted-recon; sid:200002134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"farmerhouse.sathyamnextgen.com",nocase; classtype:attempted-recon; sid:200002135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fascinatingquick.top",nocase; classtype:attempted-recon; sid:200002136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fashionphotographycourse.com",nocase; classtype:attempted-recon; sid:200002137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fasthost.hk",nocase; classtype:attempted-recon; sid:200002138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fastskins.ru.com",nocase; classtype:attempted-recon; sid:200002139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fatura-digitalhiiper.net",nocase; classtype:attempted-recon; sid:200002140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fatura-hiiiper-digital.net",nocase; classtype:attempted-recon; sid:200002141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"faturadigiital-hiper.net",nocase; classtype:attempted-recon; sid:200002142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fax.gruppobiesse.it",nocase; classtype:attempted-recon; sid:200002143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"faxitalia.com",nocase; classtype:attempted-recon; sid:200002144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fb-privacy-help-10000001234598695868710.tk",nocase; classtype:attempted-recon; sid:200002145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fb-privacy-help-10000001234598695868715.tk",nocase; classtype:attempted-recon; sid:200002146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fb-privacy-help-1000011234507980591407060.tk",nocase; classtype:attempted-recon; sid:200002147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fb-privacy-help-1000011234507980591407067.tk",nocase; classtype:attempted-recon; sid:200002148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fb-recovery-help-100000012345986958190.ml",nocase; classtype:attempted-recon; sid:200002149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fb-secure-help-100001123450798059174.tk",nocase; classtype:attempted-recon; sid:200002150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fb-security-help-10000001234598695868744.tk",nocase; classtype:attempted-recon; sid:200002151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fb-security-help-10000001234598695868745.tk",nocase; classtype:attempted-recon; sid:200002152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fb-security-help-10000001234598695868746.tk",nocase; classtype:attempted-recon; sid:200002153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fb-security-help-10000001234598695868748.tk",nocase; classtype:attempted-recon; sid:200002154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fb-security-help-10000001234598695868749.tk",nocase; classtype:attempted-recon; sid:200002155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fb-verified-account2903283.smpn3sk.sch.id",nocase; classtype:attempted-recon; sid:200002156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fb.expressturkeyi.com",nocase; classtype:attempted-recon; sid:200002157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fb.probox.lk",nocase; classtype:attempted-recon; sid:200002158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fb7927.bget.ru",nocase; classtype:attempted-recon; sid:200002159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fbcom-2oemj4g3j.streamsteam.ca",nocase; classtype:attempted-recon; sid:200002160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fbcom-39jq7lml83.streamsteam.ca",nocase; classtype:attempted-recon; sid:200002161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fbcom-3ro3nng7.streamsteam.ca",nocase; classtype:attempted-recon; sid:200002162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fbcom-461utr3op.streamsteam.ca",nocase; classtype:attempted-recon; sid:200002163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fbcom-7dimcty4.streamsteam.ca",nocase; classtype:attempted-recon; sid:200002164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fbcom-7pt7rdqfb8.streamsteam.ca",nocase; classtype:attempted-recon; sid:200002165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fbcom-8mqggv786m.streamsteam.ca",nocase; classtype:attempted-recon; sid:200002166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fbcom-cq1nduup95.streamsteam.ca",nocase; classtype:attempted-recon; sid:200002167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fbcom-evkmdzo8ig.streamsteam.ca",nocase; classtype:attempted-recon; sid:200002168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fbcom-lkt6sgmqe.streamsteam.ca",nocase; classtype:attempted-recon; sid:200002169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fbcom-pwtdp8c3i.streamsteam.ca",nocase; classtype:attempted-recon; sid:200002170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fbcom-shlb2vg1hx.streamsteam.ca",nocase; classtype:attempted-recon; sid:200002171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fbcom-wtcsucu1.streamsteam.ca",nocase; classtype:attempted-recon; sid:200002172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fbcom-z1tfm09d.streamsteam.ca",nocase; classtype:attempted-recon; sid:200002173; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fbead23swus.gb.net",nocase; classtype:attempted-recon; sid:200002174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fbforpages1414141.web.app",nocase; classtype:attempted-recon; sid:200002175; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fbforpages1848151.web.app",nocase; classtype:attempted-recon; sid:200002176; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fbmarketplace-raywhite-property30041.com",nocase; classtype:attempted-recon; sid:200002177; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fbpages-claim-center.my.id",nocase; classtype:attempted-recon; sid:200002178; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fbvote-internationa-program-contest-k.000webhostapp.com",nocase; classtype:attempted-recon; sid:200002179; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fdx.co.th",nocase; classtype:attempted-recon; sid:200002180; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"feceboolk.blogspot.com",nocase; classtype:attempted-recon; sid:200002181; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fedd1822-0cc3-4025-9903-241940974381.id.repl.co",nocase; classtype:attempted-recon; sid:200002182; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"federalaccesscredit.com",nocase; classtype:attempted-recon; sid:200002183; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fedexdelivery.drm.com.ng",nocase; classtype:attempted-recon; sid:200002184; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fedexoutdelivery.page.link",nocase; classtype:attempted-recon; sid:200002185; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fedextrackingonlinedelivery.drm.com.ng",nocase; classtype:attempted-recon; sid:200002186; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fedexvoyager.com",nocase; classtype:attempted-recon; sid:200002187; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fediburgame.com",nocase; classtype:attempted-recon; sid:200002188; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fedner.net",nocase; classtype:attempted-recon; sid:200002189; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"feedilicious.com",nocase; classtype:attempted-recon; sid:200002190; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"felipecostta94.github.io",nocase; classtype:attempted-recon; sid:200002191; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fene-modi.firebaseapp.com",nocase; classtype:attempted-recon; sid:200002192; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ferienhof-gempel.de",nocase; classtype:attempted-recon; sid:200002193; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ferrariparts4less.com",nocase; classtype:attempted-recon; sid:200002194; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ff-grnmemberships2021.com",nocase; classtype:attempted-recon; sid:200002195; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ffcs.com.pk",nocase; classtype:attempted-recon; sid:200002196; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ffjfjf.no",nocase; classtype:attempted-recon; sid:200002197; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fgebhyvqzntgkerjdihuoxquhi-dot-gowa11111111.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200002198; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fgfgfgf-2.easy.co",nocase; classtype:attempted-recon; sid:200002199; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fghjr74rhudfguhtfguji.blogspot.com",nocase; classtype:attempted-recon; sid:200002200; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fgts2021.com",nocase; classtype:attempted-recon; sid:200002201; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fhhw1u.webwave.dev",nocase; classtype:attempted-recon; sid:200002202; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fianceflowers.ir",nocase; classtype:attempted-recon; sid:200002203; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fiestanube.com.ar",nocase; classtype:attempted-recon; sid:200002204; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fifohbibou.blogspot.com",nocase; classtype:attempted-recon; sid:200002205; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"files-lcloud.com",nocase; classtype:attempted-recon; sid:200002206; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fileundelete.net",nocase; classtype:attempted-recon; sid:200002207; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"filsafat.stahnmpukuturan.ac.id",nocase; classtype:attempted-recon; sid:200002208; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"filtrosmil.com.br",nocase; classtype:attempted-recon; sid:200002209; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"financiallifecoaching.builderallwp.com",nocase; classtype:attempted-recon; sid:200002210; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"financialone.com.hk",nocase; classtype:attempted-recon; sid:200002211; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"financieracredicorpltda.com",nocase; classtype:attempted-recon; sid:200002212; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"findmy-support-icloud.com",nocase; classtype:attempted-recon; sid:200002213; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"findrealtors.tv",nocase; classtype:attempted-recon; sid:200002214; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"findurway.tech",nocase; classtype:attempted-recon; sid:200002215; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"finplustechnology.com",nocase; classtype:attempted-recon; sid:200002216; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"first.myvnc.com",nocase; classtype:attempted-recon; sid:200002217; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firstcallautomation.in",nocase; classtype:attempted-recon; sid:200002218; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fish.tw1.su",nocase; classtype:attempted-recon; sid:200002219; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fiteram.eliotek.net",nocase; classtype:attempted-recon; sid:200002220; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fiuf89ufgigigi.yolasite.com",nocase; classtype:attempted-recon; sid:200002221; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fixertawa.blogspot.com",nocase; classtype:attempted-recon; sid:200002222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fixi.monster",nocase; classtype:attempted-recon; sid:200002223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fixi.rest",nocase; classtype:attempted-recon; sid:200002224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fixin1click.com",nocase; classtype:attempted-recon; sid:200002225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fizikagroup.ru",nocase; classtype:attempted-recon; sid:200002226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fkjzei.top",nocase; classtype:attempted-recon; sid:200002227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"flaviovieiraadv.com.br",nocase; classtype:attempted-recon; sid:200002228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"flher.com",nocase; classtype:attempted-recon; sid:200002229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"flixpassed.com",nocase; classtype:attempted-recon; sid:200002230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"flladv.com.br",nocase; classtype:attempted-recon; sid:200002231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"floorsdirectltd.co.uk",nocase; classtype:attempted-recon; sid:200002232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"flouchs112.freecluster.eu",nocase; classtype:attempted-recon; sid:200002233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"flowtork.com",nocase; classtype:attempted-recon; sid:200002234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fluksrv.mycpanel.rs",nocase; classtype:attempted-recon; sid:200002235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fluorgov.sharepoint.us.mcas-gov.us",nocase; classtype:attempted-recon; sid:200002236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"flywed.turbo.site",nocase; classtype:attempted-recon; sid:200002237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fm.registrobarretos.com.br",nocase; classtype:attempted-recon; sid:200002238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fmail.youxjiauun.work",nocase; classtype:attempted-recon; sid:200002239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fmpos.ucad.sn",nocase; classtype:attempted-recon; sid:200002240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fnatic-go.com",nocase; classtype:attempted-recon; sid:200002241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fnzskhxpymppkjqtzljqayrjgf-dot-gowa11111111.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200002242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fo1bbbcf4445.info",nocase; classtype:attempted-recon; sid:200002243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"foamnflow.com",nocase; classtype:attempted-recon; sid:200002244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"focar.vn",nocase; classtype:attempted-recon; sid:200002245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"focusphotography.co.vu",nocase; classtype:attempted-recon; sid:200002246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"foliar.pl",nocase; classtype:attempted-recon; sid:200002247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"folignocrediti.it",nocase; classtype:attempted-recon; sid:200002248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"foma-ura-lote.firebaseapp.com",nocase; classtype:attempted-recon; sid:200002249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fon-gsm.pl",nocase; classtype:attempted-recon; sid:200002250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"foorwhatepouse.byethost9.com",nocase; classtype:attempted-recon; sid:200002251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"foresta-mod.firebaseapp.com",nocase; classtype:attempted-recon; sid:200002252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forfoodies.co",nocase; classtype:attempted-recon; sid:200002253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forgesmithvr.com",nocase; classtype:attempted-recon; sid:200002254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forlifehome.net",nocase; classtype:attempted-recon; sid:200002255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"formbuddy.com",nocase; classtype:attempted-recon; sid:200002256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.formium.io",nocase; classtype:attempted-recon; sid:200002257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"formtools.com",nocase; classtype:attempted-recon; sid:200002258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"formulario-conta-segura.arcanal.com.br",nocase; classtype:attempted-recon; sid:200002259; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forumasik.com",nocase; classtype:attempted-recon; sid:200002260; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forumgalixia.byethost6.com",nocase; classtype:attempted-recon; sid:200002261; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forums.rstools.club",nocase; classtype:attempted-recon; sid:200002262; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fosnetsecuritycameras.com",nocase; classtype:attempted-recon; sid:200002263; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fotoljilja.com",nocase; classtype:attempted-recon; sid:200002264; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"foxdancecompany.com",nocase; classtype:attempted-recon; sid:200002265; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fpmaam.org",nocase; classtype:attempted-recon; sid:200002266; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fr-europe564598-com.filesusr.com",nocase; classtype:attempted-recon; sid:200002267; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fraenkly-speaking.de",nocase; classtype:attempted-recon; sid:200002268; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fralindendre.com",nocase; classtype:attempted-recon; sid:200002269; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"framecapturestudio.com",nocase; classtype:attempted-recon; sid:200002270; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"franckpilier23-my-cheetah-website-copy.cheetah.builderall.com",nocase; classtype:attempted-recon; sid:200002271; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"franckpilier23-oro.cheetah.builderall.com",nocase; classtype:attempted-recon; sid:200002272; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"franckpilier23-ro.cheetah.builderall.com",nocase; classtype:attempted-recon; sid:200002273; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"frank-auth.cf",nocase; classtype:attempted-recon; sid:200002274; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freddsur111.byethost32.com",nocase; classtype:attempted-recon; sid:200002275; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fredounv.000webhostapp.com",nocase; classtype:attempted-recon; sid:200002276; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"free-fire-event-gratis298.duckdns.org",nocase; classtype:attempted-recon; sid:200002277; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"free-firecoderedem.blogspot.com",nocase; classtype:attempted-recon; sid:200002278; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"free3-codashop-v3.duckdns.org",nocase; classtype:attempted-recon; sid:200002279; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"free345sschool.gb.net",nocase; classtype:attempted-recon; sid:200002280; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freegsm.co",nocase; classtype:attempted-recon; sid:200002281; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freeliker.net",nocase; classtype:attempted-recon; sid:200002282; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freeproductkey.org",nocase; classtype:attempted-recon; sid:200002283; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freepubgs.live",nocase; classtype:attempted-recon; sid:200002284; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freeride-gulmarg.com",nocase; classtype:attempted-recon; sid:200002285; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"frerfire-gaming.mrbonus.com",nocase; classtype:attempted-recon; sid:200002286; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"friendlystorewyo.com",nocase; classtype:attempted-recon; sid:200002287; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"frizzter.freecluster.eu",nocase; classtype:attempted-recon; sid:200002288; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"frontllineed.com",nocase; classtype:attempted-recon; sid:200002289; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fruernes.dk",nocase; classtype:attempted-recon; sid:200002290; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fsgs653526sghg.000webhostapp.com",nocase; classtype:attempted-recon; sid:200002291; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftp.lesterandco.com",nocase; classtype:attempted-recon; sid:200002292; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ftp.trialshop.it",nocase; classtype:attempted-recon; sid:200002293; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fuad.iainkendari.ac.id",nocase; classtype:attempted-recon; sid:200002294; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"futuretroveschool.com",nocase; classtype:attempted-recon; sid:200002295; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fxguru.co.in",nocase; classtype:attempted-recon; sid:200002296; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fxt27.csb.app",nocase; classtype:attempted-recon; sid:200002297; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fyfb-9h4s5ryhgh.tv1space.az",nocase; classtype:attempted-recon; sid:200002298; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fzbfhn.webwave.dev",nocase; classtype:attempted-recon; sid:200002299; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"g-mtcc.com",nocase; classtype:attempted-recon; sid:200002300; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"g1lib.skipdns.link",nocase; classtype:attempted-recon; sid:200002301; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gabungg-gruppwhattsapp18.ftp1.biz",nocase; classtype:attempted-recon; sid:200002302; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"galcbheoo9.byethost33.com",nocase; classtype:attempted-recon; sid:200002303; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"galiciabankimg.ihostfull.com",nocase; classtype:attempted-recon; sid:200002304; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"galiciaspersonal.eshost.com.ar",nocase; classtype:attempted-recon; sid:200002305; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gamalaser.ir",nocase; classtype:attempted-recon; sid:200002306; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gambling1.ru.com",nocase; classtype:attempted-recon; sid:200002307; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gameofbet.info",nocase; classtype:attempted-recon; sid:200002308; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gameofbet.org",nocase; classtype:attempted-recon; sid:200002309; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gamestoppc.com",nocase; classtype:attempted-recon; sid:200002310; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gamingtools.xyz",nocase; classtype:attempted-recon; sid:200002311; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gardeniahotel.in",nocase; classtype:attempted-recon; sid:200002312; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"garena--freefire.com",nocase; classtype:attempted-recon; sid:200002313; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"garenabaomatvipham.com",nocase; classtype:attempted-recon; sid:200002314; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gasforteinstalacoes.com.br",nocase; classtype:attempted-recon; sid:200002315; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gasterdeckbuilde.com",nocase; classtype:attempted-recon; sid:200002316; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gator3030.temp.domains",nocase; classtype:attempted-recon; sid:200002317; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gawvs.in",nocase; classtype:attempted-recon; sid:200002318; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gayatriprojects.com",nocase; classtype:attempted-recon; sid:200002319; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gceporvrspacdswdhcxtczdzuc-dot-gowa11111111.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200002320; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gchronics.com",nocase; classtype:attempted-recon; sid:200002321; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gcmtraders.com",nocase; classtype:attempted-recon; sid:200002322; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ge-ge.snprobbx.pbz.r.de.a2ip.ru",nocase; classtype:attempted-recon; sid:200002323; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"geauxcartz.com",nocase; classtype:attempted-recon; sid:200002324; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gebaek-derman.eu",nocase; classtype:attempted-recon; sid:200002325; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"geelongtrailers.com.au",nocase; classtype:attempted-recon; sid:200002326; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gelisimfilo.com.tr",nocase; classtype:attempted-recon; sid:200002327; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gencanning.com",nocase; classtype:attempted-recon; sid:200002328; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"generarba232.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200002329; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"generarcita-sv.com",nocase; classtype:attempted-recon; sid:200002330; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"generationalkidz.com",nocase; classtype:attempted-recon; sid:200002331; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"genie-alba.firebaseapp.com",nocase; classtype:attempted-recon; sid:200002332; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gershwinsongranby.com",nocase; classtype:attempted-recon; sid:200002333; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gestacultura.com",nocase; classtype:attempted-recon; sid:200002334; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"getactive365.com",nocase; classtype:attempted-recon; sid:200002335; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"getapps.vip",nocase; classtype:attempted-recon; sid:200002336; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"getatless.com",nocase; classtype:attempted-recon; sid:200002337; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"getco-genetics.com",nocase; classtype:attempted-recon; sid:200002338; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"getfunding.pledesma.com",nocase; classtype:attempted-recon; sid:200002339; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"getlikesfree.com",nocase; classtype:attempted-recon; sid:200002340; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"getrealreview.com",nocase; classtype:attempted-recon; sid:200002341; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gfprcjvijumkuxtkftvpgdawkqrxrz.22web.org",nocase; classtype:attempted-recon; sid:200002342; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gfxx.creatorlink.net",nocase; classtype:attempted-recon; sid:200002343; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gg-attorneys.ml",nocase; classtype:attempted-recon; sid:200002344; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ggattorneys.tk",nocase; classtype:attempted-recon; sid:200002345; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ggivrrterxnndbcunfchzyeirxdcnv.22web.org",nocase; classtype:attempted-recon; sid:200002346; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ghislain.dartois.pagesperso-orange.fr",nocase; classtype:attempted-recon; sid:200002347; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ghoostheplain.byethost7.com",nocase; classtype:attempted-recon; sid:200002348; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ghorana.com",nocase; classtype:attempted-recon; sid:200002349; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"giftcards.allomoncoco.com",nocase; classtype:attempted-recon; sid:200002350; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"giggleassist.top",nocase; classtype:attempted-recon; sid:200002351; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gionghatvietnhii2021.ga",nocase; classtype:attempted-recon; sid:200002352; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gipvpn.xyz",nocase; classtype:attempted-recon; sid:200002353; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"giris-papara.net",nocase; classtype:attempted-recon; sid:200002354; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"girlsgroupwhtsapponlysexxy.xxuz.com",nocase; classtype:attempted-recon; sid:200002355; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gismoi.com",nocase; classtype:attempted-recon; sid:200002356; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gite-lafage.com",nocase; classtype:attempted-recon; sid:200002357; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gj3riqdasokdd67iptr.duckdns.org",nocase; classtype:attempted-recon; sid:200002358; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gjhanekamp.nl",nocase; classtype:attempted-recon; sid:200002359; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gkjx168.com",nocase; classtype:attempted-recon; sid:200002360; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gkstools.com",nocase; classtype:attempted-recon; sid:200002361; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glamournailsbyleda.com",nocase; classtype:attempted-recon; sid:200002362; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"globailpage-prodwebex.com",nocase; classtype:attempted-recon; sid:200002363; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"global-paxful.com",nocase; classtype:attempted-recon; sid:200002364; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"globalhsbcsecurity.com",nocase; classtype:attempted-recon; sid:200002365; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"globalpage-prodwebex.com",nocase; classtype:attempted-recon; sid:200002366; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glogo.org",nocase; classtype:attempted-recon; sid:200002367; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glomediamarketinginstitute.com",nocase; classtype:attempted-recon; sid:200002368; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glossmeup.ae",nocase; classtype:attempted-recon; sid:200002369; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glpacbn.com",nocase; classtype:attempted-recon; sid:200002370; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glr-auth.cf",nocase; classtype:attempted-recon; sid:200002371; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glr-authe.tk",nocase; classtype:attempted-recon; sid:200002372; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glr-autheti.ga",nocase; classtype:attempted-recon; sid:200002373; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glr-autheti.gq",nocase; classtype:attempted-recon; sid:200002374; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glsword.com",nocase; classtype:attempted-recon; sid:200002375; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gmail-phone-support.com",nocase; classtype:attempted-recon; sid:200002376; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gmaillgve.ebpages.com",nocase; classtype:attempted-recon; sid:200002377; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gmall-involceview-verilog-auth.pages.dev",nocase; classtype:attempted-recon; sid:200002378; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gmwdigital.in",nocase; classtype:attempted-recon; sid:200002379; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gmx-aktualisierung.yolasite.com",nocase; classtype:attempted-recon; sid:200002380; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gmxmailme.yolasite.com",nocase; classtype:attempted-recon; sid:200002381; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gnrhealth.cf",nocase; classtype:attempted-recon; sid:200002382; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"go.sparkasse-sicherer-login.de",nocase; classtype:attempted-recon; sid:200002383; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"go.swipez.in",nocase; classtype:attempted-recon; sid:200002384; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gofreegovernmentmoney.com",nocase; classtype:attempted-recon; sid:200002385; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"goglemaps.co",nocase; classtype:attempted-recon; sid:200002386; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"goldcoastrhinoplasty.com.au",nocase; classtype:attempted-recon; sid:200002387; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"golden5-938737.ingress-erytho.easywp.com",nocase; classtype:attempted-recon; sid:200002388; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"goldenlasgidi10.web.app",nocase; classtype:attempted-recon; sid:200002389; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"goldpackrio.com.br",nocase; classtype:attempted-recon; sid:200002390; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"goldvipescort.es",nocase; classtype:attempted-recon; sid:200002391; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"golfballsonline.com",nocase; classtype:attempted-recon; sid:200002392; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"golosovanie.viptop.ru",nocase; classtype:attempted-recon; sid:200002393; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"goocruxainsificansion.com",nocase; classtype:attempted-recon; sid:200002394; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"good12345.tripod.com",nocase; classtype:attempted-recon; sid:200002395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"goodiegirlscupcakes.com",nocase; classtype:attempted-recon; sid:200002396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google-quality-rater-audit.com",nocase; classtype:attempted-recon; sid:200002397; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.accoumts.ga",nocase; classtype:attempted-recon; sid:200002398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gorgas.gob.pa",nocase; classtype:attempted-recon; sid:200002399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gornjimilanovac.rs",nocase; classtype:attempted-recon; sid:200002400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gosafes.com",nocase; classtype:attempted-recon; sid:200002401; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gosalair.com",nocase; classtype:attempted-recon; sid:200002402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gotholdng.com",nocase; classtype:attempted-recon; sid:200002403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gourtt-manta2-ec.hostkda.com",nocase; classtype:attempted-recon; sid:200002404; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gouttierespj.com",nocase; classtype:attempted-recon; sid:200002405; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gov.uk-dvla.org",nocase; classtype:attempted-recon; sid:200002406; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"governmentgrants.godaddysites.com",nocase; classtype:attempted-recon; sid:200002407; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"govkn.knorish.com",nocase; classtype:attempted-recon; sid:200002408; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"govtfundnow.com",nocase; classtype:attempted-recon; sid:200002409; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gpbom.codesandbox.io",nocase; classtype:attempted-recon; sid:200002410; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gpubr.cn",nocase; classtype:attempted-recon; sid:200002411; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grabyourcode.com",nocase; classtype:attempted-recon; sid:200002412; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grand-chang.top",nocase; classtype:attempted-recon; sid:200002413; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grandbettinggir2.blogspot.com",nocase; classtype:attempted-recon; sid:200002414; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grandcaymanfoodie.com",nocase; classtype:attempted-recon; sid:200002415; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grandmarketltd.co.uk",nocase; classtype:attempted-recon; sid:200002416; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"graudez.com.br",nocase; classtype:attempted-recon; sid:200002417; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"greaterlovefoundation.org",nocase; classtype:attempted-recon; sid:200002418; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"greatmusica.com",nocase; classtype:attempted-recon; sid:200002419; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gregmounsey.com",nocase; classtype:attempted-recon; sid:200002420; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"greyhound.ie",nocase; classtype:attempted-recon; sid:200002421; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grin.co.rs",nocase; classtype:attempted-recon; sid:200002422; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grms.cit.net",nocase; classtype:attempted-recon; sid:200002423; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grosshandel-mevida.de",nocase; classtype:attempted-recon; sid:200002424; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grottedisaledesenzano.com",nocase; classtype:attempted-recon; sid:200002425; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"groundforcelogistics.com",nocase; classtype:attempted-recon; sid:200002426; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"group-18-sans.wikaba.com",nocase; classtype:attempted-recon; sid:200002427; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"groupevosnotnot.duckdns.org",nocase; classtype:attempted-recon; sid:200002428; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"groupwhattsap.jkub.com",nocase; classtype:attempted-recon; sid:200002429; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"growasiacapital.id",nocase; classtype:attempted-recon; sid:200002430; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"groworldinternational.com",nocase; classtype:attempted-recon; sid:200002431; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grp01.id.rakuten.co.jp",nocase; classtype:attempted-recon; sid:200002432; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grubbokep22.mrbonus.com",nocase; classtype:attempted-recon; sid:200002433; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grubwhatsaapterbaru.duckdns.org",nocase; classtype:attempted-recon; sid:200002434; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grubwhatsappvrl21.duckdns.org",nocase; classtype:attempted-recon; sid:200002435; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gruoup-whatsapp.com",nocase; classtype:attempted-recon; sid:200002436; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grup-wa-bokep18.wikaba.com",nocase; classtype:attempted-recon; sid:200002437; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grup-whatsappsexy.xxuz.com",nocase; classtype:attempted-recon; sid:200002438; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grupbokephot2021.duckdns.org",nocase; classtype:attempted-recon; sid:200002439; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gruphot18viral.duckdns.org",nocase; classtype:attempted-recon; sid:200002440; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grupoabi.cl",nocase; classtype:attempted-recon; sid:200002441; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grupofsp.com.br",nocase; classtype:attempted-recon; sid:200002442; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grupopromeric.webcindario.com",nocase; classtype:attempted-recon; sid:200002443; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gruposcherman.com.br",nocase; classtype:attempted-recon; sid:200002444; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grupwa18-tys.wikaba.com",nocase; classtype:attempted-recon; sid:200002445; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grupwaefefxyz.servebeer.com",nocase; classtype:attempted-recon; sid:200002446; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grupwatanteempotbokep21.duckdns.org",nocase; classtype:attempted-recon; sid:200002447; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gscommunityspirit.greenschool.org",nocase; classtype:attempted-recon; sid:200002448; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gtaswansea.org",nocase; classtype:attempted-recon; sid:200002449; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gtroot.edulinellc.mn",nocase; classtype:attempted-recon; sid:200002450; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gtsukxrxiiumhxjcdsdlrgthqc-dot-gowa11111111.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200002451; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gudanggamismuslimah.com",nocase; classtype:attempted-recon; sid:200002452; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gwenet.org",nocase; classtype:attempted-recon; sid:200002453; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gwisalltrack.com",nocase; classtype:attempted-recon; sid:200002454; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gwred.4ik87425pj-354refd.workers.dev",nocase; classtype:attempted-recon; sid:200002455; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gz32tf89tx00xz.byethost11.com",nocase; classtype:attempted-recon; sid:200002456; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"h5-chase.com",nocase; classtype:attempted-recon; sid:200002457; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"h5brzd.webwave.dev",nocase; classtype:attempted-recon; sid:200002458; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"h5p.roboticamexico.com.mx",nocase; classtype:attempted-recon; sid:200002459; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"h62g.nichesite.org",nocase; classtype:attempted-recon; sid:200002460; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"habbocreditosparati.blogspot.com",nocase; classtype:attempted-recon; sid:200002461; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"habibassociatesbd.com",nocase; classtype:attempted-recon; sid:200002462; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hagalepuesmijo.byethost32.com",nocase; classtype:attempted-recon; sid:200002463; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hahdaeupdate.es.tl",nocase; classtype:attempted-recon; sid:200002464; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hakiy26789.temp.swtest.ru",nocase; classtype:attempted-recon; sid:200002465; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"halaisabudhabi.com",nocase; classtype:attempted-recon; sid:200002466; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hali-securesuite.com",nocase; classtype:attempted-recon; sid:200002467; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"halifax-checkthispayee.com",nocase; classtype:attempted-recon; sid:200002468; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"halifax-direct.com",nocase; classtype:attempted-recon; sid:200002469; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"halifax-online-bank.com",nocase; classtype:attempted-recon; sid:200002470; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"halifax-securelink.com",nocase; classtype:attempted-recon; sid:200002471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"halifax-security-de-register-device.com",nocase; classtype:attempted-recon; sid:200002472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"halifax.deregister-cancellation-payee-secure-auth.com",nocase; classtype:attempted-recon; sid:200002473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"haliuk-secure-device.com",nocase; classtype:attempted-recon; sid:200002474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hamzabilisim.net",nocase; classtype:attempted-recon; sid:200002475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"handyhelp.eu",nocase; classtype:attempted-recon; sid:200002476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hannetjiefaurie1.creatorlink.net",nocase; classtype:attempted-recon; sid:200002477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hans-ledlite.com",nocase; classtype:attempted-recon; sid:200002478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"haogege.52yjh.top",nocase; classtype:attempted-recon; sid:200002479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"happyhouru.com",nocase; classtype:attempted-recon; sid:200002480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"haroldhazard1-wixsite-com.filesusr.com",nocase; classtype:attempted-recon; sid:200002481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hasadom1.com",nocase; classtype:attempted-recon; sid:200002482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hasmob.com",nocase; classtype:attempted-recon; sid:200002483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hasseanhannitybeenwaterboarded.com",nocase; classtype:attempted-recon; sid:200002484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"havanaturbahamas.com",nocase; classtype:attempted-recon; sid:200002485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"havenscloudkitchen.com",nocase; classtype:attempted-recon; sid:200002486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hb-promerica-sv.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200002487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hb-promerica.hostfree.pw",nocase; classtype:attempted-recon; sid:200002488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hbhfwiic.ml",nocase; classtype:attempted-recon; sid:200002489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hbomaxfreetrial.com",nocase; classtype:attempted-recon; sid:200002490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hc1.checker.in",nocase; classtype:attempted-recon; sid:200002491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hcnprdvz.azureedge.net",nocase; classtype:attempted-recon; sid:200002492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hcps-auth.ga",nocase; classtype:attempted-recon; sid:200002493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hdmediahub.club",nocase; classtype:attempted-recon; sid:200002494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hdsp.cf",nocase; classtype:attempted-recon; sid:200002495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"he-lp-desk.my-free.website",nocase; classtype:attempted-recon; sid:200002496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"healthycars.in",nocase; classtype:attempted-recon; sid:200002497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hebrjlndybbemhtixfyxhwefxc-dot-gowa11111111.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200002498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hediyeevreni.com",nocase; classtype:attempted-recon; sid:200002499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"heenakala.com",nocase; classtype:attempted-recon; sid:200002500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"helloparis.co.uk",nocase; classtype:attempted-recon; sid:200002501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"help-dbs.net",nocase; classtype:attempted-recon; sid:200002502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"help.ccemlimited.com",nocase; classtype:attempted-recon; sid:200002503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"helpdesk-tech.com",nocase; classtype:attempted-recon; sid:200002504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"helpdoors.com",nocase; classtype:attempted-recon; sid:200002505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"helppageconfirmingservice.co.vu",nocase; classtype:attempted-recon; sid:200002506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"helppss-konfiguresion131wq.cf",nocase; classtype:attempted-recon; sid:200002507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"helppss-validtionss131wq.gq",nocase; classtype:attempted-recon; sid:200002508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"heppler.ch.net2care.com",nocase; classtype:attempted-recon; sid:200002509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hepsbahis01.blogspot.com",nocase; classtype:attempted-recon; sid:200002510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hepsibahiis1.blogspot.com",nocase; classtype:attempted-recon; sid:200002511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hepsibahisgirisimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200002512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hepsibahisgirisimiz1.blogspot.com",nocase; classtype:attempted-recon; sid:200002513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hepsibahisgirisimiz4.blogspot.com",nocase; classtype:attempted-recon; sid:200002514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hermes.pay-depot-fee.com",nocase; classtype:attempted-recon; sid:200002515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hetershaven.net",nocase; classtype:attempted-recon; sid:200002516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hetrios.com.br",nocase; classtype:attempted-recon; sid:200002517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hetsa.com.mx",nocase; classtype:attempted-recon; sid:200002518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hgn2t.app.link",nocase; classtype:attempted-recon; sid:200002519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hhfbvwvajbcdjgvjetczgtqdqq-dot-gowa11111111.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200002520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hhfjjehnnnmkkfjnmmju.odoo.com",nocase; classtype:attempted-recon; sid:200002521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hhqqmmylkgw.typeform.com",nocase; classtype:attempted-recon; sid:200002522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hhtinvestments.com",nocase; classtype:attempted-recon; sid:200002523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hiccup.pancakeswap.finances.baylysimmo.com",nocase; classtype:attempted-recon; sid:200002524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hide-windows.com",nocase; classtype:attempted-recon; sid:200002525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"higufytdfghlk98.weeblysite.com",nocase; classtype:attempted-recon; sid:200002526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"himalkom.cs.ipb.ac.id",nocase; classtype:attempted-recon; sid:200002527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hindmovie.cc",nocase; classtype:attempted-recon; sid:200002528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hismarthomes.com",nocase; classtype:attempted-recon; sid:200002529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hitman71hd-wixsite-com.filesusr.com",nocase; classtype:attempted-recon; sid:200002530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hitpe.com",nocase; classtype:attempted-recon; sid:200002531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hjkfgx.tk",nocase; classtype:attempted-recon; sid:200002532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hjkfj.ml",nocase; classtype:attempted-recon; sid:200002533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hk.mikecrm.com",nocase; classtype:attempted-recon; sid:200002534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hm-revenue-costums.ciclosew.com",nocase; classtype:attempted-recon; sid:200002535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hm.ru",nocase; classtype:attempted-recon; sid:200002536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hmlkl.codesandbox.io",nocase; classtype:attempted-recon; sid:200002537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hmp.me",nocase; classtype:attempted-recon; sid:200002538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hmu.karmatechmediaworks.com",nocase; classtype:attempted-recon; sid:200002539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hof-barth.de",nocase; classtype:attempted-recon; sid:200002540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"holatoronto.com",nocase; classtype:attempted-recon; sid:200002541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"holdmembershipntfx.aulaseidec.com",nocase; classtype:attempted-recon; sid:200002542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"holidayinnboston.com",nocase; classtype:attempted-recon; sid:200002543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"holiganguncelgir.blogspot.com",nocase; classtype:attempted-recon; sid:200002544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"holiloa.site",nocase; classtype:attempted-recon; sid:200002545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"holina-ne.tk",nocase; classtype:attempted-recon; sid:200002546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hollubarsch.de",nocase; classtype:attempted-recon; sid:200002547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hollykim.com",nocase; classtype:attempted-recon; sid:200002548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"holyrichesglobal.com",nocase; classtype:attempted-recon; sid:200002549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"home.ei1ns.de",nocase; classtype:attempted-recon; sid:200002550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"home.myfairpoint.net",nocase; classtype:attempted-recon; sid:200002551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"homebak1lgalici.byethost31.com",nocase; classtype:attempted-recon; sid:200002552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"homefairbd.com",nocase; classtype:attempted-recon; sid:200002553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"homesinlogin.com",nocase; classtype:attempted-recon; sid:200002554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"homologacao.madrugadaolanches.com.br",nocase; classtype:attempted-recon; sid:200002555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"homs.com.br",nocase; classtype:attempted-recon; sid:200002556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"honda4fun.com",nocase; classtype:attempted-recon; sid:200002557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"honeygarden.in",nocase; classtype:attempted-recon; sid:200002558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"honeyhyper.com",nocase; classtype:attempted-recon; sid:200002559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"honorary-detachment.000webhostapp.com",nocase; classtype:attempted-recon; sid:200002560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hope-polska.live",nocase; classtype:attempted-recon; sid:200002561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hopeforfuture.org.in",nocase; classtype:attempted-recon; sid:200002562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"horosho.house",nocase; classtype:attempted-recon; sid:200002563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hosting2021623.online.pro",nocase; classtype:attempted-recon; sid:200002564; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hosting2024700.online.pro",nocase; classtype:attempted-recon; sid:200002565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hosting2042037.online.pro",nocase; classtype:attempted-recon; sid:200002566; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hosting2070987.online.pro",nocase; classtype:attempted-recon; sid:200002567; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hosting2086464.online.pro",nocase; classtype:attempted-recon; sid:200002568; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hostmium.com",nocase; classtype:attempted-recon; sid:200002569; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hostnix.net",nocase; classtype:attempted-recon; sid:200002570; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hostpoint.ch.11c7028a.net2care.com",nocase; classtype:attempted-recon; sid:200002571; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hostpoint.ch.1200028f.net2care.com",nocase; classtype:attempted-recon; sid:200002572; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hostpoint.ch.121c0291.net2care.com",nocase; classtype:attempted-recon; sid:200002573; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hostpoint.ch.17a902ef.tcorner.fr",nocase; classtype:attempted-recon; sid:200002574; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hostpoint.ch.182f02ff.net2care.com",nocase; classtype:attempted-recon; sid:200002575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hostpoint.ch.hebetec.ch.p2aexpertise.com",nocase; classtype:attempted-recon; sid:200002576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hostyoutube.byethost14.com",nocase; classtype:attempted-recon; sid:200002577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hot-sofupqlgmsi.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200002578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hotbrooks.com",nocase; classtype:attempted-recon; sid:200002579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hotel-pontos.gr",nocase; classtype:attempted-recon; sid:200002580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hotelaakashresidency.com",nocase; classtype:attempted-recon; sid:200002581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hotelgapel.com",nocase; classtype:attempted-recon; sid:200002582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hotelmirafloresizu.com",nocase; classtype:attempted-recon; sid:200002583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hotgrub.mlbb732.ga",nocase; classtype:attempted-recon; sid:200002584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hounbvc-c7661.web.app",nocase; classtype:attempted-recon; sid:200002585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"houra.xyz",nocase; classtype:attempted-recon; sid:200002586; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"houstonconcrete.us",nocase; classtype:attempted-recon; sid:200002587; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"how.servemp3.com",nocase; classtype:attempted-recon; sid:200002588; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"howrse.5v.pl",nocase; classtype:attempted-recon; sid:200002589; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hoynoticias.com.ar",nocase; classtype:attempted-recon; sid:200002590; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hpplotters.in",nocase; classtype:attempted-recon; sid:200002591; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hrs-game.main.jp",nocase; classtype:attempted-recon; sid:200002592; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hs-19982318.t.hubspotfree.net",nocase; classtype:attempted-recon; sid:200002593; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hs-giveaways.ca",nocase; classtype:attempted-recon; sid:200002594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hsbcinfo.com",nocase; classtype:attempted-recon; sid:200002595; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hsegbpscrbnatxeufgqjkpvzqz-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200002596; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ht-cargo.com.vn",nocase; classtype:attempted-recon; sid:200002597; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hthtrhtrthth.000webhostapp.com",nocase; classtype:attempted-recon; sid:200002598; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpcpcalendars.granadoemurahara.com.br",nocase; classtype:attempted-recon; sid:200002599; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpcpcontacts.granadoemurahara.com.br",nocase; classtype:attempted-recon; sid:200002600; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpeugnerally-wixsite-com.filesusr.com",nocase; classtype:attempted-recon; sid:200002601; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httppostsfb-5ynyhdkk.novitium.ca",nocase; classtype:attempted-recon; sid:200002602; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httppostsfb-9kylkbqp.novitium.ca",nocase; classtype:attempted-recon; sid:200002603; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httppostsfb-hg36wq99.novitium.ca",nocase; classtype:attempted-recon; sid:200002604; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httppostsfb-sstg2l7lt.novitium.ca",nocase; classtype:attempted-recon; sid:200002605; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httppostsfb-tci6f27n.novitium.ca",nocase; classtype:attempted-recon; sid:200002606; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httppostsfb-zxsz1c361.novitium.ca",nocase; classtype:attempted-recon; sid:200002607; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpsbooking.pl-id38672907.xyz",nocase; classtype:attempted-recon; sid:200002608; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"httpshttpmobile.retrocafe.net.au",nocase; classtype:attempted-recon; sid:200002609; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"htwww.duluxautosales.com",nocase; classtype:attempted-recon; sid:200002610; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hublaalikes.com",nocase; classtype:attempted-recon; sid:200002611; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"huge.servegame.com",nocase; classtype:attempted-recon; sid:200002612; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hulu-com-activate.sitey.me",nocase; classtype:attempted-recon; sid:200002613; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hulu-hulu-com-activate.sitey.me",nocase; classtype:attempted-recon; sid:200002614; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hulu.sitey.me",nocase; classtype:attempted-recon; sid:200002615; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"human.servegame.com",nocase; classtype:attempted-recon; sid:200002616; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"humani.biz",nocase; classtype:attempted-recon; sid:200002617; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"humc.in",nocase; classtype:attempted-recon; sid:200002618; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"huntington.net.au",nocase; classtype:attempted-recon; sid:200002619; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"huntingtononline.ddns.info",nocase; classtype:attempted-recon; sid:200002620; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hutoknepper.de",nocase; classtype:attempted-recon; sid:200002621; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"huynguyen2k.github.io",nocase; classtype:attempted-recon; sid:200002622; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hvaayh.top",nocase; classtype:attempted-recon; sid:200002623; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hwazen.com",nocase; classtype:attempted-recon; sid:200002624; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hwzyw.csb.app",nocase; classtype:attempted-recon; sid:200002625; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hydratrader.com",nocase; classtype:attempted-recon; sid:200002626; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hyjkfsdr-107934.square.site",nocase; classtype:attempted-recon; sid:200002627; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hypegames.shop",nocase; classtype:attempted-recon; sid:200002628; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"i-ask332.dga.jp",nocase; classtype:attempted-recon; sid:200002629; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"i-kiwi.com.ua",nocase; classtype:attempted-recon; sid:200002630; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"i.gal",nocase; classtype:attempted-recon; sid:200002631; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"i1ctv.weblium.site",nocase; classtype:attempted-recon; sid:200002632; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"i4us.com",nocase; classtype:attempted-recon; sid:200002633; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iamkevinfay.com",nocase; classtype:attempted-recon; sid:200002634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iamwatch.net",nocase; classtype:attempted-recon; sid:200002635; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iazu.me",nocase; classtype:attempted-recon; sid:200002636; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ibank.qnbfinansbkonline.com",nocase; classtype:attempted-recon; sid:200002637; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ibankasb.ru",nocase; classtype:attempted-recon; sid:200002638; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ibelongtotheworld.com",nocase; classtype:attempted-recon; sid:200002639; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ibourl.com",nocase; classtype:attempted-recon; sid:200002640; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ibpm.ru",nocase; classtype:attempted-recon; sid:200002641; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ic-cite.ulm.ac.id",nocase; classtype:attempted-recon; sid:200002642; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"icfpl.co.in",nocase; classtype:attempted-recon; sid:200002643; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"idam-web-public.aat.platform.hmcts.net",nocase; classtype:attempted-recon; sid:200002644; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iddeev.hyperphp.com",nocase; classtype:attempted-recon; sid:200002645; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ideabank-logowanie.net",nocase; classtype:attempted-recon; sid:200002646; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"identification.fr-mescomptesv1.cf",nocase; classtype:attempted-recon; sid:200002647; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"identification.fr-principalev1.cf",nocase; classtype:attempted-recon; sid:200002648; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"identified-shortly-ok-katrina.trycloudflare.com",nocase; classtype:attempted-recon; sid:200002649; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"identifiez-vous-avec-votre-compte.yolasite.com",nocase; classtype:attempted-recon; sid:200002650; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"identify.run-us-west2.goorm.io",nocase; classtype:attempted-recon; sid:200002651; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"identita.n26.com.verificatoinformazioni.com",nocase; classtype:attempted-recon; sid:200002652; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"idhuman-verification.run-us-west2.goorm.io",nocase; classtype:attempted-recon; sid:200002653; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"idiomas247.com",nocase; classtype:attempted-recon; sid:200002654; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"idorangefr24.yolasite.com",nocase; classtype:attempted-recon; sid:200002655; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"idpd-1501.com",nocase; classtype:attempted-recon; sid:200002656; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ie-boi365.org",nocase; classtype:attempted-recon; sid:200002657; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ien.fni.mybluehost.me",nocase; classtype:attempted-recon; sid:200002658; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ifhdigofj.weebly.com",nocase; classtype:attempted-recon; sid:200002659; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ifuudaixcbaqhoxwbttgkptnlb-dot-gowa11111111.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200002660; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"igenpod.com",nocase; classtype:attempted-recon; sid:200002661; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ignitionclaim.com",nocase; classtype:attempted-recon; sid:200002662; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iiaosdffff.easy.co",nocase; classtype:attempted-recon; sid:200002663; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iims.onlineapplication.co",nocase; classtype:attempted-recon; sid:200002664; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iipvit.by",nocase; classtype:attempted-recon; sid:200002665; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ijijijijuiuhhu.000webhostapp.com",nocase; classtype:attempted-recon; sid:200002666; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iksanthesharp.postown.net",nocase; classtype:attempted-recon; sid:200002667; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ikuhzdswpx.pfirmann-bau.de",nocase; classtype:attempted-recon; sid:200002668; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ikulutugrowthacademy.com",nocase; classtype:attempted-recon; sid:200002669; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"imagelinetech.com",nocase; classtype:attempted-recon; sid:200002670; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-4h9j0ttah.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002671; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-7jbmtszqrl.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002672; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-c6wv0b0nie.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002673; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-il6k6wb7.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002674; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-mijtu80r.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002675; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"images-ol53sxre2e.salamazerbaycan.az",nocase; classtype:attempted-recon; sid:200002676; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"imexpharm.com",nocase; classtype:attempted-recon; sid:200002677; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"img.maplejournal.co.in",nocase; classtype:attempted-recon; sid:200002678; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"imi.org.au",nocase; classtype:attempted-recon; sid:200002679; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"impotspublicservice.com",nocase; classtype:attempted-recon; sid:200002680; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"impulseauction.top",nocase; classtype:attempted-recon; sid:200002681; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"imsva91-ctp.trendmicro.com",nocase; classtype:attempted-recon; sid:200002682; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"in-truck.dk",nocase; classtype:attempted-recon; sid:200002683; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inbusinesscoworking.com",nocase; classtype:attempted-recon; sid:200002684; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"indeed8.com",nocase; classtype:attempted-recon; sid:200002685; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"index.kroppsfunktion.com",nocase; classtype:attempted-recon; sid:200002686; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"indexalimentos.com.mx",nocase; classtype:attempted-recon; sid:200002687; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"indha.in",nocase; classtype:attempted-recon; sid:200002688; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"indiankitchenfood.com",nocase; classtype:attempted-recon; sid:200002689; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"indigocoin.me",nocase; classtype:attempted-recon; sid:200002690; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"indomotorlestari.com",nocase; classtype:attempted-recon; sid:200002691; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"industrialonline.in.th",nocase; classtype:attempted-recon; sid:200002692; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"infinitycare.gt",nocase; classtype:attempted-recon; sid:200002693; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"info-full18.2waky.com",nocase; classtype:attempted-recon; sid:200002694; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"info.ipromoteuoffers.com",nocase; classtype:attempted-recon; sid:200002695; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"info.lionnets.com",nocase; classtype:attempted-recon; sid:200002696; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"infobank.app.link",nocase; classtype:attempted-recon; sid:200002697; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"infodeseguros.com",nocase; classtype:attempted-recon; sid:200002698; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"infomation245.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200002699; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"infopage-create.000webhostapp.com",nocase; classtype:attempted-recon; sid:200002700; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"informacionespsiquiatricas.com",nocase; classtype:attempted-recon; sid:200002701; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"informativoclienteapp.io",nocase; classtype:attempted-recon; sid:200002702; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"infosprologinmatrisemomols.yolasite.com",nocase; classtype:attempted-recon; sid:200002703; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"infotreegroup.com",nocase; classtype:attempted-recon; sid:200002704; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"infrm-m-informa.blogspot.com",nocase; classtype:attempted-recon; sid:200002705; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ing.direct.verifica.dati.wellmom.net",nocase; classtype:attempted-recon; sid:200002706; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ing.kluisrekening.nl.",nocase; classtype:attempted-recon; sid:200002707; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ingaveiculos.creatorlink.net",nocase; classtype:attempted-recon; sid:200002708; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inhtg67y.byethost6.com",nocase; classtype:attempted-recon; sid:200002709; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inicsido.vzpla.net",nocase; classtype:attempted-recon; sid:200002710; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inno.surf",nocase; classtype:attempted-recon; sid:200002711; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"innoaura.com",nocase; classtype:attempted-recon; sid:200002712; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inperiire.com",nocase; classtype:attempted-recon; sid:200002713; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpexcom-au.com",nocase; classtype:attempted-recon; sid:200002714; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost-order.pl-id26160856.xyz",nocase; classtype:attempted-recon; sid:200002715; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost-order.pl-id30542198.xyz",nocase; classtype:attempted-recon; sid:200002716; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost-order.pl-id50073848.xyz",nocase; classtype:attempted-recon; sid:200002717; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost-order.pl-id76514308.xyz",nocase; classtype:attempted-recon; sid:200002718; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost-pku.id9030.me",nocase; classtype:attempted-recon; sid:200002719; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost-pl.id-013497.pw",nocase; classtype:attempted-recon; sid:200002720; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost-pl.id-799883.pw",nocase; classtype:attempted-recon; sid:200002721; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost-pl.id-847329.pw",nocase; classtype:attempted-recon; sid:200002722; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost-pl.id-987438.pw",nocase; classtype:attempted-recon; sid:200002723; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost-pl.merchant-781.tk",nocase; classtype:attempted-recon; sid:200002724; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost-pl.net",nocase; classtype:attempted-recon; sid:200002725; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost-skd.id9824.me",nocase; classtype:attempted-recon; sid:200002726; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost.dostawa-safety.club",nocase; classtype:attempted-recon; sid:200002727; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost.pl-info.deposit-recievment.com",nocase; classtype:attempted-recon; sid:200002728; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpost.post-dostawa.com",nocase; classtype:attempted-recon; sid:200002729; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inps-ep.com",nocase; classtype:attempted-recon; sid:200002730; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inpursuitoflove.com",nocase; classtype:attempted-recon; sid:200002731; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ins.cloudns.nz",nocase; classtype:attempted-recon; sid:200002732; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"insidesoftwares.com",nocase; classtype:attempted-recon; sid:200002733; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"instagram-instagram-instagram-instagram-instagam-instagram.tw1.ru",nocase; classtype:attempted-recon; sid:200002734; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"instagram-photo-battle-profile.ru",nocase; classtype:attempted-recon; sid:200002735; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"instagram.kiloppls.com",nocase; classtype:attempted-recon; sid:200002736; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"instagram.support.al",nocase; classtype:attempted-recon; sid:200002737; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"instagramhelpp.agency",nocase; classtype:attempted-recon; sid:200002738; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"instagramhelps.com",nocase; classtype:attempted-recon; sid:200002739; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"instargram.dothome.co.kr",nocase; classtype:attempted-recon; sid:200002740; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"institutoaxioma.com.ar",nocase; classtype:attempted-recon; sid:200002741; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"institutodefaveri.com",nocase; classtype:attempted-recon; sid:200002742; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"insuminet.hostfree.pw",nocase; classtype:attempted-recon; sid:200002743; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"intellogistics.vn",nocase; classtype:attempted-recon; sid:200002744; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interbahis452.blogspot.com",nocase; classtype:attempted-recon; sid:200002745; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interbahisgirin.blogspot.com",nocase; classtype:attempted-recon; sid:200002746; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interbahisgirisadresimiz2.blogspot.com",nocase; classtype:attempted-recon; sid:200002747; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interbahiss1.blogspot.com",nocase; classtype:attempted-recon; sid:200002748; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interbankempresas.pe-li.ru",nocase; classtype:attempted-recon; sid:200002749; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interbanlkwelb.caseykozlowski.com",nocase; classtype:attempted-recon; sid:200002750; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"intercroofthlm.byethost33.com",nocase; classtype:attempted-recon; sid:200002751; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interestingfurniture.com",nocase; classtype:attempted-recon; sid:200002752; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interfacethlmt.byethost3.com",nocase; classtype:attempted-recon; sid:200002753; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"intergirisi.blogspot.com",nocase; classtype:attempted-recon; sid:200002754; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interiorsbis.com",nocase; classtype:attempted-recon; sid:200002755; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"interlbankwelb.artagentsinternational.com",nocase; classtype:attempted-recon; sid:200002756; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"intern.unibas-com.ch",nocase; classtype:attempted-recon; sid:200002757; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"international-services.ni6132741-1.web19.nitrado.hosting",nocase; classtype:attempted-recon; sid:200002758; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"international-web-fb75a.web.app",nocase; classtype:attempted-recon; sid:200002759; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"internationalsoccercamp.com",nocase; classtype:attempted-recon; sid:200002760; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"intexargentina.com.ar",nocase; classtype:attempted-recon; sid:200002761; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"intheknowinspections.com",nocase; classtype:attempted-recon; sid:200002762; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inthewildproductions.com",nocase; classtype:attempted-recon; sid:200002763; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"invictuspower.com.br",nocase; classtype:attempted-recon; sid:200002764; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"invitation-page-policy-notification-2021.my.id",nocase; classtype:attempted-recon; sid:200002765; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"invitation-pages-advanced-notification-2021.my.id",nocase; classtype:attempted-recon; sid:200002766; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inx.inbox.lv",nocase; classtype:attempted-recon; sid:200002767; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"io.haardhoutveiling.com",nocase; classtype:attempted-recon; sid:200002768; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ipa.fkip.ulm.ac.id",nocase; classtype:attempted-recon; sid:200002769; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ipay.open-pays.ru",nocase; classtype:attempted-recon; sid:200002770; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iphonepens.com",nocase; classtype:attempted-recon; sid:200002771; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ipkaor.xyz",nocase; classtype:attempted-recon; sid:200002772; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ipkonline.com",nocase; classtype:attempted-recon; sid:200002773; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ipod.co.za",nocase; classtype:attempted-recon; sid:200002774; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iq-sci.com",nocase; classtype:attempted-recon; sid:200002775; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irenterprises.in",nocase; classtype:attempted-recon; sid:200002776; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irequest-beneficiary-removal.com",nocase; classtype:attempted-recon; sid:200002777; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irisdigi-labs.com",nocase; classtype:attempted-recon; sid:200002778; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irn-inc.com",nocase; classtype:attempted-recon; sid:200002779; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irs-departement.tax-compensation.com",nocase; classtype:attempted-recon; sid:200002780; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irs-gov.us-identity-refunds.com",nocase; classtype:attempted-recon; sid:200002781; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irs.gov.admin-mcas-gov.ms",nocase; classtype:attempted-recon; sid:200002782; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irs.gov.mcas-gov.ms",nocase; classtype:attempted-recon; sid:200002783; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irs.gov.septembercovid19.com",nocase; classtype:attempted-recon; sid:200002784; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irs507.yolasite.com",nocase; classtype:attempted-recon; sid:200002785; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irsgov.unaux.com",nocase; classtype:attempted-recon; sid:200002786; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irstaxrefund.rf.gd",nocase; classtype:attempted-recon; sid:200002787; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irstds.com",nocase; classtype:attempted-recon; sid:200002788; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"isabelleswindowdesignvestal.com",nocase; classtype:attempted-recon; sid:200002789; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"isfirsatibul.com",nocase; classtype:attempted-recon; sid:200002790; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"issc345enter.gb.net",nocase; classtype:attempted-recon; sid:200002791; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"istras.com",nocase; classtype:attempted-recon; sid:200002792; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"istudyalumni.com",nocase; classtype:attempted-recon; sid:200002793; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"isue-ideent-privacy-update-secu-recovriy-andromeda-44.web.id",nocase; classtype:attempted-recon; sid:200002794; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"it-europe564598-com.filesusr.com",nocase; classtype:attempted-recon; sid:200002795; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"it-friedli.ch",nocase; classtype:attempted-recon; sid:200002796; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"it-supportdesk.com",nocase; classtype:attempted-recon; sid:200002797; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"it.melnikhotels.com",nocase; classtype:attempted-recon; sid:200002798; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"it2021samoa.000webhostapp.com",nocase; classtype:attempted-recon; sid:200002799; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"itaauinf.byethost7.com",nocase; classtype:attempted-recon; sid:200002800; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"italminna.com",nocase; classtype:attempted-recon; sid:200002801; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"itamwallet.000webhostapp.com",nocase; classtype:attempted-recon; sid:200002802; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"itau.gq",nocase; classtype:attempted-recon; sid:200002803; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"itaucard21437.000webhostapp.com",nocase; classtype:attempted-recon; sid:200002804; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"itechcircle.com",nocase; classtype:attempted-recon; sid:200002805; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"itiy.in",nocase; classtype:attempted-recon; sid:200002806; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"itryratan.com",nocase; classtype:attempted-recon; sid:200002807; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"itsmdshahin.github.io",nocase; classtype:attempted-recon; sid:200002808; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iuagri.tk",nocase; classtype:attempted-recon; sid:200002809; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iuhkj.r4f4vmtlso.workers.dev",nocase; classtype:attempted-recon; sid:200002810; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iuliss6.3utilities.com",nocase; classtype:attempted-recon; sid:200002811; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iutdigne.free.fr",nocase; classtype:attempted-recon; sid:200002812; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iuyhfd.hyperphp.com",nocase; classtype:attempted-recon; sid:200002813; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iw2b-cadastronovo.com",nocase; classtype:attempted-recon; sid:200002814; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"izcalttia.com",nocase; classtype:attempted-recon; sid:200002815; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.7kt.caretek.com.au",nocase; classtype:attempted-recon; sid:200002816; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j6a656akodf.typeform.com",nocase; classtype:attempted-recon; sid:200002817; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j6rdc0.webwave.dev",nocase; classtype:attempted-recon; sid:200002818; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j9aolejd98d.typeform.com",nocase; classtype:attempted-recon; sid:200002819; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jaban.cn",nocase; classtype:attempted-recon; sid:200002820; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jabezrealtyservices.com",nocase; classtype:attempted-recon; sid:200002821; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jabkzahrimasjoun.blogspot.com",nocase; classtype:attempted-recon; sid:200002822; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jaccsivr.vmenu.jp",nocase; classtype:attempted-recon; sid:200002823; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jackbinaspuol.blogspot.com",nocase; classtype:attempted-recon; sid:200002824; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jacobliston.com",nocase; classtype:attempted-recon; sid:200002825; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jadebest.ru",nocase; classtype:attempted-recon; sid:200002826; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jaees-srevioc-traind-jalg0000100m.sarahdarwin1.cn",nocase; classtype:attempted-recon; sid:200002827; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jaees-srevioc-traind-jalg0000100m.slheloisehuxley.cn",nocase; classtype:attempted-recon; sid:200002828; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jaees-srevioc-traind-jalg0000100m.tengxinseal.cn",nocase; classtype:attempted-recon; sid:200002829; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jaees-srevioc-traind-jalg0000100m.weimakeji15.cn",nocase; classtype:attempted-recon; sid:200002830; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jagex.nu",nocase; classtype:attempted-recon; sid:200002831; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jalfre.com",nocase; classtype:attempted-recon; sid:200002832; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jam-023d.gitlab.io",nocase; classtype:attempted-recon; sid:200002833; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jameshallybone.co.uk",nocase; classtype:attempted-recon; sid:200002834; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jamesonpcapitalgroup.com",nocase; classtype:attempted-recon; sid:200002835; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jasakirimshopeeid.duckdns.org",nocase; classtype:attempted-recon; sid:200002836; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jasminsafaris.co.ke",nocase; classtype:attempted-recon; sid:200002837; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jasonmaiolo.com",nocase; classtype:attempted-recon; sid:200002838; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"javarockingland.com",nocase; classtype:attempted-recon; sid:200002839; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jcbo.top",nocase; classtype:attempted-recon; sid:200002840; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jcmitalia.it",nocase; classtype:attempted-recon; sid:200002841; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jctuitiononline.com.sg",nocase; classtype:attempted-recon; sid:200002842; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jeffreybcam.net",nocase; classtype:attempted-recon; sid:200002843; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jeffreylcapitalgroup.com",nocase; classtype:attempted-recon; sid:200002844; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jeffvandewalle.com",nocase; classtype:attempted-recon; sid:200002845; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jenniangel.vzpla.net",nocase; classtype:attempted-recon; sid:200002846; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jetser-electrical-supply.business.site",nocase; classtype:attempted-recon; sid:200002847; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jettlinkkk.webador.co.uk",nocase; classtype:attempted-recon; sid:200002848; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jeuxnys.com",nocase; classtype:attempted-recon; sid:200002849; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jewlsh.com",nocase; classtype:attempted-recon; sid:200002850; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jflkp.csb.app",nocase; classtype:attempted-recon; sid:200002851; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jhhjfdsjjfdsjnsfdjnkfsjknfs-inrgw.ondigitalocean.app",nocase; classtype:attempted-recon; sid:200002852; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jho.click",nocase; classtype:attempted-recon; sid:200002853; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jiaheconstuction.com",nocase; classtype:attempted-recon; sid:200002854; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jibnubank.com",nocase; classtype:attempted-recon; sid:200002855; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jide43977005.sitebuilder.name.tools",nocase; classtype:attempted-recon; sid:200002856; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jifxrefamtafjyefceovjqzstf-dot-gowa11111111.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200002857; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jijisa.com",nocase; classtype:attempted-recon; sid:200002858; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jindaltextiles.com",nocase; classtype:attempted-recon; sid:200002859; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jiontnteegrubwhtsp.se.ke",nocase; classtype:attempted-recon; sid:200002860; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jiwanramchemical.com",nocase; classtype:attempted-recon; sid:200002861; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jjfurniturerepair.com",nocase; classtype:attempted-recon; sid:200002862; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jk3bt83s.r.eu-west-1.awstrack.me",nocase; classtype:attempted-recon; sid:200002863; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jkasdhjhs.mipropia.com",nocase; classtype:attempted-recon; sid:200002864; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jlogine.com",nocase; classtype:attempted-recon; sid:200002865; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jms-ibs.com",nocase; classtype:attempted-recon; sid:200002866; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jnq0y.weblium.site",nocase; classtype:attempted-recon; sid:200002867; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jocapelli.com",nocase; classtype:attempted-recon; sid:200002868; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joe23.aidaform.com",nocase; classtype:attempted-recon; sid:200002869; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joecamera.net",nocase; classtype:attempted-recon; sid:200002870; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joeypmemorialfoundation.com",nocase; classtype:attempted-recon; sid:200002871; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joeytorres.com",nocase; classtype:attempted-recon; sid:200002872; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"john-ashley.de",nocase; classtype:attempted-recon; sid:200002873; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"join-whatapp.otzo.com",nocase; classtype:attempted-recon; sid:200002874; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"join-whatsappk8wh.xxuz.com",nocase; classtype:attempted-recon; sid:200002875; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joindewasa.qpoe.com",nocase; classtype:attempted-recon; sid:200002876; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joingroup2.myz.info",nocase; classtype:attempted-recon; sid:200002877; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joingrup-whatsappbokep.duckdns.org",nocase; classtype:attempted-recon; sid:200002878; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joingrupwa18xnx.duckdns.org",nocase; classtype:attempted-recon; sid:200002879; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joingrupwhatsapp-tanteku.duckdns.org",nocase; classtype:attempted-recon; sid:200002880; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joinngrubwa.itsaol.com",nocase; classtype:attempted-recon; sid:200002881; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joinss-grubs-sexssnew201.duckdns.org",nocase; classtype:attempted-recon; sid:200002882; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joinwhatsapp1.duckdns.org",nocase; classtype:attempted-recon; sid:200002883; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joker179.com",nocase; classtype:attempted-recon; sid:200002884; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jor-admin.servebeer.com",nocase; classtype:attempted-recon; sid:200002885; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joudialbarat.blogspot.com",nocase; classtype:attempted-recon; sid:200002886; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joul.co.kr",nocase; classtype:attempted-recon; sid:200002887; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joyarrington.com",nocase; classtype:attempted-recon; sid:200002888; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"joyeriajireh.com.mx",nocase; classtype:attempted-recon; sid:200002889; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jp-etc.cyou",nocase; classtype:attempted-recon; sid:200002890; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jp.mcorecari.com",nocase; classtype:attempted-recon; sid:200002891; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jptechdocsign.net",nocase; classtype:attempted-recon; sid:200002892; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jrcreformasemanutencao.com.br",nocase; classtype:attempted-recon; sid:200002893; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jrhayley.plus.com",nocase; classtype:attempted-recon; sid:200002894; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jsbyv.app.link",nocase; classtype:attempted-recon; sid:200002895; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jstrieb.github.io",nocase; classtype:attempted-recon; sid:200002896; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jtrffrrt.hyperphp.com",nocase; classtype:attempted-recon; sid:200002897; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"juandfar.github.io",nocase; classtype:attempted-recon; sid:200002898; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"juanthradio.com",nocase; classtype:attempted-recon; sid:200002899; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"judithleoni.com",nocase; classtype:attempted-recon; sid:200002900; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"judysigner.cafe24.com",nocase; classtype:attempted-recon; sid:200002901; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"juikdghzzwancicabxygjucbwl-dot-gowa11111111.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200002902; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"julianamartinezaccesorios.com",nocase; classtype:attempted-recon; sid:200002903; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jun1.hyperphp.com",nocase; classtype:attempted-recon; sid:200002904; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"juries.servebeer.com",nocase; classtype:attempted-recon; sid:200002905; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jurlebedev.ru",nocase; classtype:attempted-recon; sid:200002906; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"justgot.gonevis.com",nocase; classtype:attempted-recon; sid:200002907; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"justlookapp.com",nocase; classtype:attempted-recon; sid:200002908; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"justsayingbro.com",nocase; classtype:attempted-recon; sid:200002909; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jvjvfg.tk",nocase; classtype:attempted-recon; sid:200002910; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"k4je4zal.yolasite.com",nocase; classtype:attempted-recon; sid:200002911; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"k8923.csb.app",nocase; classtype:attempted-recon; sid:200002912; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kaamwalibais.co.in",nocase; classtype:attempted-recon; sid:200002913; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kagyulibrary.hk",nocase; classtype:attempted-recon; sid:200002914; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kaionesaw.com",nocase; classtype:attempted-recon; sid:200002915; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kalarirmalove.loveslife.biz",nocase; classtype:attempted-recon; sid:200002916; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kalmiaaxonic.info",nocase; classtype:attempted-recon; sid:200002917; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kammleads.com",nocase; classtype:attempted-recon; sid:200002918; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"karenjob.com.br",nocase; classtype:attempted-recon; sid:200002919; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"karin-gafom.de",nocase; classtype:attempted-recon; sid:200002920; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"karnarupiah.com",nocase; classtype:attempted-recon; sid:200002921; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kartaltepespor.com",nocase; classtype:attempted-recon; sid:200002922; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kartarky-online.cz",nocase; classtype:attempted-recon; sid:200002923; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kashmir-packages.com",nocase; classtype:attempted-recon; sid:200002924; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kavrecampus.edu.np",nocase; classtype:attempted-recon; sid:200002925; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kbl-ltd.co.jp",nocase; classtype:attempted-recon; sid:200002926; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kblessedmom.com.np",nocase; classtype:attempted-recon; sid:200002927; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kbstitchdesigns.com",nocase; classtype:attempted-recon; sid:200002928; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kbx1orln7nj.typeform.com",nocase; classtype:attempted-recon; sid:200002929; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kcimagesplus.com",nocase; classtype:attempted-recon; sid:200002930; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kdlscaffolding.co.uk",nocase; classtype:attempted-recon; sid:200002931; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kdspumps.com",nocase; classtype:attempted-recon; sid:200002932; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kecbearings.com",nocase; classtype:attempted-recon; sid:200002933; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kecmanijada.com",nocase; classtype:attempted-recon; sid:200002934; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kedrieve.com",nocase; classtype:attempted-recon; sid:200002935; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"keepspiritdesign.com",nocase; classtype:attempted-recon; sid:200002936; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"keeptrying.co.za",nocase; classtype:attempted-recon; sid:200002937; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kellsougsfrek.byethost17.com",nocase; classtype:attempted-recon; sid:200002938; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kelpiesinc.com",nocase; classtype:attempted-recon; sid:200002939; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ken.kulaklikdergisi.com",nocase; classtype:attempted-recon; sid:200002940; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kennel-buffing.com",nocase; classtype:attempted-recon; sid:200002941; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kenyaembassyjuba.com",nocase; classtype:attempted-recon; sid:200002942; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"keramikadecor.com.ua",nocase; classtype:attempted-recon; sid:200002943; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"keyboardtreasures.com",nocase; classtype:attempted-recon; sid:200002944; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kfdg.omnicamp1.com",nocase; classtype:attempted-recon; sid:200002945; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kh3wfp6f.easy.co",nocase; classtype:attempted-recon; sid:200002946; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"khichik.in",nocase; classtype:attempted-recon; sid:200002947; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kids.newpsalmist.org",nocase; classtype:attempted-recon; sid:200002948; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kilshi.com",nocase; classtype:attempted-recon; sid:200002949; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kimscakedesigns.com.au",nocase; classtype:attempted-recon; sid:200002950; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kind-villani.13-93-165-215.plesk.page",nocase; classtype:attempted-recon; sid:200002951; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kineutn.club",nocase; classtype:attempted-recon; sid:200002952; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kissapps.io",nocase; classtype:attempted-recon; sid:200002953; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kit.mishkanhakavana.com",nocase; classtype:attempted-recon; sid:200002954; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kjsa.com",nocase; classtype:attempted-recon; sid:200002955; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kjsdhtw.tk",nocase; classtype:attempted-recon; sid:200002956; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"klantenservicebelgies.com",nocase; classtype:attempted-recon; sid:200002957; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"klantportaal.de",nocase; classtype:attempted-recon; sid:200002958; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"klmailing.info",nocase; classtype:attempted-recon; sid:200002959; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"klockorochsmycken.se",nocase; classtype:attempted-recon; sid:200002960; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"klsjdlfkjqslfkjsdlkfjldsfjldsf.blogspot.com",nocase; classtype:attempted-recon; sid:200002961; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"klveiculosmontealto.com.br",nocase; classtype:attempted-recon; sid:200002962; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"km4o0.codesandbox.io",nocase; classtype:attempted-recon; sid:200002963; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kmaqhvswdmrozqrcugdekkvbbo-dot-gowa11111111.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200002964; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kob5.epizy.com",nocase; classtype:attempted-recon; sid:200002965; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"koerich-c-empresarial.com",nocase; classtype:attempted-recon; sid:200002966; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kojd6.app.link",nocase; classtype:attempted-recon; sid:200002967; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"konami-uefa-euro.net",nocase; classtype:attempted-recon; sid:200002968; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kone-ali123-mon-site-web-cheetah-5.cheetah.builderall.com",nocase; classtype:attempted-recon; sid:200002969; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"konskij-vozbuditel.ru",nocase; classtype:attempted-recon; sid:200002970; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kontoopdatering.appleld.dk.opdatering.dspbrand.com",nocase; classtype:attempted-recon; sid:200002971; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kookbros.com",nocase; classtype:attempted-recon; sid:200002972; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"koreiamotors.com.br",nocase; classtype:attempted-recon; sid:200002973; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kormendinora.com",nocase; classtype:attempted-recon; sid:200002974; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"korzhneva.com",nocase; classtype:attempted-recon; sid:200002975; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"koskas.activehosted.com",nocase; classtype:attempted-recon; sid:200002976; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kospod.com",nocase; classtype:attempted-recon; sid:200002977; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kovolem.cz",nocase; classtype:attempted-recon; sid:200002978; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kp.kralenexpres.nl",nocase; classtype:attempted-recon; sid:200002979; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kr-bithumb.web.app",nocase; classtype:attempted-recon; sid:200002980; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"krakenrums.blogspot.com",nocase; classtype:attempted-recon; sid:200002981; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kreiskassenverband12.xyz",nocase; classtype:attempted-recon; sid:200002982; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kreiskassenverband1345.xyz",nocase; classtype:attempted-recon; sid:200002983; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kreiskassenverband14.xyz",nocase; classtype:attempted-recon; sid:200002984; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kreiskassenverband15.xyz",nocase; classtype:attempted-recon; sid:200002985; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kreiskassenverband15643.xyz",nocase; classtype:attempted-recon; sid:200002986; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kreiskassenverband166.xyz",nocase; classtype:attempted-recon; sid:200002987; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"krishnakhatri.com.np",nocase; classtype:attempted-recon; sid:200002988; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"krishnaprotabsolutions.co.in",nocase; classtype:attempted-recon; sid:200002989; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"krishnawatch.com",nocase; classtype:attempted-recon; sid:200002990; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kropiwnicki.com.pl",nocase; classtype:attempted-recon; sid:200002991; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kscdcg.webwave.dev",nocase; classtype:attempted-recon; sid:200002992; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kshconsultingllc.com",nocase; classtype:attempted-recon; sid:200002993; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ksk-reaktiverung.com",nocase; classtype:attempted-recon; sid:200002994; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kskfiliale07.xyz",nocase; classtype:attempted-recon; sid:200002995; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kuchkuchnights.com",nocase; classtype:attempted-recon; sid:200002996; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kulikovets.ru",nocase; classtype:attempted-recon; sid:200002997; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kundendaten-aktivierung.com",nocase; classtype:attempted-recon; sid:200002998; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kungmedia.com",nocase; classtype:attempted-recon; sid:200002999; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kurbanirgoru.com",nocase; classtype:attempted-recon; sid:200003000; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kurdistan-gallery.com",nocase; classtype:attempted-recon; sid:200003001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kurortnoye.com.ua",nocase; classtype:attempted-recon; sid:200003002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kxgsluznfblwltjhnywgzqwhwq-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200003003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kyleaustincollins.com",nocase; classtype:attempted-recon; sid:200003004; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kyn168.club",nocase; classtype:attempted-recon; sid:200003005; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kynw.club",nocase; classtype:attempted-recon; sid:200003006; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kyovlqokawddshywlnynoyxxmh-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200003007; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kytduyfguo-105122.square.site",nocase; classtype:attempted-recon; sid:200003008; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.joingroupppwatsappp.duckdns.org",nocase; classtype:attempted-recon; sid:200003009; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l1zuo.codesandbox.io",nocase; classtype:attempted-recon; sid:200003010; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l2royalties.com",nocase; classtype:attempted-recon; sid:200003011; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l6bzuo.webwave.dev",nocase; classtype:attempted-recon; sid:200003012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l7s.com.br",nocase; classtype:attempted-recon; sid:200003013; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"labanque-postale-activation-miss.justns.ru",nocase; classtype:attempted-recon; sid:200003014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"labanquepostale-francepostale.gq",nocase; classtype:attempted-recon; sid:200003015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"labogaya.ma",nocase; classtype:attempted-recon; sid:200003016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"labore-ma.blogspot.com",nocase; classtype:attempted-recon; sid:200003017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"labpenjasfkip.ulm.ac.id",nocase; classtype:attempted-recon; sid:200003018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lafise.co",nocase; classtype:attempted-recon; sid:200003019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"laibia.com",nocase; classtype:attempted-recon; sid:200003020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lakp.pl",nocase; classtype:attempted-recon; sid:200003021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"laliquidacion.dev03.aws3.net",nocase; classtype:attempted-recon; sid:200003022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lamaison.bc.ca",nocase; classtype:attempted-recon; sid:200003023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lamoorespizza.com",nocase; classtype:attempted-recon; sid:200003024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lano.my",nocase; classtype:attempted-recon; sid:200003025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lapiraterieestla.wixsite.com",nocase; classtype:attempted-recon; sid:200003026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lapostemail44.wixsite.com",nocase; classtype:attempted-recon; sid:200003027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lapostiyem.com",nocase; classtype:attempted-recon; sid:200003028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lapotosinaexpress.com",nocase; classtype:attempted-recon; sid:200003029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"laptopfinance.org.uk",nocase; classtype:attempted-recon; sid:200003030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"laraccount.com",nocase; classtype:attempted-recon; sid:200003031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"larindbr.creatorlink.net",nocase; classtype:attempted-recon; sid:200003032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"larvalab.to",nocase; classtype:attempted-recon; sid:200003033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lasyaja.github.io",nocase; classtype:attempted-recon; sid:200003034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"latinotravel.cz",nocase; classtype:attempted-recon; sid:200003035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"latmasoud.persiangig.com",nocase; classtype:attempted-recon; sid:200003036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"latoriel.xyz",nocase; classtype:attempted-recon; sid:200003037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"layananshopee.duckdns.org",nocase; classtype:attempted-recon; sid:200003038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lazarus.co.zw",nocase; classtype:attempted-recon; sid:200003039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lazy.myvnc.com",nocase; classtype:attempted-recon; sid:200003040; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lbc.aceslbcversemen.com",nocase; classtype:attempted-recon; sid:200003041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lbcpzoanseguranet.sitegooe.com",nocase; classtype:attempted-recon; sid:200003042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lbcpzoanseguranetpe.sitgon.com",nocase; classtype:attempted-recon; sid:200003043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lbcpzonaseguranetpe.cubpops.com",nocase; classtype:attempted-recon; sid:200003044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lcdjh.codesandbox.io",nocase; classtype:attempted-recon; sid:200003045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lcloud.app",nocase; classtype:attempted-recon; sid:200003046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ldsplanettt.yolasite.com",nocase; classtype:attempted-recon; sid:200003047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"le-diablotin-rouen.com",nocase; classtype:attempted-recon; sid:200003048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leadershipmail.org",nocase; classtype:attempted-recon; sid:200003049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leapstcyran.fr",nocase; classtype:attempted-recon; sid:200003050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"learning-academy.com.au",nocase; classtype:attempted-recon; sid:200003051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"learning.validate.santander.digital",nocase; classtype:attempted-recon; sid:200003052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leboncoin-fr.3ds-ivpay.site",nocase; classtype:attempted-recon; sid:200003053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leboncoin-paiementsecured.paperform.co",nocase; classtype:attempted-recon; sid:200003054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leboncoin.la",nocase; classtype:attempted-recon; sid:200003055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leboncoin.leiboncoin.com",nocase; classtype:attempted-recon; sid:200003056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leboncoinf.connexionlbc.com",nocase; classtype:attempted-recon; sid:200003057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leboncoinsecupaiement.paperform.co",nocase; classtype:attempted-recon; sid:200003058; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leboncoinsecurepaiement.fr",nocase; classtype:attempted-recon; sid:200003059; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lecord.com",nocase; classtype:attempted-recon; sid:200003060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lecro.digital",nocase; classtype:attempted-recon; sid:200003061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lectiocolombia.com",nocase; classtype:attempted-recon; sid:200003062; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lefsb.csb.app",nocase; classtype:attempted-recon; sid:200003063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"legalshield.com_client-authorize-id.2uvna-noiwm-bop7l-idjvr-kzk8u.bursavebiz.com",nocase; classtype:attempted-recon; sid:200003064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"legendtitleagency.com",nocase; classtype:attempted-recon; sid:200003065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leitersadvogados.com.br",nocase; classtype:attempted-recon; sid:200003066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lekeet.com",nocase; classtype:attempted-recon; sid:200003067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lemonyellowsun.com",nocase; classtype:attempted-recon; sid:200003068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lenagruessdich.net",nocase; classtype:attempted-recon; sid:200003069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lender.sandbox.natwest.poweredbydivido.com",nocase; classtype:attempted-recon; sid:200003070; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leni-pisker.byethost7.com",nocase; classtype:attempted-recon; sid:200003071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leotravel.ch",nocase; classtype:attempted-recon; sid:200003072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leqcen.top",nocase; classtype:attempted-recon; sid:200003073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lerocice1911.blogspot.com",nocase; classtype:attempted-recon; sid:200003074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lesbenwelt.de",nocase; classtype:attempted-recon; sid:200003075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lesfreresnacash.com",nocase; classtype:attempted-recon; sid:200003076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"letsjumpnj.com",nocase; classtype:attempted-recon; sid:200003077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"leuqwozaaftwljnbpejuitjumtlprjheuqwxtsaj.bafz.cn",nocase; classtype:attempted-recon; sid:200003078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lexnotes.com.ng",nocase; classtype:attempted-recon; sid:200003079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lfelelei.agilecrm.com",nocase; classtype:attempted-recon; sid:200003080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lfgtrk.com",nocase; classtype:attempted-recon; sid:200003081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lg-onecom-io.web.app",nocase; classtype:attempted-recon; sid:200003082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"library.foraqsa.com",nocase; classtype:attempted-recon; sid:200003083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"licpedrojsaldivar.com",nocase; classtype:attempted-recon; sid:200003084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"liezen-online.at",nocase; classtype:attempted-recon; sid:200003085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lifehackersacademy.com",nocase; classtype:attempted-recon; sid:200003086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"liga-norm.com.ua",nocase; classtype:attempted-recon; sid:200003087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lightlink.com.cn",nocase; classtype:attempted-recon; sid:200003088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lihi3.cc",nocase; classtype:attempted-recon; sid:200003089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lihi3.com",nocase; classtype:attempted-recon; sid:200003090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"likecreeper.com",nocase; classtype:attempted-recon; sid:200003091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"likss-updat-schb.demopage.co",nocase; classtype:attempted-recon; sid:200003092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lindalpilcher.com",nocase; classtype:attempted-recon; sid:200003093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lindyandfriends.net",nocase; classtype:attempted-recon; sid:200003094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linesn.ru",nocase; classtype:attempted-recon; sid:200003095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linesoe.github.io",nocase; classtype:attempted-recon; sid:200003096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lingojob.com",nocase; classtype:attempted-recon; sid:200003097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"link-grup-whatshap768.duckdns.org",nocase; classtype:attempted-recon; sid:200003098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"link.eezzyshop.com",nocase; classtype:attempted-recon; sid:200003099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"link.upnyk.ac.id",nocase; classtype:attempted-recon; sid:200003100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linkedin.app.fit.ba",nocase; classtype:attempted-recon; sid:200003101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linkedn.jikimi-5575.oo.gd",nocase; classtype:attempted-recon; sid:200003102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"links-newsandtimes.net",nocase; classtype:attempted-recon; sid:200003103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linpromerxx1.byethost9.com",nocase; classtype:attempted-recon; sid:200003104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lion.main.jp",nocase; classtype:attempted-recon; sid:200003105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"liongear.com",nocase; classtype:attempted-recon; sid:200003106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"liusanchuan.github.io",nocase; classtype:attempted-recon; sid:200003107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"live-site.hopto.me",nocase; classtype:attempted-recon; sid:200003108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"live3jertech833.byethost7.com",nocase; classtype:attempted-recon; sid:200003109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"livinglawsociety.org",nocase; classtype:attempted-recon; sid:200003110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lkt.bio",nocase; classtype:attempted-recon; sid:200003111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"llantasmex.com",nocase; classtype:attempted-recon; sid:200003112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloyd-reviewdata.com",nocase; classtype:attempted-recon; sid:200003113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydbank-accountbreach.com",nocase; classtype:attempted-recon; sid:200003114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydbank-connect-payee.com",nocase; classtype:attempted-recon; sid:200003115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydbank-devicehelp.com",nocase; classtype:attempted-recon; sid:200003116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydbank-online-secures.com",nocase; classtype:attempted-recon; sid:200003117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydbank-secure-customers.com",nocase; classtype:attempted-recon; sid:200003118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydbank-support-team.com",nocase; classtype:attempted-recon; sid:200003119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydbanking-securelogin.com",nocase; classtype:attempted-recon; sid:200003120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloyds-bank-help-page.com",nocase; classtype:attempted-recon; sid:200003121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloyds-payeecancellations.com",nocase; classtype:attempted-recon; sid:200003122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloyds-uk-bank.com",nocase; classtype:attempted-recon; sid:200003123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydsbank.deregister-payee-secure-auth.com",nocase; classtype:attempted-recon; sid:200003124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydsbank.deregister-payee-security-auth.com",nocase; classtype:attempted-recon; sid:200003125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydsbank.login-personal-devices.com",nocase; classtype:attempted-recon; sid:200003126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydsbank.online-auth-verify-secure.com",nocase; classtype:attempted-recon; sid:200003127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydsbank.online-security-auth-verify.com",nocase; classtype:attempted-recon; sid:200003128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydsbank.online-visit-secure-auth.com",nocase; classtype:attempted-recon; sid:200003129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydsbank.personal-devices-login.com",nocase; classtype:attempted-recon; sid:200003130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydsbank.personal-login-secure-payee.com",nocase; classtype:attempted-recon; sid:200003131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydsbank.protect-secure-prevent.com",nocase; classtype:attempted-recon; sid:200003132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydsbank.secure-device-protect.net",nocase; classtype:attempted-recon; sid:200003133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydsbank.secure-online-deregister.com",nocase; classtype:attempted-recon; sid:200003134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydsbank.secure-personal-device-login.com",nocase; classtype:attempted-recon; sid:200003135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloyduk-newdevice-registered-online.com",nocase; classtype:attempted-recon; sid:200003136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloyduk-online.com",nocase; classtype:attempted-recon; sid:200003137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lmaox.com",nocase; classtype:attempted-recon; sid:200003138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lmax509788.com",nocase; classtype:attempted-recon; sid:200003139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lmax89898.com",nocase; classtype:attempted-recon; sid:200003140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lmax9788.net",nocase; classtype:attempted-recon; sid:200003141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lmlenzitrasporti.com",nocase; classtype:attempted-recon; sid:200003142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lms.ozyegin.edu.tr",nocase; classtype:attempted-recon; sid:200003143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnfo-poste.queencolchoes.com.br",nocase; classtype:attempted-recon; sid:200003144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnk.pmlti-etai-2.ovh",nocase; classtype:attempted-recon; sid:200003145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnpost-0rder.pl-id08842906.xyz",nocase; classtype:attempted-recon; sid:200003146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnstalam.eu",nocase; classtype:attempted-recon; sid:200003147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lntebaxk.com",nocase; classtype:attempted-recon; sid:200003148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnterbanlkhome.weworldnews.com",nocase; classtype:attempted-recon; sid:200003149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnterbanlkpewelb.castlechemicals.sv2.cheshire-online.com",nocase; classtype:attempted-recon; sid:200003150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnterbanlkweb.entrepreneurialsuccessprogram.com",nocase; classtype:attempted-recon; sid:200003151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnterbanlkwelb.lodicomputer.com",nocase; classtype:attempted-recon; sid:200003152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnterbkapp.xyz",nocase; classtype:attempted-recon; sid:200003153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnterlbkalertas.xyz",nocase; classtype:attempted-recon; sid:200003154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"loaqyafckiduqgxidlhebxkvlu-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200003155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lobbygolf.org",nocase; classtype:attempted-recon; sid:200003156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"local.bitz.co.za",nocase; classtype:attempted-recon; sid:200003157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"localbusinesscitationbuilding.com",nocase; classtype:attempted-recon; sid:200003158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"localpublicidad.com",nocase; classtype:attempted-recon; sid:200003159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"loess.3utilities.com",nocase; classtype:attempted-recon; sid:200003160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lofon-add.firebaseapp.com",nocase; classtype:attempted-recon; sid:200003161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"logex.com.tr",nocase; classtype:attempted-recon; sid:200003162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"loghhtmls.byethost24.com",nocase; classtype:attempted-recon; sid:200003163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"logienhalp2.tk",nocase; classtype:attempted-recon; sid:200003164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"logienhalp3.tk",nocase; classtype:attempted-recon; sid:200003165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"logienhalp5.tk",nocase; classtype:attempted-recon; sid:200003166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login-bank.org",nocase; classtype:attempted-recon; sid:200003167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login-live.com-s02.net",nocase; classtype:attempted-recon; sid:200003168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login-onlinebanking-suntrust-olb.net",nocase; classtype:attempted-recon; sid:200003169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login.eskuvoclassic.hu",nocase; classtype:attempted-recon; sid:200003170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login.outlook-365.net",nocase; classtype:attempted-recon; sid:200003171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login.privategold.uytrtyuhij987.gowithapex.com",nocase; classtype:attempted-recon; sid:200003172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login.vdohnovenie.org.ua",nocase; classtype:attempted-recon; sid:200003173; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"loginrun.info",nocase; classtype:attempted-recon; sid:200003174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"logitel.com.au",nocase; classtype:attempted-recon; sid:200003175; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"logowanie24securebos.com",nocase; classtype:attempted-recon; sid:200003176; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"logowizardz.themonkco.com",nocase; classtype:attempted-recon; sid:200003177; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lokerpatscity.byethost33.com",nocase; classtype:attempted-recon; sid:200003178; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lolostes.my.id",nocase; classtype:attempted-recon; sid:200003179; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lombard11.eu",nocase; classtype:attempted-recon; sid:200003180; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"londonmakt.com",nocase; classtype:attempted-recon; sid:200003181; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lookdigital.co",nocase; classtype:attempted-recon; sid:200003182; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lopn.planetwaves.am",nocase; classtype:attempted-recon; sid:200003183; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lordgordon.it",nocase; classtype:attempted-recon; sid:200003184; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"loto041219.blogspot.com",nocase; classtype:attempted-recon; sid:200003185; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"loverlampos.vzpla.net",nocase; classtype:attempted-recon; sid:200003186; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lovesouls.ru",nocase; classtype:attempted-recon; sid:200003187; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lp.vp4.me",nocase; classtype:attempted-recon; sid:200003188; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lqg8u8.webwave.dev",nocase; classtype:attempted-recon; sid:200003189; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lrlscpxminlelvvdoxsralshoilhuzoyaflympjb.xmonk.cn",nocase; classtype:attempted-recon; sid:200003190; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lsquaredwebdesigns.com",nocase; classtype:attempted-recon; sid:200003191; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ltau.ativesms.com",nocase; classtype:attempted-recon; sid:200003192; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ltitrk.com",nocase; classtype:attempted-recon; sid:200003193; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lucie-inter.myshopwired.com",nocase; classtype:attempted-recon; sid:200003194; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"luckylkhraylbwal.blogspot.com",nocase; classtype:attempted-recon; sid:200003195; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lucy-walker.com",nocase; classtype:attempted-recon; sid:200003196; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lucywestpdaarubcorubber.org",nocase; classtype:attempted-recon; sid:200003197; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ludiequip.es",nocase; classtype:attempted-recon; sid:200003198; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lumail61.wixsite.com",nocase; classtype:attempted-recon; sid:200003199; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"luxuriousmagazineasia.com",nocase; classtype:attempted-recon; sid:200003200; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"luxuryautomobile.me",nocase; classtype:attempted-recon; sid:200003201; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"luxustelekatermeszetben.hu",nocase; classtype:attempted-recon; sid:200003202; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ly12-52.dazog.ge",nocase; classtype:attempted-recon; sid:200003203; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lycee-ozanam35.fr",nocase; classtype:attempted-recon; sid:200003204; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lygzxi.top",nocase; classtype:attempted-recon; sid:200003205; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lynkos.com.br",nocase; classtype:attempted-recon; sid:200003206; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m-1q45axh0.streamsteam.ca",nocase; classtype:attempted-recon; sid:200003207; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m-magnet-fix.healthy-looks.com",nocase; classtype:attempted-recon; sid:200003208; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.07runescape.com.au",nocase; classtype:attempted-recon; sid:200003209; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.emd9856.com",nocase; classtype:attempted-recon; sid:200003210; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.es.runescape.com-ov.ru",nocase; classtype:attempted-recon; sid:200003211; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.hf2555.com",nocase; classtype:attempted-recon; sid:200003212; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.hf862.com",nocase; classtype:attempted-recon; sid:200003213; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.hf9996.com",nocase; classtype:attempted-recon; sid:200003214; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.httpservlces.runescape.com-ov.ru",nocase; classtype:attempted-recon; sid:200003215; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.httpsservlces.runescape.com-m.ru",nocase; classtype:attempted-recon; sid:200003216; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.tpservlices.runescape.com-nu.ru",nocase; classtype:attempted-recon; sid:200003217; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.www.pma.runescape.com-gb.ru",nocase; classtype:attempted-recon; sid:200003218; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m25g.22web.org",nocase; classtype:attempted-recon; sid:200003219; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m42club.com",nocase; classtype:attempted-recon; sid:200003220; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m54af8.webwave.dev",nocase; classtype:attempted-recon; sid:200003221; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mabp.s-fr.net",nocase; classtype:attempted-recon; sid:200003222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"macro-sistemas.com",nocase; classtype:attempted-recon; sid:200003223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"maddho435st.gb.net",nocase; classtype:attempted-recon; sid:200003224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"madeinluis067.byethost33.com",nocase; classtype:attempted-recon; sid:200003225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"madens.com.pl",nocase; classtype:attempted-recon; sid:200003226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"madrugadaolanches.com.br",nocase; classtype:attempted-recon; sid:200003227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"maestro.my.prod.dfg152.ru",nocase; classtype:attempted-recon; sid:200003228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"magazin-top-gmnx.de",nocase; classtype:attempted-recon; sid:200003229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"magicteachescoresubjects.com",nocase; classtype:attempted-recon; sid:200003230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"maikhl0.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200003231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail-account-verify-f4723.web.app",nocase; classtype:attempted-recon; sid:200003232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail-instargam.miwork.ru",nocase; classtype:attempted-recon; sid:200003233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail-ovhcloud.web.app",nocase; classtype:attempted-recon; sid:200003234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail-reschedules.com",nocase; classtype:attempted-recon; sid:200003235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail-security-server.000webhostapp.com",nocase; classtype:attempted-recon; sid:200003236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.152-70-128-242.cprapid.com",nocase; classtype:attempted-recon; sid:200003237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.allrecognitionawards.com",nocase; classtype:attempted-recon; sid:200003238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.bay81.com",nocase; classtype:attempted-recon; sid:200003239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.bay81studios.com",nocase; classtype:attempted-recon; sid:200003240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.blogdoaltivo.com.br",nocase; classtype:attempted-recon; sid:200003241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.bnfyazilim.com.tr",nocase; classtype:attempted-recon; sid:200003242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.charperimagedesign.com",nocase; classtype:attempted-recon; sid:200003243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.connexion-service.com",nocase; classtype:attempted-recon; sid:200003244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.conway.sa",nocase; classtype:attempted-recon; sid:200003245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.czechineseauction.com",nocase; classtype:attempted-recon; sid:200003246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.designandcraftsmanship.com",nocase; classtype:attempted-recon; sid:200003247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.easycoachltd.com",nocase; classtype:attempted-recon; sid:200003248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.enrollmoreclientsbootcamp.com",nocase; classtype:attempted-recon; sid:200003249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.gardenlog.com.br",nocase; classtype:attempted-recon; sid:200003250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.glui.eu",nocase; classtype:attempted-recon; sid:200003251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.harmonmedical.net",nocase; classtype:attempted-recon; sid:200003252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.hhtinvestments.com",nocase; classtype:attempted-recon; sid:200003253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.ims-fe.com",nocase; classtype:attempted-recon; sid:200003254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.infotecseg.com.br",nocase; classtype:attempted-recon; sid:200003255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.kulturkurs.se",nocase; classtype:attempted-recon; sid:200003256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.livelogrestoration.com",nocase; classtype:attempted-recon; sid:200003257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.macrofashion.com.br",nocase; classtype:attempted-recon; sid:200003258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.mlcexpresstransportes.com.br",nocase; classtype:attempted-recon; sid:200003259; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.musicgiftsgalore.com",nocase; classtype:attempted-recon; sid:200003260; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.navarrotow.com",nocase; classtype:attempted-recon; sid:200003261; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.netflixpartycanada.com",nocase; classtype:attempted-recon; sid:200003262; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.nris.com.au",nocase; classtype:attempted-recon; sid:200003263; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.o2-bill-service.com",nocase; classtype:attempted-recon; sid:200003264; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.o2-service-billings.com",nocase; classtype:attempted-recon; sid:200003265; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.phongvuexpress.vn",nocase; classtype:attempted-recon; sid:200003266; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.pnatwest.site",nocase; classtype:attempted-recon; sid:200003267; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.tariqalaraimi.com",nocase; classtype:attempted-recon; sid:200003268; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.thelovegarden.com.ph",nocase; classtype:attempted-recon; sid:200003269; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.weddingstaffcompanies.com",nocase; classtype:attempted-recon; sid:200003270; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.wheel1factory.net",nocase; classtype:attempted-recon; sid:200003271; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.windyhollandfashion.com",nocase; classtype:attempted-recon; sid:200003272; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.yehcommerce.com.br",nocase; classtype:attempted-recon; sid:200003273; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail2.mclink.it",nocase; classtype:attempted-recon; sid:200003274; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mailer2.zohoinsights-crm.com",nocase; classtype:attempted-recon; sid:200003275; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mailerserver65mailerserver65mailerserver65mailerserver65mail.s3.eu-de.cloud-object-storage.appdomain.cloud",nocase; classtype:attempted-recon; sid:200003276; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mailing.languedoc-roussillon.cci.fr",nocase; classtype:attempted-recon; sid:200003277; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mailingserver20.godaddysites.com",nocase; classtype:attempted-recon; sid:200003278; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mailmanager.engineread.gq",nocase; classtype:attempted-recon; sid:200003279; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mailorderdeliver.com",nocase; classtype:attempted-recon; sid:200003280; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mailserver7656566.blob.core.windows.net",nocase; classtype:attempted-recon; sid:200003281; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mailupgrade2info.site44.com",nocase; classtype:attempted-recon; sid:200003282; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"main.d3ud24g8g11jr7.amplifyapp.com",nocase; classtype:attempted-recon; sid:200003283; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mainehomeconnection.com",nocase; classtype:attempted-recon; sid:200003284; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"majorityclub.top",nocase; classtype:attempted-recon; sid:200003285; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"maklononline.nutrifood.co.id",nocase; classtype:attempted-recon; sid:200003286; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mala-riba.com",nocase; classtype:attempted-recon; sid:200003287; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"maliya-misrata.org",nocase; classtype:attempted-recon; sid:200003288; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"malloryweisstearpedia.com",nocase; classtype:attempted-recon; sid:200003289; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"malvaudconstruction.fr",nocase; classtype:attempted-recon; sid:200003290; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mamameloweqweqwe.my-board.org",nocase; classtype:attempted-recon; sid:200003291; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"man1bantul.sch.id",nocase; classtype:attempted-recon; sid:200003292; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"manager.ovh.com-47df764c.drmturismo.com",nocase; classtype:attempted-recon; sid:200003293; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"manager.ovh.com-bourgoin-depannage.frsd.metalworks.pt",nocase; classtype:attempted-recon; sid:200003294; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"manager.ovh.comdsfsifoyaka.comd.show-on.pt",nocase; classtype:attempted-recon; sid:200003295; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"manager.ovh.compakortex-consulting.comd.claraboya.pt",nocase; classtype:attempted-recon; sid:200003296; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"manateetreeservice.com",nocase; classtype:attempted-recon; sid:200003297; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mancomplain.com",nocase; classtype:attempted-recon; sid:200003298; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mancomplain.net",nocase; classtype:attempted-recon; sid:200003299; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mandmtextiles.com",nocase; classtype:attempted-recon; sid:200003300; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"manligtharavfall.se",nocase; classtype:attempted-recon; sid:200003301; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mantemask.com",nocase; classtype:attempted-recon; sid:200003302; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mantri.in",nocase; classtype:attempted-recon; sid:200003303; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mapadocrime.com",nocase; classtype:attempted-recon; sid:200003304; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mapleaiongroup.co.uk",nocase; classtype:attempted-recon; sid:200003305; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mapsa.com.pe",nocase; classtype:attempted-recon; sid:200003306; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mapsoft.ga",nocase; classtype:attempted-recon; sid:200003307; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"maquinasdecartaosemaluguel.com.br",nocase; classtype:attempted-recon; sid:200003308; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mar-developer.com",nocase; classtype:attempted-recon; sid:200003309; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marceluoribeiro.weebly.com",nocase; classtype:attempted-recon; sid:200003310; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marckloper.vzpla.net",nocase; classtype:attempted-recon; sid:200003311; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"margarita.md",nocase; classtype:attempted-recon; sid:200003312; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mariaeugeniafm.vzpla.net",nocase; classtype:attempted-recon; sid:200003313; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marianellame.com.ar",nocase; classtype:attempted-recon; sid:200003314; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marjaharmon.com",nocase; classtype:attempted-recon; sid:200003315; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"markazgroup.pk",nocase; classtype:attempted-recon; sid:200003316; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"markbids.com",nocase; classtype:attempted-recon; sid:200003317; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marketplace-65985214.com",nocase; classtype:attempted-recon; sid:200003318; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marketplace.cryptobay.vip",nocase; classtype:attempted-recon; sid:200003319; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marketplace.facebook.com-izkbuxmx.isiolo.go.ke",nocase; classtype:attempted-recon; sid:200003320; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marketvit.by",nocase; classtype:attempted-recon; sid:200003321; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"markgoldbach.com",nocase; classtype:attempted-recon; sid:200003322; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"markocop-giveaway.duckdns.org",nocase; classtype:attempted-recon; sid:200003323; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"martinsboots.shop",nocase; classtype:attempted-recon; sid:200003324; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"martunjukkankehebatanmy.ml",nocase; classtype:attempted-recon; sid:200003325; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"masaeilvo.com",nocase; classtype:attempted-recon; sid:200003326; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"massaget5456hera.gb.net",nocase; classtype:attempted-recon; sid:200003327; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"massimobacchini.com",nocase; classtype:attempted-recon; sid:200003328; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"masterclass-meeting.com",nocase; classtype:attempted-recon; sid:200003329; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"masterdrive.com",nocase; classtype:attempted-recon; sid:200003330; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"matbetgir1.blogspot.com",nocase; classtype:attempted-recon; sid:200003331; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"matbetgirisimizgir.blogspot.com",nocase; classtype:attempted-recon; sid:200003332; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"match.lookatmynewphotos.com",nocase; classtype:attempted-recon; sid:200003333; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"matematika.fkip.untirta.ac.id",nocase; classtype:attempted-recon; sid:200003334; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"matixlogin.eshost.com.ar",nocase; classtype:attempted-recon; sid:200003335; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mavibetgir5.blogspot.com",nocase; classtype:attempted-recon; sid:200003336; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mavibets.blogspot.com",nocase; classtype:attempted-recon; sid:200003337; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mavibett1.blogspot.com",nocase; classtype:attempted-recon; sid:200003338; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mavibett11.blogspot.com",nocase; classtype:attempted-recon; sid:200003339; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mavinglobal.net",nocase; classtype:attempted-recon; sid:200003340; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"maviswalletupdate.com",nocase; classtype:attempted-recon; sid:200003341; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mawazo.host",nocase; classtype:attempted-recon; sid:200003342; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"maxclinic.ru",nocase; classtype:attempted-recon; sid:200003343; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"maximilianschnauzers.com",nocase; classtype:attempted-recon; sid:200003344; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"maxis-winner-2020.webs.com",nocase; classtype:attempted-recon; sid:200003345; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mazinsamona.com",nocase; classtype:attempted-recon; sid:200003346; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mbex.ru",nocase; classtype:attempted-recon; sid:200003347; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mccarthyelectrical.com",nocase; classtype:attempted-recon; sid:200003348; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mckennittfamily.com",nocase; classtype:attempted-recon; sid:200003349; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mclaren-org.org",nocase; classtype:attempted-recon; sid:200003350; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mcoletacsm.temp.swtest.ru",nocase; classtype:attempted-recon; sid:200003351; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mdbil.com",nocase; classtype:attempted-recon; sid:200003352; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mdurucan.com",nocase; classtype:attempted-recon; sid:200003353; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mdvpycmtmhzxsvjukwrzzgjnsx-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200003354; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"medicinalisfarmaceutica.com.br",nocase; classtype:attempted-recon; sid:200003355; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mediosdigitalescr.com",nocase; classtype:attempted-recon; sid:200003356; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"medscore.azurewebsites.net",nocase; classtype:attempted-recon; sid:200003357; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meeting-23900123090123.bitbucket.io",nocase; classtype:attempted-recon; sid:200003358; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"megacredi.com",nocase; classtype:attempted-recon; sid:200003359; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"megasolar.lk",nocase; classtype:attempted-recon; sid:200003360; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mein-lbb.me",nocase; classtype:attempted-recon; sid:200003361; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mein.gebuhrenfrei.com",nocase; classtype:attempted-recon; sid:200003362; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meinkonto-kontrol24.blogspot.com",nocase; classtype:attempted-recon; sid:200003363; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mekelanmlock.byethost9.com",nocase; classtype:attempted-recon; sid:200003364; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"members.theatrewomen.org",nocase; classtype:attempted-recon; sid:200003365; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"membershipff.vn",nocase; classtype:attempted-recon; sid:200003366; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"memkart.com",nocase; classtype:attempted-recon; sid:200003367; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"menghuanchaoren.xyz",nocase; classtype:attempted-recon; sid:200003368; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mensajeriaexpressguatemala.com",nocase; classtype:attempted-recon; sid:200003369; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mental-zip-wma-thoroughly.trycloudflare.com",nocase; classtype:attempted-recon; sid:200003370; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mental.servegame.com",nocase; classtype:attempted-recon; sid:200003371; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mepsijikctvssrkyubkzhrzuuq-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200003372; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meracri.mers4.com",nocase; classtype:attempted-recon; sid:200003373; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.bderx.com",nocase; classtype:attempted-recon; sid:200003374; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.dhrwa.com",nocase; classtype:attempted-recon; sid:200003375; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.dwaui.com",nocase; classtype:attempted-recon; sid:200003376; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.dwaxz.com",nocase; classtype:attempted-recon; sid:200003377; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.gherw.com",nocase; classtype:attempted-recon; sid:200003378; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.gqwzx.com",nocase; classtype:attempted-recon; sid:200003379; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.hjredf.com",nocase; classtype:attempted-recon; sid:200003380; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.mers3.com",nocase; classtype:attempted-recon; sid:200003381; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.mers5.com",nocase; classtype:attempted-recon; sid:200003382; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.merse1.com",nocase; classtype:attempted-recon; sid:200003383; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.merse2.com",nocase; classtype:attempted-recon; sid:200003384; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.merse3.com",nocase; classtype:attempted-recon; sid:200003385; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.merse4.com",nocase; classtype:attempted-recon; sid:200003386; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.merse5.com",nocase; classtype:attempted-recon; sid:200003387; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.merse6.com",nocase; classtype:attempted-recon; sid:200003388; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.merse7.com",nocase; classtype:attempted-recon; sid:200003389; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.merse8.com",nocase; classtype:attempted-recon; sid:200003390; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.merssc.com",nocase; classtype:attempted-recon; sid:200003391; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.merux3.com",nocase; classtype:attempted-recon; sid:200003392; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercari.sfeqwx.com",nocase; classtype:attempted-recon; sid:200003393; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mercatorgloves.com",nocase; classtype:attempted-recon; sid:200003394; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meremanovegabana.website2.me",nocase; classtype:attempted-recon; sid:200003395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mericaproafterdu.byethost6.com",nocase; classtype:attempted-recon; sid:200003396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meriprocaseinbanfro.42web.io",nocase; classtype:attempted-recon; sid:200003397; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"merveyilmazericmimarlik.com",nocase; classtype:attempted-recon; sid:200003398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meschinowellness.com",nocase; classtype:attempted-recon; sid:200003399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mesquecamping.es",nocase; classtype:attempted-recon; sid:200003400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"messagerie-orange164.yolasite.com",nocase; classtype:attempted-recon; sid:200003401; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"messagerie.groupe-labanquepostale.ml",nocase; classtype:attempted-recon; sid:200003402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"messagerieseloger.unaux.com",nocase; classtype:attempted-recon; sid:200003403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"messagerievocale.ctcin.bio",nocase; classtype:attempted-recon; sid:200003404; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"messelive.tv",nocase; classtype:attempted-recon; sid:200003405; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mester.info.hu",nocase; classtype:attempted-recon; sid:200003406; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mestersuperwingskb1a.blogspot.com",nocase; classtype:attempted-recon; sid:200003407; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mestersuperwingskb3c.blogspot.com",nocase; classtype:attempted-recon; sid:200003408; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mestertignseekjet1.blogspot.com",nocase; classtype:attempted-recon; sid:200003409; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mestertignseekjet2.blogspot.com",nocase; classtype:attempted-recon; sid:200003410; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mestertignseekjet3.blogspot.com",nocase; classtype:attempted-recon; sid:200003411; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mestertignseekjet4.blogspot.com",nocase; classtype:attempted-recon; sid:200003412; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mestertignseekjet5.blogspot.com",nocase; classtype:attempted-recon; sid:200003413; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mestertignseekjet6.blogspot.com",nocase; classtype:attempted-recon; sid:200003414; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metallkom-spb.ru",nocase; classtype:attempted-recon; sid:200003415; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metaltubos.com.br",nocase; classtype:attempted-recon; sid:200003416; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metamask-extension.com.hsurge.com",nocase; classtype:attempted-recon; sid:200003417; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metamask-support.live",nocase; classtype:attempted-recon; sid:200003418; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metamask.cam",nocase; classtype:attempted-recon; sid:200003419; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metamask.coins-app.org",nocase; classtype:attempted-recon; sid:200003420; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metamask.gg",nocase; classtype:attempted-recon; sid:200003421; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metamask.secure-connection.org",nocase; classtype:attempted-recon; sid:200003422; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metamaska.pro",nocase; classtype:attempted-recon; sid:200003423; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metamaskservicesweb.com",nocase; classtype:attempted-recon; sid:200003424; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metavideos.com",nocase; classtype:attempted-recon; sid:200003425; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"metroluxflowers.com",nocase; classtype:attempted-recon; sid:200003426; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mets-applicat.top",nocase; classtype:attempted-recon; sid:200003427; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meuacessegurccxaaiixxaa.com",nocase; classtype:attempted-recon; sid:200003428; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meusabor.com.br",nocase; classtype:attempted-recon; sid:200003429; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meusacessocaixas.com",nocase; classtype:attempted-recon; sid:200003430; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meysamweb.ir",nocase; classtype:attempted-recon; sid:200003431; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mf.rks-gov.net",nocase; classtype:attempted-recon; sid:200003432; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mfacebook.blogspot.rs",nocase; classtype:attempted-recon; sid:200003433; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mfacebook.blogspot.ru",nocase; classtype:attempted-recon; sid:200003434; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mhacrix.freecluster.eu",nocase; classtype:attempted-recon; sid:200003435; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mhlvv.xyz",nocase; classtype:attempted-recon; sid:200003436; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"miangroupofcompanies.com",nocase; classtype:attempted-recon; sid:200003437; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mibancocrece.com.co",nocase; classtype:attempted-recon; sid:200003438; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"michel.hyperphp.com",nocase; classtype:attempted-recon; sid:200003439; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"micr0s0ftverify.nicepage.io",nocase; classtype:attempted-recon; sid:200003440; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"microcav.square.site",nocase; classtype:attempted-recon; sid:200003441; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"microsoft-excel.kr.jaleco.com",nocase; classtype:attempted-recon; sid:200003442; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"microsoft01829.odoo.com",nocase; classtype:attempted-recon; sid:200003443; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"microsoft0invoce.rf.gd",nocase; classtype:attempted-recon; sid:200003444; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"microsoftloginverification.questionpro.com",nocase; classtype:attempted-recon; sid:200003445; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"microsoftonedlrlve.typeform.com",nocase; classtype:attempted-recon; sid:200003446; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"microsoftsecure-docucenterfile.questionpro.com",nocase; classtype:attempted-recon; sid:200003447; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"microsoftwebserver.mfs.gg",nocase; classtype:attempted-recon; sid:200003448; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"microspromeri081.byethost22.com",nocase; classtype:attempted-recon; sid:200003449; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"microuuy.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200003450; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"microverifylink.github.io",nocase; classtype:attempted-recon; sid:200003451; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"micuenta01.github.io",nocase; classtype:attempted-recon; sid:200003452; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"middle.servehttp.com",nocase; classtype:attempted-recon; sid:200003453; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"midnightluna1.typeform.com",nocase; classtype:attempted-recon; sid:200003454; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mido-safe.com",nocase; classtype:attempted-recon; sid:200003455; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"midshopping.ro",nocase; classtype:attempted-recon; sid:200003456; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"miecompany.8b.io",nocase; classtype:attempted-recon; sid:200003457; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mijnbuitenhuis.nl",nocase; classtype:attempted-recon; sid:200003458; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mikakahla463.shoplineapp.com",nocase; classtype:attempted-recon; sid:200003459; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mikelantes.vzpla.net",nocase; classtype:attempted-recon; sid:200003460; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"milamansa.com",nocase; classtype:attempted-recon; sid:200003461; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"milanobet301.com",nocase; classtype:attempted-recon; sid:200003462; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"miljsnc.000webhostapp.com",nocase; classtype:attempted-recon; sid:200003463; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"millenniumstaffing.co.uk",nocase; classtype:attempted-recon; sid:200003464; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"miloserdie-rzn.ru",nocase; classtype:attempted-recon; sid:200003465; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mimecast.fmlms.com",nocase; classtype:attempted-recon; sid:200003466; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mimecast.swagonline.co.uk",nocase; classtype:attempted-recon; sid:200003467; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"minor-color.surge.sh",nocase; classtype:attempted-recon; sid:200003468; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"minuel.com",nocase; classtype:attempted-recon; sid:200003469; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"minute-too-late.my.id",nocase; classtype:attempted-recon; sid:200003470; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"miplab.net",nocase; classtype:attempted-recon; sid:200003471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mipymescolombiana.com",nocase; classtype:attempted-recon; sid:200003472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"miraclecraftshop.com",nocase; classtype:attempted-recon; sid:200003473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"misdatosviabcp.live",nocase; classtype:attempted-recon; sid:200003474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"missed-delivery-depot.com",nocase; classtype:attempted-recon; sid:200003475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"missedparcel-dpd.com",nocase; classtype:attempted-recon; sid:200003476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"missionshashank.org",nocase; classtype:attempted-recon; sid:200003477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mistimbas.com",nocase; classtype:attempted-recon; sid:200003478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mitrasinergisukses.com",nocase; classtype:attempted-recon; sid:200003479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mivtsystems.com",nocase; classtype:attempted-recon; sid:200003480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mixi.guru",nocase; classtype:attempted-recon; sid:200003481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mixmytea.at",nocase; classtype:attempted-recon; sid:200003482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjayme9jdg9izxixmjeydgg.filesusr.com",nocase; classtype:attempted-recon; sid:200003483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjayme9jdg9izxiymjnyza.filesusr.com",nocase; classtype:attempted-recon; sid:200003484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymu1heta1dgg.filesusr.com",nocase; classtype:attempted-recon; sid:200003485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymu1hetezmtj0aa.filesusr.com",nocase; classtype:attempted-recon; sid:200003486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymu1hetgym3jk.filesusr.com",nocase; classtype:attempted-recon; sid:200003487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymu1hetizmtl0aa.filesusr.com",nocase; classtype:attempted-recon; sid:200003488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymu1hetqymhro.filesusr.com",nocase; classtype:attempted-recon; sid:200003489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymu1hetu3dgg.filesusr.com",nocase; classtype:attempted-recon; sid:200003490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymu1hetuymhro.filesusr.com",nocase; classtype:attempted-recon; sid:200003491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymuf1z3vzdde4mtf0aa.filesusr.com",nocase; classtype:attempted-recon; sid:200003492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymufwcmlsmde5dgg.filesusr.com",nocase; classtype:attempted-recon; sid:200003493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymup1bhk0mtf0aa.filesusr.com",nocase; classtype:attempted-recon; sid:200003494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymup1bhk1mtr0aa.filesusr.com",nocase; classtype:attempted-recon; sid:200003495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymup1bhkzmtn0aa.filesusr.com",nocase; classtype:attempted-recon; sid:200003496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymup1bmu0mtf0aa.filesusr.com",nocase; classtype:attempted-recon; sid:200003497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymup1bmuymzfzda.filesusr.com",nocase; classtype:attempted-recon; sid:200003498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymuphbnvhcnkxmzv0aa.filesusr.com",nocase; classtype:attempted-recon; sid:200003499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mjaymvnlchrlbwjlcjizmxn0.filesusr.com",nocase; classtype:attempted-recon; sid:200003500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mkengineering.com.my",nocase; classtype:attempted-recon; sid:200003501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mkiuyhakauywa.blogspot.com",nocase; classtype:attempted-recon; sid:200003502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mky.com",nocase; classtype:attempted-recon; sid:200003503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mlbb-giveawayskin.ddkx.tk",nocase; classtype:attempted-recon; sid:200003504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mlcexpresstransportes.com.br",nocase; classtype:attempted-recon; sid:200003505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mlcoarb.com",nocase; classtype:attempted-recon; sid:200003506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mmprsatx.com",nocase; classtype:attempted-recon; sid:200003507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mms.tucsonhispanicchamber.net",nocase; classtype:attempted-recon; sid:200003508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mmsportable.kissr.com",nocase; classtype:attempted-recon; sid:200003509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mnp-postscriptum.com",nocase; classtype:attempted-recon; sid:200003510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"moaracubucate.ro",nocase; classtype:attempted-recon; sid:200003511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mobile-alerts-o2.com",nocase; classtype:attempted-recon; sid:200003512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mobile-facebook-com.netlify.app",nocase; classtype:attempted-recon; sid:200003513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mobile-portail.live",nocase; classtype:attempted-recon; sid:200003514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mobile-srftoken-benutzername.de",nocase; classtype:attempted-recon; sid:200003515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mobile.retrocafe.net.au",nocase; classtype:attempted-recon; sid:200003516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mobiledesbloqueio.com",nocase; classtype:attempted-recon; sid:200003517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mobsuemil.com",nocase; classtype:attempted-recon; sid:200003518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mockup.metradigitalmedia.com",nocase; classtype:attempted-recon; sid:200003519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"modabotas.com",nocase; classtype:attempted-recon; sid:200003520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"modasbrilhodosol.com",nocase; classtype:attempted-recon; sid:200003521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"moderka-sklep.pl",nocase; classtype:attempted-recon; sid:200003522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"modest-kapitsa.23-94-190-112.plesk.page",nocase; classtype:attempted-recon; sid:200003523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"moira.cl",nocase; classtype:attempted-recon; sid:200003524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"moj.aktiv.rs",nocase; classtype:attempted-recon; sid:200003525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mokusew.cf",nocase; classtype:attempted-recon; sid:200003526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mollybabes.com",nocase; classtype:attempted-recon; sid:200003527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"momentoslemadrid.com",nocase; classtype:attempted-recon; sid:200003528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mon-service-admin.mikecole-tennis.de",nocase; classtype:attempted-recon; sid:200003529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monexde.com",nocase; classtype:attempted-recon; sid:200003530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"moneyclaims-legal.aat.platform.hmcts.net",nocase; classtype:attempted-recon; sid:200003531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"moneyviewfinance.in",nocase; classtype:attempted-recon; sid:200003532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"moni.bg",nocase; classtype:attempted-recon; sid:200003533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monirshouvo.github.io",nocase; classtype:attempted-recon; sid:200003534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monomobileservice.yolasite.com",nocase; classtype:attempted-recon; sid:200003535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monooh.com",nocase; classtype:attempted-recon; sid:200003536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monstercarp.rn86.ru",nocase; classtype:attempted-recon; sid:200003537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"montessoricali.edu.co",nocase; classtype:attempted-recon; sid:200003538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monthly-o2-paymentsupport.com",nocase; classtype:attempted-recon; sid:200003539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"montmabesa1888.blogspot.com",nocase; classtype:attempted-recon; sid:200003540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monyeward.com",nocase; classtype:attempted-recon; sid:200003541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"moodle.lms-su.com",nocase; classtype:attempted-recon; sid:200003542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mopxopeps.vn",nocase; classtype:attempted-recon; sid:200003543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mor-globa.cf",nocase; classtype:attempted-recon; sid:200003544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mor-globa.ga",nocase; classtype:attempted-recon; sid:200003545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"moraesegiocondo.adv.br",nocase; classtype:attempted-recon; sid:200003546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mordovia-darts.ru",nocase; classtype:attempted-recon; sid:200003547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"morning-cloud-9b80.loginupdatemail.workers.dev",nocase; classtype:attempted-recon; sid:200003548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mosvisa24.ru",nocase; classtype:attempted-recon; sid:200003549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"motormoskito.cl",nocase; classtype:attempted-recon; sid:200003550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"motorsparkle.top",nocase; classtype:attempted-recon; sid:200003551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"movingsquadsc-com.ga",nocase; classtype:attempted-recon; sid:200003552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mpsgraphicssecure.com",nocase; classtype:attempted-recon; sid:200003553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mq.gl",nocase; classtype:attempted-recon; sid:200003554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"msc-doelsach.at",nocase; classtype:attempted-recon; sid:200003555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"msftoutlook.site",nocase; classtype:attempted-recon; sid:200003556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"msnserviceverifivation.wordpress.com",nocase; classtype:attempted-recon; sid:200003557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"msofficemessagescenter-1.mfs.gg",nocase; classtype:attempted-recon; sid:200003558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"msofficesystems.mfs.gg",nocase; classtype:attempted-recon; sid:200003559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mtbankservar.dynamic-dns.net",nocase; classtype:attempted-recon; sid:200003560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mtbb3authprotect.duckdns.org",nocase; classtype:attempted-recon; sid:200003561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mtngifts2021.blogspot.com",nocase; classtype:attempted-recon; sid:200003562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mtpo.pages.dev",nocase; classtype:attempted-recon; sid:200003563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mudraloans.biz",nocase; classtype:attempted-recon; sid:200003564; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"muhasebex.com",nocase; classtype:attempted-recon; sid:200003565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"muleshoe-eng.com",nocase; classtype:attempted-recon; sid:200003566; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"multiplushk.com",nocase; classtype:attempted-recon; sid:200003567; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"multirbnacion.com",nocase; classtype:attempted-recon; sid:200003568; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"multiredvirtualbn.live",nocase; classtype:attempted-recon; sid:200003569; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"multiserviciosfibnc.com",nocase; classtype:attempted-recon; sid:200003570; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"musclespro.com",nocase; classtype:attempted-recon; sid:200003571; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"music3.wymomg.com",nocase; classtype:attempted-recon; sid:200003572; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"musicgiftsgalore.com",nocase; classtype:attempted-recon; sid:200003573; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"musicisit.de",nocase; classtype:attempted-recon; sid:200003574; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mutrom.vn",nocase; classtype:attempted-recon; sid:200003575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mw2hbg7ev0a.typeform.com",nocase; classtype:attempted-recon; sid:200003576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mxrr.com",nocase; classtype:attempted-recon; sid:200003577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my-bithumb.web.app",nocase; classtype:attempted-recon; sid:200003578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my-da4a.ru",nocase; classtype:attempted-recon; sid:200003579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my-devices-halifax.com",nocase; classtype:attempted-recon; sid:200003580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my-site219.yolasite.com",nocase; classtype:attempted-recon; sid:200003581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my-site228.yolasite.com",nocase; classtype:attempted-recon; sid:200003582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my-sofftbank.icu",nocase; classtype:attempted-recon; sid:200003583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my-sotfbend.info",nocase; classtype:attempted-recon; sid:200003584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.nativeforms.com",nocase; classtype:attempted-recon; sid:200003585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.texter.pk",nocase; classtype:attempted-recon; sid:200003586; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my02billing.dev",nocase; classtype:attempted-recon; sid:200003587; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my2ktop.company.site",nocase; classtype:attempted-recon; sid:200003588; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my2ktop.ecwid.com",nocase; classtype:attempted-recon; sid:200003589; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myaccount-settings-accesss-plus.ml",nocase; classtype:attempted-recon; sid:200003590; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myaccounts-settings-inc-fix.ml",nocase; classtype:attempted-recon; sid:200003591; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myaccountscitizen.webhop.me",nocase; classtype:attempted-recon; sid:200003592; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myaethers.com",nocase; classtype:attempted-recon; sid:200003593; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myauthorz.com",nocase; classtype:attempted-recon; sid:200003594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mybank.toc.com.ec",nocase; classtype:attempted-recon; sid:200003595; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mybilling-paymybill.com",nocase; classtype:attempted-recon; sid:200003596; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mybpos.net",nocase; classtype:attempted-recon; sid:200003597; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mybt-onlinebill.com",nocase; classtype:attempted-recon; sid:200003598; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mycoerver.es",nocase; classtype:attempted-recon; sid:200003599; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mydoc-pasadenaisd.org",nocase; classtype:attempted-recon; sid:200003600; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myedd-profile.verifyidentity.workers.dev",nocase; classtype:attempted-recon; sid:200003601; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myee-billing-info.com",nocase; classtype:attempted-recon; sid:200003602; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myeedirect.co.uk",nocase; classtype:attempted-recon; sid:200003603; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myeeyouree.com",nocase; classtype:attempted-recon; sid:200003604; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myentnherballet.com",nocase; classtype:attempted-recon; sid:200003605; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myetherwollot.com",nocase; classtype:attempted-recon; sid:200003606; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myhealthinsquotes.com",nocase; classtype:attempted-recon; sid:200003607; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myhermes-redeliveryhelp.com",nocase; classtype:attempted-recon; sid:200003608; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myjcb-89oski.gwcqd.com",nocase; classtype:attempted-recon; sid:200003609; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myjobassists.com",nocase; classtype:attempted-recon; sid:200003610; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mykonos.cl",nocase; classtype:attempted-recon; sid:200003611; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mylovejar.com",nocase; classtype:attempted-recon; sid:200003612; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mymentalhealthday.org",nocase; classtype:attempted-recon; sid:200003613; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mymonero.to",nocase; classtype:attempted-recon; sid:200003614; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mymweb-owner.at.ua",nocase; classtype:attempted-recon; sid:200003615; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myo2-billing-error28.com",nocase; classtype:attempted-recon; sid:200003616; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myo2-billing-error83.com",nocase; classtype:attempted-recon; sid:200003617; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mypixie.net",nocase; classtype:attempted-recon; sid:200003618; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myqatar.com",nocase; classtype:attempted-recon; sid:200003619; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myqli.com",nocase; classtype:attempted-recon; sid:200003620; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myshedbuilder.com",nocase; classtype:attempted-recon; sid:200003621; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mysites.infinityfreeapp.com",nocase; classtype:attempted-recon; sid:200003622; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mysmartconveyance.app",nocase; classtype:attempted-recon; sid:200003623; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mysoulaura.com",nocase; classtype:attempted-recon; sid:200003624; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myswisscomonline.net",nocase; classtype:attempted-recon; sid:200003625; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myupdates-mynetflix.com",nocase; classtype:attempted-recon; sid:200003626; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mzwy2.csb.app",nocase; classtype:attempted-recon; sid:200003627; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"n-naoko-0319.github.io",nocase; classtype:attempted-recon; sid:200003628; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"n26-particuluar-n26-personal-own.boxofbusinessblogs.com",nocase; classtype:attempted-recon; sid:200003629; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"n4r7u.app.link",nocase; classtype:attempted-recon; sid:200003630; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"n6623a052sk.typeform.com",nocase; classtype:attempted-recon; sid:200003631; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"n66744rp5er.typeform.com",nocase; classtype:attempted-recon; sid:200003632; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"n7orton.com",nocase; classtype:attempted-recon; sid:200003633; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"n9qyb.csb.app",nocase; classtype:attempted-recon; sid:200003634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"na-amazon-creturns.com",nocase; classtype:attempted-recon; sid:200003635; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nabagejec1893.blogspot.com",nocase; classtype:attempted-recon; sid:200003636; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nabagejec1893.blogspot.sg",nocase; classtype:attempted-recon; sid:200003637; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nabtolonu1913.blogspot.com",nocase; classtype:attempted-recon; sid:200003638; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nabtolonu1913.blogspot.kr",nocase; classtype:attempted-recon; sid:200003639; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nacionalbank.webcindario.com",nocase; classtype:attempted-recon; sid:200003640; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"najboljeuslugezavas.betterservicesforyou.com",nocase; classtype:attempted-recon; sid:200003641; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nakamistrad.com",nocase; classtype:attempted-recon; sid:200003642; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"namasteflavoursannarbor.com",nocase; classtype:attempted-recon; sid:200003643; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"namehoyms.000webhostapp.com",nocase; classtype:attempted-recon; sid:200003644; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nanairan.com",nocase; classtype:attempted-recon; sid:200003645; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"naranja-users.auth0.com",nocase; classtype:attempted-recon; sid:200003646; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"narnozom.co.jp.hjmqbza.cn",nocase; classtype:attempted-recon; sid:200003647; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"narrativesummit.org",nocase; classtype:attempted-recon; sid:200003648; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"natwest.nwolb-device-login.com",nocase; classtype:attempted-recon; sid:200003649; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"natwest.nwolb-login-auth.com",nocase; classtype:attempted-recon; sid:200003650; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"natwest.secure-auth-personal-device.com",nocase; classtype:attempted-recon; sid:200003651; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"natwest.secured-online-verify.com",nocase; classtype:attempted-recon; sid:200003652; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"natwest.secured-personal-verify.com",nocase; classtype:attempted-recon; sid:200003653; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nav.vn",nocase; classtype:attempted-recon; sid:200003654; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"navigatorthailand.com",nocase; classtype:attempted-recon; sid:200003655; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nbdtrade.com",nocase; classtype:attempted-recon; sid:200003656; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ncaweagricol.byethost33.com",nocase; classtype:attempted-recon; sid:200003657; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ncservices.co.in",nocase; classtype:attempted-recon; sid:200003658; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ne1flix.com",nocase; classtype:attempted-recon; sid:200003659; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ne7vwmh61fk.typeform.com",nocase; classtype:attempted-recon; sid:200003660; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nebojsega.com",nocase; classtype:attempted-recon; sid:200003661; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"necessitymag.com",nocase; classtype:attempted-recon; sid:200003662; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"neckelmanns.com",nocase; classtype:attempted-recon; sid:200003663; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nedbank.demdex.net",nocase; classtype:attempted-recon; sid:200003664; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nedbankqa.flowblocks.com",nocase; classtype:attempted-recon; sid:200003665; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nedirien.online",nocase; classtype:attempted-recon; sid:200003666; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"need.serveftp.com",nocase; classtype:attempted-recon; sid:200003667; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nelsonjustus.com.br",nocase; classtype:attempted-recon; sid:200003668; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"neltfxix.blogspot.com",nocase; classtype:attempted-recon; sid:200003669; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nerefors.fun",nocase; classtype:attempted-recon; sid:200003670; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nero.egybest.site",nocase; classtype:attempted-recon; sid:200003671; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netart-design.com",nocase; classtype:attempted-recon; sid:200003672; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netbkq.net",nocase; classtype:attempted-recon; sid:200003673; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netciti.id",nocase; classtype:attempted-recon; sid:200003674; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netfilx.com.zonefivestudio.com",nocase; classtype:attempted-recon; sid:200003675; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netflix-com.com",nocase; classtype:attempted-recon; sid:200003676; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netflix-fr-fr-navlink-connexion.trans-mea.com",nocase; classtype:attempted-recon; sid:200003677; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netflix.sourceaudio.com",nocase; classtype:attempted-recon; sid:200003678; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netflixloginhelp.com",nocase; classtype:attempted-recon; sid:200003679; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netlana.com",nocase; classtype:attempted-recon; sid:200003680; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netlnterseguros.com",nocase; classtype:attempted-recon; sid:200003681; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netmas.com.mx",nocase; classtype:attempted-recon; sid:200003682; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netprogress.net",nocase; classtype:attempted-recon; sid:200003683; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netsantanderuru0.byethost31.com",nocase; classtype:attempted-recon; sid:200003684; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netservice-upd.tumblr.com",nocase; classtype:attempted-recon; sid:200003685; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netttxnet.byethost3.com",nocase; classtype:attempted-recon; sid:200003686; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"network.innovatedm.com",nocase; classtype:attempted-recon; sid:200003687; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"new-control-pamis.com",nocase; classtype:attempted-recon; sid:200003688; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"new-devicehelp.com",nocase; classtype:attempted-recon; sid:200003689; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"new-payee-lloyds.com",nocase; classtype:attempted-recon; sid:200003690; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"new.29studios.com",nocase; classtype:attempted-recon; sid:200003691; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newboi365onlineupdate.com",nocase; classtype:attempted-recon; sid:200003692; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newcapital-compounds.com",nocase; classtype:attempted-recon; sid:200003693; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newel.uno",nocase; classtype:attempted-recon; sid:200003694; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newlien.site44.com",nocase; classtype:attempted-recon; sid:200003695; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newnanplazapawnshop.com",nocase; classtype:attempted-recon; sid:200003696; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newonline-payee-restricted.com",nocase; classtype:attempted-recon; sid:200003697; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newonline-restrict-payee.com",nocase; classtype:attempted-recon; sid:200003698; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newrydramafestival.co.uk",nocase; classtype:attempted-recon; sid:200003699; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"news.forteens.online",nocase; classtype:attempted-recon; sid:200003700; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newsbrigade.com",nocase; classtype:attempted-recon; sid:200003701; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newsfortrading.com",nocase; classtype:attempted-recon; sid:200003702; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newsimdigital.com",nocase; classtype:attempted-recon; sid:200003703; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newsonghannover.org",nocase; classtype:attempted-recon; sid:200003704; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newupdateppl.blogspot.com",nocase; classtype:attempted-recon; sid:200003705; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newworldcaseblog.com",nocase; classtype:attempted-recon; sid:200003706; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ngx273.inmotionhosting.com",nocase; classtype:attempted-recon; sid:200003707; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nhacaiuytin888.com",nocase; classtype:attempted-recon; sid:200003708; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ni212065-1.web02.nitrado.hosting",nocase; classtype:attempted-recon; sid:200003709; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"niadabuyherepayhere.com",nocase; classtype:attempted-recon; sid:200003710; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nice-torvalds.104-168-102-175.plesk.page",nocase; classtype:attempted-recon; sid:200003711; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nicenice.manchesteruniting.space",nocase; classtype:attempted-recon; sid:200003712; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nicoleturneractor.com",nocase; classtype:attempted-recon; sid:200003713; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nightvision.tech",nocase; classtype:attempted-recon; sid:200003714; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nihongospeechtrainer.com",nocase; classtype:attempted-recon; sid:200003715; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nikomac.main.jp",nocase; classtype:attempted-recon; sid:200003716; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nineled.com",nocase; classtype:attempted-recon; sid:200003717; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"niversity.serveftp.com",nocase; classtype:attempted-recon; sid:200003718; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nizotchauffage.bilty.be",nocase; classtype:attempted-recon; sid:200003719; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"njolfs.hyperphp.com",nocase; classtype:attempted-recon; sid:200003720; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"njxzhf.ml",nocase; classtype:attempted-recon; sid:200003721; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nojima-co-jp.merceair.com",nocase; classtype:attempted-recon; sid:200003722; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nomehold-gricco3.byethost7.com",nocase; classtype:attempted-recon; sid:200003723; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nonstop-ks.com",nocase; classtype:attempted-recon; sid:200003724; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"noor-alfajr.com",nocase; classtype:attempted-recon; sid:200003725; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nordichairistanbul.com",nocase; classtype:attempted-recon; sid:200003726; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"noreply-netelle.blogspot.com",nocase; classtype:attempted-recon; sid:200003727; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"normativa-sicurezza-verifica.app.sicurty-login.com",nocase; classtype:attempted-recon; sid:200003728; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"northernswine.com",nocase; classtype:attempted-recon; sid:200003729; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"norton-ultra.com",nocase; classtype:attempted-recon; sid:200003730; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notariagalvez.com",nocase; classtype:attempted-recon; sid:200003731; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notendur.hi.is",nocase; classtype:attempted-recon; sid:200003732; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"noticia.link",nocase; classtype:attempted-recon; sid:200003733; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notificacioneslv.hostfree.pw",nocase; classtype:attempted-recon; sid:200003734; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notificacionesv.hostfree.pw",nocase; classtype:attempted-recon; sid:200003735; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notificacionesv3.hostfree.pw",nocase; classtype:attempted-recon; sid:200003736; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notificacionesv8.hostfree.pw",nocase; classtype:attempted-recon; sid:200003737; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notification-orange6.yolasite.com",nocase; classtype:attempted-recon; sid:200003738; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notification-vocale-ecoute.freeweb.pk",nocase; classtype:attempted-recon; sid:200003739; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notifyfb-2am3335o6s.tv1space.az",nocase; classtype:attempted-recon; sid:200003740; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notifyfb-9h4s5ryhgh.tv1space.az",nocase; classtype:attempted-recon; sid:200003741; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notifyfb-i0mfyejbpj.tv1space.az",nocase; classtype:attempted-recon; sid:200003742; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notifyfb-j8tjsdr70v.tv1space.az",nocase; classtype:attempted-recon; sid:200003743; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notifyfb-kryox10249.tv1space.az",nocase; classtype:attempted-recon; sid:200003744; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nour-ala-nour.com",nocase; classtype:attempted-recon; sid:200003745; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nozed-uname.firebaseapp.com",nocase; classtype:attempted-recon; sid:200003746; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nrk.one",nocase; classtype:attempted-recon; sid:200003747; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ns3pssionntngoal.app.link",nocase; classtype:attempted-recon; sid:200003748; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nsdbds.tk",nocase; classtype:attempted-recon; sid:200003749; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nueva-acropolis.cl",nocase; classtype:attempted-recon; sid:200003750; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nuewa-hwa.oracleindustry.com",nocase; classtype:attempted-recon; sid:200003751; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nuezlincalp.hostkda.com",nocase; classtype:attempted-recon; sid:200003752; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nullresimler.com",nocase; classtype:attempted-recon; sid:200003753; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"num63rsgroup.com",nocase; classtype:attempted-recon; sid:200003754; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nuovesicurezzeonline.com",nocase; classtype:attempted-recon; sid:200003755; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nuu1.com",nocase; classtype:attempted-recon; sid:200003756; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nuvuneu.com",nocase; classtype:attempted-recon; sid:200003757; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nv.snprobbx.pbz.r.de.a2ip.ru",nocase; classtype:attempted-recon; sid:200003758; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nw-securedfailure.com",nocase; classtype:attempted-recon; sid:200003759; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nwolb.default.aspx.cookiecheck.refferiddent.aspx.online.cross-press.net",nocase; classtype:attempted-recon; sid:200003760; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nwolbderegisterdevice-access.com",nocase; classtype:attempted-recon; sid:200003761; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nwsecure-iproceed-icancel.com",nocase; classtype:attempted-recon; sid:200003762; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nwsecure-newdevice-iproceed.com",nocase; classtype:attempted-recon; sid:200003763; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nwsecurity-setdevice-icancel.com",nocase; classtype:attempted-recon; sid:200003764; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nxmbfhj.tk",nocase; classtype:attempted-recon; sid:200003765; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nyeline.com",nocase; classtype:attempted-recon; sid:200003766; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nyhet.cc",nocase; classtype:attempted-recon; sid:200003767; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o2-authbill-secure.com",nocase; classtype:attempted-recon; sid:200003768; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o2-failure-billing-update.com",nocase; classtype:attempted-recon; sid:200003769; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o2-processbilling-update.com",nocase; classtype:attempted-recon; sid:200003770; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o2-securebilling-update.com",nocase; classtype:attempted-recon; sid:200003771; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o2-service-account.com",nocase; classtype:attempted-recon; sid:200003772; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o2-updatebillingvia.com",nocase; classtype:attempted-recon; sid:200003773; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o2billingauth-update.com",nocase; classtype:attempted-recon; sid:200003774; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o365.yourcbsm.work",nocase; classtype:attempted-recon; sid:200003775; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o365microsoftonline.com",nocase; classtype:attempted-recon; sid:200003776; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"o5cpm.skipdns.link",nocase; classtype:attempted-recon; sid:200003777; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oa5.a0001.net",nocase; classtype:attempted-recon; sid:200003778; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oah-nc-secure.ga",nocase; classtype:attempted-recon; sid:200003779; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oakhamstreeservices.com",nocase; classtype:attempted-recon; sid:200003780; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"obdvczu.cluster030.hosting.ovh.net",nocase; classtype:attempted-recon; sid:200003781; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oberpiskoihof.it",nocase; classtype:attempted-recon; sid:200003782; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"obgyn.kku.ac.th",nocase; classtype:attempted-recon; sid:200003783; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"observatoriodeourofino.com.br",nocase; classtype:attempted-recon; sid:200003784; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"observesuppoqased.com",nocase; classtype:attempted-recon; sid:200003785; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ocaque-domen.firebaseapp.com",nocase; classtype:attempted-recon; sid:200003786; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oceantires.com",nocase; classtype:attempted-recon; sid:200003787; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"of7dh0jxy4s.typeform.com",nocase; classtype:attempted-recon; sid:200003788; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ofertasonlinebiggs.com",nocase; classtype:attempted-recon; sid:200003789; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"offic3887688.sitebuilder.name.tools",nocase; classtype:attempted-recon; sid:200003790; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"office-updateinfo.net",nocase; classtype:attempted-recon; sid:200003791; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"office365.apps.maxsolutions.com.au",nocase; classtype:attempted-recon; sid:200003792; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"officeee.bubbleapps.io",nocase; classtype:attempted-recon; sid:200003793; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"officialevent.way.live",nocase; classtype:attempted-recon; sid:200003794; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"officialgameworld.com",nocase; classtype:attempted-recon; sid:200003795; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"officialliker.co",nocase; classtype:attempted-recon; sid:200003796; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"officialmabar.duckdns.org",nocase; classtype:attempted-recon; sid:200003797; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ogz6d.codesandbox.io",nocase; classtype:attempted-recon; sid:200003798; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oh-unemployment-ohio-gov.com",nocase; classtype:attempted-recon; sid:200003799; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oi58904x.yolasite.com",nocase; classtype:attempted-recon; sid:200003800; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oillamp.zikiso.jp",nocase; classtype:attempted-recon; sid:200003801; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ojnw.app.link",nocase; classtype:attempted-recon; sid:200003802; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ojs.budimulia.ac.id",nocase; classtype:attempted-recon; sid:200003803; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"okankaracan.com",nocase; classtype:attempted-recon; sid:200003804; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"okwok.co.kr",nocase; classtype:attempted-recon; sid:200003805; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"old.prunescape.com.au",nocase; classtype:attempted-recon; sid:200003806; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oldps1.com",nocase; classtype:attempted-recon; sid:200003807; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oldschool-runescape-bondrewards.com",nocase; classtype:attempted-recon; sid:200003808; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olidooo.waca.tw",nocase; classtype:attempted-recon; sid:200003809; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olittbakeryv2-71.olitt.net",nocase; classtype:attempted-recon; sid:200003810; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olivergency-ukk.ga",nocase; classtype:attempted-recon; sid:200003811; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx-casa.com",nocase; classtype:attempted-recon; sid:200003812; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx-group.com",nocase; classtype:attempted-recon; sid:200003813; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx-order.pl-id50073848.xyz",nocase; classtype:attempted-recon; sid:200003814; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx-order.pl-id53061369.xyz",nocase; classtype:attempted-recon; sid:200003815; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx-order.pl-id67928021.xyz",nocase; classtype:attempted-recon; sid:200003816; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx-order.pl-id76985466.xyz",nocase; classtype:attempted-recon; sid:200003817; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx-order.pl-id98526677.xyz",nocase; classtype:attempted-recon; sid:200003818; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx-pl-konto-ref.com",nocase; classtype:attempted-recon; sid:200003819; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx-pl.fes-pay.info",nocase; classtype:attempted-recon; sid:200003820; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx-pl.id-485854.pw",nocase; classtype:attempted-recon; sid:200003821; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx-pl.id-i98332.pw",nocase; classtype:attempted-recon; sid:200003822; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx.pl-id423678123.net",nocase; classtype:attempted-recon; sid:200003823; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx.pl-paymentsget.xyz",nocase; classtype:attempted-recon; sid:200003824; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx.pl.express-shop.org",nocase; classtype:attempted-recon; sid:200003825; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx.pl.getmoney.xyz",nocase; classtype:attempted-recon; sid:200003826; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx.pl.safedeal-click.info",nocase; classtype:attempted-recon; sid:200003827; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"olx.rwpay.ru",nocase; classtype:attempted-recon; sid:200003828; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"omesqiwines.de",nocase; classtype:attempted-recon; sid:200003829; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"omshad-links.com",nocase; classtype:attempted-recon; sid:200003830; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"omzonno.monster",nocase; classtype:attempted-recon; sid:200003831; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"on-linecaso326.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200003832; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"on-linecaso3298.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200003833; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"on-me-ro.firebaseapp.com",nocase; classtype:attempted-recon; sid:200003834; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"on00000221.temp.swtest.ru",nocase; classtype:attempted-recon; sid:200003835; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oncopharma-ae.com",nocase; classtype:attempted-recon; sid:200003836; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"one.app-aktualisieren.com",nocase; classtype:attempted-recon; sid:200003837; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oneaim.lu",nocase; classtype:attempted-recon; sid:200003838; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onecreator.info",nocase; classtype:attempted-recon; sid:200003839; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onee-a0488.web.app",nocase; classtype:attempted-recon; sid:200003840; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onemedic.com.mx",nocase; classtype:attempted-recon; sid:200003841; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oneone-19cd8.web.app",nocase; classtype:attempted-recon; sid:200003842; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oneone-a38ef.web.app",nocase; classtype:attempted-recon; sid:200003843; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onet-swietokrzyskie.xyz",nocase; classtype:attempted-recon; sid:200003844; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online-auth-doc-trippumbach.cf",nocase; classtype:attempted-recon; sid:200003845; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online-doc-madisonpointecc.cf",nocase; classtype:attempted-recon; sid:200003846; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online.firstfinan.com",nocase; classtype:attempted-recon; sid:200003847; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online.natwest-personal.com",nocase; classtype:attempted-recon; sid:200003848; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online.natwest-supportcentre.com",nocase; classtype:attempted-recon; sid:200003849; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online.natwest-welfare.com",nocase; classtype:attempted-recon; sid:200003850; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online2banking.byethost6.com",nocase; classtype:attempted-recon; sid:200003851; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlinebneutuedwybjrgwrezyqqvhatcvbuubebnonline.66ghz.com",nocase; classtype:attempted-recon; sid:200003852; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlinepayee-restricted-service.com",nocase; classtype:attempted-recon; sid:200003853; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlineprint.cufapparel.cf",nocase; classtype:attempted-recon; sid:200003854; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlinepromerica.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200003855; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlinepromerica5.byethost8.com",nocase; classtype:attempted-recon; sid:200003856; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlinepromericac.byethost3.com",nocase; classtype:attempted-recon; sid:200003857; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlinepromericas.byethost7.com",nocase; classtype:attempted-recon; sid:200003858; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlineremanager.com",nocase; classtype:attempted-recon; sid:200003859; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlineroisupportupdate.com",nocase; classtype:attempted-recon; sid:200003860; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlinesbi.online",nocase; classtype:attempted-recon; sid:200003861; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlineserveroffice365.mfs.gg",nocase; classtype:attempted-recon; sid:200003862; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlineservicefree.club",nocase; classtype:attempted-recon; sid:200003863; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlineservicefree.website",nocase; classtype:attempted-recon; sid:200003864; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlineservicetec.com",nocase; classtype:attempted-recon; sid:200003865; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlineservicetech.website",nocase; classtype:attempted-recon; sid:200003866; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlinpromerica2.byethost11.com",nocase; classtype:attempted-recon; sid:200003867; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onsparks-dab.blogspot.com",nocase; classtype:attempted-recon; sid:200003868; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ooxvocalor.yolasite.com",nocase; classtype:attempted-recon; sid:200003869; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"opallds.com",nocase; classtype:attempted-recon; sid:200003870; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"opened.bosshomestead.work",nocase; classtype:attempted-recon; sid:200003871; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"openmessageriespacemms.ukit.me",nocase; classtype:attempted-recon; sid:200003872; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"opensea.bio",nocase; classtype:attempted-recon; sid:200003873; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"opentorue.byethost7.com",nocase; classtype:attempted-recon; sid:200003874; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"operacionmultired1bn-web.com",nocase; classtype:attempted-recon; sid:200003875; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"opfgmdm.creatorlink.net",nocase; classtype:attempted-recon; sid:200003876; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"opjkk.creatorlink.net",nocase; classtype:attempted-recon; sid:200003877; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"opretretopoptk.000webhostapp.com",nocase; classtype:attempted-recon; sid:200003878; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"opsidposqidpoqsidpoiqspodiqsopdipqsd.blogspot.com",nocase; classtype:attempted-recon; sid:200003879; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"optika-anda.hr",nocase; classtype:attempted-recon; sid:200003880; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"optus-au.blogspot.com",nocase; classtype:attempted-recon; sid:200003881; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"optus-com-au.blogspot.com",nocase; classtype:attempted-recon; sid:200003882; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"optusnet-com.blogspot.com",nocase; classtype:attempted-recon; sid:200003883; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ora-n.yolasite.com",nocase; classtype:attempted-recon; sid:200003884; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orabu.it",nocase; classtype:attempted-recon; sid:200003885; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oralcamp.com.br",nocase; classtype:attempted-recon; sid:200003886; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orange-covid20.yolasite.com",nocase; classtype:attempted-recon; sid:200003887; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orange-dcr.fr",nocase; classtype:attempted-recon; sid:200003888; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orange-messagepro546.moonfruit.com",nocase; classtype:attempted-recon; sid:200003889; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orange-mobile16.wixsite.com",nocase; classtype:attempted-recon; sid:200003890; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orange-offre.mobile-forfait.client.travelforever.co.uk",nocase; classtype:attempted-recon; sid:200003891; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orange-rdv-mvp.ayaline.com",nocase; classtype:attempted-recon; sid:200003892; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orange-rdv.ayaline.com",nocase; classtype:attempted-recon; sid:200003893; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orange-security.cloud.coreoz.com",nocase; classtype:attempted-recon; sid:200003894; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orange.iobeya.com",nocase; classtype:attempted-recon; sid:200003895; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orange624.yolasite.com",nocase; classtype:attempted-recon; sid:200003896; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orangeconnectweb.contactin.bio",nocase; classtype:attempted-recon; sid:200003897; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orangemessagerie.icon.io",nocase; classtype:attempted-recon; sid:200003898; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orangemiseajour.hostfree.pw",nocase; classtype:attempted-recon; sid:200003899; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orangevalechamber.com",nocase; classtype:attempted-recon; sid:200003900; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oranj.moonfruit.com",nocase; classtype:attempted-recon; sid:200003901; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orbitcluster.com",nocase; classtype:attempted-recon; sid:200003902; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orcapm.com",nocase; classtype:attempted-recon; sid:200003903; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ordenesticccc.com",nocase; classtype:attempted-recon; sid:200003904; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"org-nr.yolasite.com",nocase; classtype:attempted-recon; sid:200003905; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"organicreviews.net",nocase; classtype:attempted-recon; sid:200003906; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"originalcomics.fr",nocase; classtype:attempted-recon; sid:200003907; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"originalfilm.se",nocase; classtype:attempted-recon; sid:200003908; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orjziutttbosibcbqoywzjfhnt-dot-gowa11111111.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200003909; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orlandoareavacations.orlandoareavacation.com",nocase; classtype:attempted-recon; sid:200003910; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orlen.hotchili.pl",nocase; classtype:attempted-recon; sid:200003911; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orlenn.libracoinofficial-company.xyz",nocase; classtype:attempted-recon; sid:200003912; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orlenoil-la.com",nocase; classtype:attempted-recon; sid:200003913; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orlensbkpl.com",nocase; classtype:attempted-recon; sid:200003914; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orninfomail2903.moonfruit.com",nocase; classtype:attempted-recon; sid:200003915; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ornozam.co.jp.s4jrl6.cn",nocase; classtype:attempted-recon; sid:200003916; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orquestaloshispanos.com",nocase; classtype:attempted-recon; sid:200003917; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ortonder.freecluster.eu",nocase; classtype:attempted-recon; sid:200003918; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"osmaslo.ru",nocase; classtype:attempted-recon; sid:200003919; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ostrichmemory.top",nocase; classtype:attempted-recon; sid:200003920; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"osun.cz",nocase; classtype:attempted-recon; sid:200003921; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ot-directory.com",nocase; classtype:attempted-recon; sid:200003922; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"otherfinal.top",nocase; classtype:attempted-recon; sid:200003923; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"otomoto-h229.net",nocase; classtype:attempted-recon; sid:200003924; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"otomoto-konto54875424.eu",nocase; classtype:attempted-recon; sid:200003925; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"otomoto3452.com",nocase; classtype:attempted-recon; sid:200003926; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ouniswap.com",nocase; classtype:attempted-recon; sid:200003927; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ourlovmess.wordpress.com",nocase; classtype:attempted-recon; sid:200003928; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ousumi.co-jp.rjkaksnid.co",nocase; classtype:attempted-recon; sid:200003929; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ousumi.co-jp.rjkaksnid.net",nocase; classtype:attempted-recon; sid:200003930; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"outlook-mailer.com",nocase; classtype:attempted-recon; sid:200003931; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"outlook-microsoftlogin98uqwuuw8as.questionpro.com",nocase; classtype:attempted-recon; sid:200003932; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"outlook.b-cdn.net",nocase; classtype:attempted-recon; sid:200003933; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"outlook12861.activehosted.com",nocase; classtype:attempted-recon; sid:200003934; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"outlook1541489.webcindario.com",nocase; classtype:attempted-recon; sid:200003935; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"outlookcom119.yolasite.com",nocase; classtype:attempted-recon; sid:200003936; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"outlookhelpdesk.activehosted.com",nocase; classtype:attempted-recon; sid:200003937; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"outlooklan.filesusr.com",nocase; classtype:attempted-recon; sid:200003938; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"outlookmsnhotmail.weebly.com",nocase; classtype:attempted-recon; sid:200003939; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"outravantagem.com",nocase; classtype:attempted-recon; sid:200003940; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ouverturecompte.lbp-eer-int.fr",nocase; classtype:attempted-recon; sid:200003941; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ov74x.codesandbox.io",nocase; classtype:attempted-recon; sid:200003942; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ow.yestojudge.cn",nocase; classtype:attempted-recon; sid:200003943; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"owaauthmail.sitey.me",nocase; classtype:attempted-recon; sid:200003944; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"owablu84349439434.web.app",nocase; classtype:attempted-recon; sid:200003945; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"owambewww.com",nocase; classtype:attempted-recon; sid:200003946; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"owaupgradeservice3.myfreesites.net",nocase; classtype:attempted-recon; sid:200003947; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ozxl0q.webwave.dev",nocase; classtype:attempted-recon; sid:200003948; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"p.wpage.cc",nocase; classtype:attempted-recon; sid:200003949; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"p1.pagewiz.net",nocase; classtype:attempted-recon; sid:200003950; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"p1c.servleboncoinser.com",nocase; classtype:attempted-recon; sid:200003951; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"p1ch14nga.byethost6.com",nocase; classtype:attempted-recon; sid:200003952; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"p3i.lp3.ulm.ac.id",nocase; classtype:attempted-recon; sid:200003953; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"p402s.codesandbox.io",nocase; classtype:attempted-recon; sid:200003954; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"p84ig.csb.app",nocase; classtype:attempted-recon; sid:200003955; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paavos.in",nocase; classtype:attempted-recon; sid:200003956; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"packlevovd.byethost32.com",nocase; classtype:attempted-recon; sid:200003957; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"page-appeal-unpublish1253631.web.app",nocase; classtype:attempted-recon; sid:200003958; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"page-dashboard-option-2021.my.id",nocase; classtype:attempted-recon; sid:200003959; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"page-dashboard-option.my.id",nocase; classtype:attempted-recon; sid:200003960; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"page-revertion.000webhostapp.com",nocase; classtype:attempted-recon; sid:200003961; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"page-updates-and-protection.web.id",nocase; classtype:attempted-recon; sid:200003962; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pagehelpsupportupdatesidentity.co.vu",nocase; classtype:attempted-recon; sid:200003963; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pages-and-community-service.pp.ua",nocase; classtype:attempted-recon; sid:200003964; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pages-help-center-2021.my.id",nocase; classtype:attempted-recon; sid:200003965; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pageshelpandsupportcenter.co.vu",nocase; classtype:attempted-recon; sid:200003966; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pageshelpincserfivetyuasssss.co.vu",nocase; classtype:attempted-recon; sid:200003967; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pagesldentitypollcylssue.co.vu",nocase; classtype:attempted-recon; sid:200003968; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pagespolicycenter-0000053926367388.support",nocase; classtype:attempted-recon; sid:200003969; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pagincolm.com",nocase; classtype:attempted-recon; sid:200003970; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pahav.ae",nocase; classtype:attempted-recon; sid:200003971; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pahcaikeswap.com",nocase; classtype:attempted-recon; sid:200003972; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paiement-leboncoin-fr.com",nocase; classtype:attempted-recon; sid:200003973; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paiementsecuriser-portefeuille-leboncoin.com",nocase; classtype:attempted-recon; sid:200003974; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paincurephysio.com",nocase; classtype:attempted-recon; sid:200003975; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pakkeleifreung.wpengine.com",nocase; classtype:attempted-recon; sid:200003976; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"palenate.com",nocase; classtype:attempted-recon; sid:200003977; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancackeswap.digital",nocase; classtype:attempted-recon; sid:200003978; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancaekswap.cc",nocase; classtype:attempted-recon; sid:200003979; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakaswap.cam",nocase; classtype:attempted-recon; sid:200003980; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancake-swap.cam",nocase; classtype:attempted-recon; sid:200003981; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakecswap.digital",nocase; classtype:attempted-recon; sid:200003982; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakesswapfinance.com",nocase; classtype:attempted-recon; sid:200003983; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakesswapfinance.net",nocase; classtype:attempted-recon; sid:200003984; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswaip.finance",nocase; classtype:attempted-recon; sid:200003985; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.betav2.com",nocase; classtype:attempted-recon; sid:200003986; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finance-reserve.com",nocase; classtype:attempted-recon; sid:200003987; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finances.amplifydynamics.com",nocase; classtype:attempted-recon; sid:200003988; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finances.andrewollick.com",nocase; classtype:attempted-recon; sid:200003989; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finances.aplansx1688.com",nocase; classtype:attempted-recon; sid:200003990; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finances.baylysimmo.com",nocase; classtype:attempted-recon; sid:200003991; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finances.clckb.com",nocase; classtype:attempted-recon; sid:200003992; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finances.engravedsticks.com",nocase; classtype:attempted-recon; sid:200003993; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finances.ewhiterealestate.com",nocase; classtype:attempted-recon; sid:200003994; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finances.expeditiouslystore.com",nocase; classtype:attempted-recon; sid:200003995; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finances.exponentialsteps.com",nocase; classtype:attempted-recon; sid:200003996; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finances.mysticplug.com",nocase; classtype:attempted-recon; sid:200003997; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finances.mytemari.com",nocase; classtype:attempted-recon; sid:200003998; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finances.mythicalmerch.com",nocase; classtype:attempted-recon; sid:200003999; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finances.mythikoutdoors.com",nocase; classtype:attempted-recon; sid:200004000; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finances.netsoftportal.com",nocase; classtype:attempted-recon; sid:200004001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finances.olifund.com",nocase; classtype:attempted-recon; sid:200004002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finances.outdoorreturn.com",nocase; classtype:attempted-recon; sid:200004003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finances.outletconnector.com",nocase; classtype:attempted-recon; sid:200004004; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finances.pandocompany.com",nocase; classtype:attempted-recon; sid:200004005; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finances.travelareo.com",nocase; classtype:attempted-recon; sid:200004006; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finances.trendette.com",nocase; classtype:attempted-recon; sid:200004007; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finances.trichomecapital.com",nocase; classtype:attempted-recon; sid:200004008; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finances.truckrepairsalbuquerque.com",nocase; classtype:attempted-recon; sid:200004009; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.finances.truthtubeuncensored.com",nocase; classtype:attempted-recon; sid:200004010; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswap.win96.io",nocase; classtype:attempted-recon; sid:200004011; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswapp.su",nocase; classtype:attempted-recon; sid:200004012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswaps-finances.com",nocase; classtype:attempted-recon; sid:200004013; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswaps.info",nocase; classtype:attempted-recon; sid:200004014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeswop.com",nocase; classtype:attempted-recon; sid:200004015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pancakeyswap.org",nocase; classtype:attempted-recon; sid:200004016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pandaskin.ru.com",nocase; classtype:attempted-recon; sid:200004017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"panelweb-4cae2.web.app",nocase; classtype:attempted-recon; sid:200004018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pantekkau.duckdns.org",nocase; classtype:attempted-recon; sid:200004019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"panterpro.com",nocase; classtype:attempted-recon; sid:200004020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"parcel-tracking-235xl845236235234x.ru",nocase; classtype:attempted-recon; sid:200004021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pardot.assemblecommunities.com",nocase; classtype:attempted-recon; sid:200004022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"parg.co",nocase; classtype:attempted-recon; sid:200004023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"parkerwayland.com",nocase; classtype:attempted-recon; sid:200004024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"parkfans.nl",nocase; classtype:attempted-recon; sid:200004025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"parqueuniversitario.com",nocase; classtype:attempted-recon; sid:200004026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"parroquiajesucristoredentor.com",nocase; classtype:attempted-recon; sid:200004027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"particuliers-espacesocietegeneral.com",nocase; classtype:attempted-recon; sid:200004028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pasquery.com",nocase; classtype:attempted-recon; sid:200004029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"passionfruit4576261.brizy.site",nocase; classtype:attempted-recon; sid:200004030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"passproa.byethost7.com",nocase; classtype:attempted-recon; sid:200004031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pasteeshirt.biz",nocase; classtype:attempted-recon; sid:200004032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pateltutorials.com",nocase; classtype:attempted-recon; sid:200004033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pathikareps.com",nocase; classtype:attempted-recon; sid:200004034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"patient-cell-40f5.updatedlogmylogin.workers.dev",nocase; classtype:attempted-recon; sid:200004035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"patriciaeqths-wa.gq",nocase; classtype:attempted-recon; sid:200004036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"patrimoni.montcada.cat",nocase; classtype:attempted-recon; sid:200004037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pauliusb.eu",nocase; classtype:attempted-recon; sid:200004038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paulmitchellforcongress.com",nocase; classtype:attempted-recon; sid:200004039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paws.org.au",nocase; classtype:attempted-recon; sid:200004040; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paxful-click.com",nocase; classtype:attempted-recon; sid:200004041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paxful-trade.com",nocase; classtype:attempted-recon; sid:200004042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pay-acc-security.codeanyapp.com",nocase; classtype:attempted-recon; sid:200004043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pay-pal.newconfig-solana.docsaboutnewrestricted.ltd",nocase; classtype:attempted-recon; sid:200004044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pay-sera.web.app",nocase; classtype:attempted-recon; sid:200004045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pay.moban.com",nocase; classtype:attempted-recon; sid:200004046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pay16-olx.pl",nocase; classtype:attempted-recon; sid:200004047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pay4pictures.com",nocase; classtype:attempted-recon; sid:200004048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"payee-my-hali.com",nocase; classtype:attempted-recon; sid:200004049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"payee-securityerror.com",nocase; classtype:attempted-recon; sid:200004050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"payeenew-hali.com",nocase; classtype:attempted-recon; sid:200004051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"payment-hsbc.eu",nocase; classtype:attempted-recon; sid:200004052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"payment.irs.benefit.marypoesia.com",nocase; classtype:attempted-recon; sid:200004053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"payment.mishooshow.com",nocase; classtype:attempted-recon; sid:200004054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paymentfailure-assistant.com",nocase; classtype:attempted-recon; sid:200004055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paymentnotificationnow.blogspot.com",nocase; classtype:attempted-recon; sid:200004056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-caseid331.com",nocase; classtype:attempted-recon; sid:200004057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-caseid63257.com",nocase; classtype:attempted-recon; sid:200004058; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-customer-service.business.site",nocase; classtype:attempted-recon; sid:200004059; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-me-alessandra-martini.com",nocase; classtype:attempted-recon; sid:200004060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-merchantloyalty.com",nocase; classtype:attempted-recon; sid:200004061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-opladen.be",nocase; classtype:attempted-recon; sid:200004062; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-security-payment.7867888.com",nocase; classtype:attempted-recon; sid:200004063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-security-payment.xkzfc.com",nocase; classtype:attempted-recon; sid:200004064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-security-payment.zcygczz.com",nocase; classtype:attempted-recon; sid:200004065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-security-payment.zwangke.com",nocase; classtype:attempted-recon; sid:200004066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-test.projektumfeld.de",nocase; classtype:attempted-recon; sid:200004067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal.ca.purchasekindle.com",nocase; classtype:attempted-recon; sid:200004068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal.co.uk.useriazi6bqgssb.settingsppup.com",nocase; classtype:attempted-recon; sid:200004069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal.com.0.security-confirmation.d72b69c8e37aec662e13e39d929d6e3d.as2.2u.se",nocase; classtype:attempted-recon; sid:200004070; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal.com.update.service.verify.freeget.net",nocase; classtype:attempted-recon; sid:200004071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypalforex.co.ke",nocase; classtype:attempted-recon; sid:200004072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypalticket134235.com",nocase; classtype:attempted-recon; sid:200004073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypay-login.jp",nocase; classtype:attempted-recon; sid:200004074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypay-net.cn",nocase; classtype:attempted-recon; sid:200004075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypei.co",nocase; classtype:attempted-recon; sid:200004076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"payplchhkin.org",nocase; classtype:attempted-recon; sid:200004077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paytheinput.updatethejpamazon.buzz",nocase; classtype:attempted-recon; sid:200004078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"payu.okta-emea.com",nocase; classtype:attempted-recon; sid:200004079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pbi.unsam.ac.id",nocase; classtype:attempted-recon; sid:200004080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pbpro3453file.gb.net",nocase; classtype:attempted-recon; sid:200004081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pc.tc",nocase; classtype:attempted-recon; sid:200004082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pcbacweb.webcindario.com",nocase; classtype:attempted-recon; sid:200004083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pcbacweblogin.webcindario.com",nocase; classtype:attempted-recon; sid:200004084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pcbc-webalert03.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200004085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pchnaasdban.byethost33.com",nocase; classtype:attempted-recon; sid:200004086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pchnchabanc.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200004087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pcpcontacts.granadoemurahara.com.br",nocase; classtype:attempted-recon; sid:200004088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pcsnissin.com",nocase; classtype:attempted-recon; sid:200004089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pdf-cloud-document.weeblysite.com",nocase; classtype:attempted-recon; sid:200004090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pdf-sharefile-doc.weeblysite.com",nocase; classtype:attempted-recon; sid:200004091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pdp.eue.mybluehost.me",nocase; classtype:attempted-recon; sid:200004092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pearlfilms.com",nocase; classtype:attempted-recon; sid:200004093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pec.libero.it.robotake.com",nocase; classtype:attempted-recon; sid:200004094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pecgradsyjpgfayrvqcfvibvog-dot-gowa11111111.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200004095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"peer.yourluv.co",nocase; classtype:attempted-recon; sid:200004096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pelhaf041984.byethost9.com",nocase; classtype:attempted-recon; sid:200004097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pemersatu-bangsaa-18plus.duckdns.org",nocase; classtype:attempted-recon; sid:200004098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pencakecwap.com",nocase; classtype:attempted-recon; sid:200004099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pendentecaixa.blob.core.windows.net",nocase; classtype:attempted-recon; sid:200004100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pentelican-amusemen.000webhostapp.com",nocase; classtype:attempted-recon; sid:200004101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"perabetgirs.blogspot.com",nocase; classtype:attempted-recon; sid:200004102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"perfectliker.net",nocase; classtype:attempted-recon; sid:200004103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"perfectlybuilt.ca",nocase; classtype:attempted-recon; sid:200004104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"perfectwill.vi",nocase; classtype:attempted-recon; sid:200004105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"perfumesway.rw",nocase; classtype:attempted-recon; sid:200004106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"perinasas.it",nocase; classtype:attempted-recon; sid:200004107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"peringatanakunfb2k214.webnode.com",nocase; classtype:attempted-recon; sid:200004108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"permajacktulsa.com",nocase; classtype:attempted-recon; sid:200004109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"peronaci.it",nocase; classtype:attempted-recon; sid:200004110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"persistent.serveirc.com",nocase; classtype:attempted-recon; sid:200004111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"perso.menara.ma",nocase; classtype:attempted-recon; sid:200004112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"personal.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200004113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pertinae.com",nocase; classtype:attempted-recon; sid:200004114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"peru.payulatam.com",nocase; classtype:attempted-recon; sid:200004115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"peruzonazonasegvra-bnweb29.com",nocase; classtype:attempted-recon; sid:200004116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"petesappliancesllc.com",nocase; classtype:attempted-recon; sid:200004117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"petro-sales.com",nocase; classtype:attempted-recon; sid:200004118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"petrolpumpservice.in",nocase; classtype:attempted-recon; sid:200004119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pharmaglobiz.com",nocase; classtype:attempted-recon; sid:200004120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"phc56741.wixsite.com",nocase; classtype:attempted-recon; sid:200004121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"phillipmill176545.clickfunnels.com",nocase; classtype:attempted-recon; sid:200004122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"phiphicocobella.com",nocase; classtype:attempted-recon; sid:200004123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"phiphihotelgroup.com",nocase; classtype:attempted-recon; sid:200004124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"phonegiftsin.blogspot.com",nocase; classtype:attempted-recon; sid:200004125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"phongvuexpress.vn",nocase; classtype:attempted-recon; sid:200004126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"photoartstavrinos.com",nocase; classtype:attempted-recon; sid:200004127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"photographybyallen.com",nocase; classtype:attempted-recon; sid:200004128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"phreshphoto.com",nocase; classtype:attempted-recon; sid:200004129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"phx.chromeproxy.net",nocase; classtype:attempted-recon; sid:200004130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"physical.servegame.com",nocase; classtype:attempted-recon; sid:200004131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"piandizano.it",nocase; classtype:attempted-recon; sid:200004132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichiactivate711.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200004133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichin-web.ihostfull.com",nocase; classtype:attempted-recon; sid:200004134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichincalog00.ihostfull.com",nocase; classtype:attempted-recon; sid:200004135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichincha-msj.byethost7.com",nocase; classtype:attempted-recon; sid:200004136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichincha.conlinux.net",nocase; classtype:attempted-recon; sid:200004137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichinchal.byethost24.com",nocase; classtype:attempted-recon; sid:200004138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichinchaonline.byethost6.com",nocase; classtype:attempted-recon; sid:200004139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichinchaq.byethost4.com",nocase; classtype:attempted-recon; sid:200004140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichinchasdirecu.byethost7.com",nocase; classtype:attempted-recon; sid:200004141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichinchasss.freecluster.eu",nocase; classtype:attempted-recon; sid:200004142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichinchaweb-ecu.byethost7.com",nocase; classtype:attempted-recon; sid:200004143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichinchawebline.byethost7.com",nocase; classtype:attempted-recon; sid:200004144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichinchawebsite.2host.me",nocase; classtype:attempted-recon; sid:200004145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichinotificpin1.ihostfull.com",nocase; classtype:attempted-recon; sid:200004146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pichnchaaban134.ihostfull.com",nocase; classtype:attempted-recon; sid:200004147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"picnic.industries",nocase; classtype:attempted-recon; sid:200004148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pics.lookatmynewphotos.com",nocase; classtype:attempted-recon; sid:200004149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pideciisa.com",nocase; classtype:attempted-recon; sid:200004150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"piena.fun",nocase; classtype:attempted-recon; sid:200004151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pijkeowa.tk",nocase; classtype:attempted-recon; sid:200004152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pikaresailing.com",nocase; classtype:attempted-recon; sid:200004153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pil.nxn.mybluehost.me",nocase; classtype:attempted-recon; sid:200004154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pilotofficial.mfs.gg",nocase; classtype:attempted-recon; sid:200004155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pipesanddrape.com",nocase; classtype:attempted-recon; sid:200004156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pips.fkip.ulm.ac.id",nocase; classtype:attempted-recon; sid:200004157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pixelbenchmarks.com",nocase; classtype:attempted-recon; sid:200004158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pizfirepizzacafe.com",nocase; classtype:attempted-recon; sid:200004159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pkk.depok.go.id",nocase; classtype:attempted-recon; sid:200004160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pl-19.ru",nocase; classtype:attempted-recon; sid:200004161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pl.pl2021.ru",nocase; classtype:attempted-recon; sid:200004162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plainspear.glitch.me",nocase; classtype:attempted-recon; sid:200004163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plan-o2-monthlypayments.com",nocase; classtype:attempted-recon; sid:200004164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plantamariaeugenia.com",nocase; classtype:attempted-recon; sid:200004165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plasifell44.freecluster.eu",nocase; classtype:attempted-recon; sid:200004166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plasma.tamu.edu",nocase; classtype:attempted-recon; sid:200004167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plasticaindia.com",nocase; classtype:attempted-recon; sid:200004168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plataformaeducativa.se.jalisco.gob.mx",nocase; classtype:attempted-recon; sid:200004169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"playnlearntogether.com",nocase; classtype:attempted-recon; sid:200004170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plodjjks.com",nocase; classtype:attempted-recon; sid:200004171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plush.my",nocase; classtype:attempted-recon; sid:200004172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pmboulevard.com",nocase; classtype:attempted-recon; sid:200004173; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pmiconnect-my.sharepoint.com",nocase; classtype:attempted-recon; sid:200004174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pms-uipro.co.in",nocase; classtype:attempted-recon; sid:200004175; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pnrmericasnm.byethost22.com",nocase; classtype:attempted-recon; sid:200004176; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"po.do",nocase; classtype:attempted-recon; sid:200004177; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"poc-rewards-program-c2dfc.web.app",nocase; classtype:attempted-recon; sid:200004178; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"poczta-order.pl-id18901816.xyz",nocase; classtype:attempted-recon; sid:200004179; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"poczta-order.pl-id32513080.xyz",nocase; classtype:attempted-recon; sid:200004180; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"poczta-order.pl-id49214593.xyz",nocase; classtype:attempted-recon; sid:200004181; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"poczta-order.pl-id53061369.xyz",nocase; classtype:attempted-recon; sid:200004182; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"poczta-order.pl-id76514308.xyz",nocase; classtype:attempted-recon; sid:200004183; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"poczta-order.pl-id89096441.xyz",nocase; classtype:attempted-recon; sid:200004184; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"podpiska-darom.ru",nocase; classtype:attempted-recon; sid:200004185; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pokajca.web.app",nocase; classtype:attempted-recon; sid:200004186; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"polen-esquadrias.blogspot.com",nocase; classtype:attempted-recon; sid:200004187; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"poligrafiapias.com",nocase; classtype:attempted-recon; sid:200004188; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"polkadot-france.fr",nocase; classtype:attempted-recon; sid:200004189; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"polkastarter.com.co",nocase; classtype:attempted-recon; sid:200004190; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"polkastarter.group",nocase; classtype:attempted-recon; sid:200004191; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"polkastarter.one",nocase; classtype:attempted-recon; sid:200004192; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"polomcapital.com",nocase; classtype:attempted-recon; sid:200004193; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"poniatowscy.xpx.pl",nocase; classtype:attempted-recon; sid:200004194; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pontofrio.webpremios.com.br",nocase; classtype:attempted-recon; sid:200004195; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pope0w.webwave.dev",nocase; classtype:attempted-recon; sid:200004196; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"portal.mailsphere.co.uk",nocase; classtype:attempted-recon; sid:200004197; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"portal57406531456576.weeblysite.com",nocase; classtype:attempted-recon; sid:200004198; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"portalemps-controllo-dispositivo.com",nocase; classtype:attempted-recon; sid:200004199; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"posadalalucia.com.ar",nocase; classtype:attempted-recon; sid:200004200; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"posdiepay.com",nocase; classtype:attempted-recon; sid:200004201; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"poseidonxraven.com",nocase; classtype:attempted-recon; sid:200004202; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"poshqd.classsizecounts.com",nocase; classtype:attempted-recon; sid:200004203; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"post-myitem.com",nocase; classtype:attempted-recon; sid:200004204; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"post-secu.fr",nocase; classtype:attempted-recon; sid:200004205; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"post-track.ch",nocase; classtype:attempted-recon; sid:200004206; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"posta.sk.u1480692.cp.regruhosting.ru",nocase; classtype:attempted-recon; sid:200004207; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postaledsp2.conexion.fr.savealifemw.org",nocase; classtype:attempted-recon; sid:200004208; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postalfees-uk.com",nocase; classtype:attempted-recon; sid:200004209; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postchtrackingorder.com",nocase; classtype:attempted-recon; sid:200004210; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"posten-post.it",nocase; classtype:attempted-recon; sid:200004211; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postlogistics.datacoll.net",nocase; classtype:attempted-recon; sid:200004212; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postnord.myvnc.com",nocase; classtype:attempted-recon; sid:200004213; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postoffice-company.com",nocase; classtype:attempted-recon; sid:200004214; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postoffice-deliveryupdates.com",nocase; classtype:attempted-recon; sid:200004215; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postoffice-fees.co.uk",nocase; classtype:attempted-recon; sid:200004216; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postoffice-issue-redelivery.com",nocase; classtype:attempted-recon; sid:200004217; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postoffice-payfees.co.uk",nocase; classtype:attempted-recon; sid:200004218; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postoffice-redelivery.co",nocase; classtype:attempted-recon; sid:200004219; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postoffice-redeliverycharge.co.uk",nocase; classtype:attempted-recon; sid:200004220; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postoffice-reshipmentcharges.co.uk",nocase; classtype:attempted-recon; sid:200004221; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postoffice-tracking-update.com",nocase; classtype:attempted-recon; sid:200004222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postoffice.co.uk-billing.delivery",nocase; classtype:attempted-recon; sid:200004223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postoffice61-t.neolane.net",nocase; classtype:attempted-recon; sid:200004224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postofficecustomerservice.com",nocase; classtype:attempted-recon; sid:200004225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-3hay7avk8t.novitium.ca",nocase; classtype:attempted-recon; sid:200004226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-3j2rm3bhv.novitium.ca",nocase; classtype:attempted-recon; sid:200004227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-4x8vuh5yl.novitium.ca",nocase; classtype:attempted-recon; sid:200004228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-5tnqcr6n2f.novitium.ca",nocase; classtype:attempted-recon; sid:200004229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-7fuasgej.novitium.ca",nocase; classtype:attempted-recon; sid:200004230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-7l6od3hib6.novitium.ca",nocase; classtype:attempted-recon; sid:200004231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-87z17z035r.novitium.ca",nocase; classtype:attempted-recon; sid:200004232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-9clmwr466y.novitium.ca",nocase; classtype:attempted-recon; sid:200004233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-b13xvat71l.novitium.ca",nocase; classtype:attempted-recon; sid:200004234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-b1qz7m80ed.novitium.ca",nocase; classtype:attempted-recon; sid:200004235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-b9b2x6lv.novitium.ca",nocase; classtype:attempted-recon; sid:200004236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-bcthrrqx.novitium.ca",nocase; classtype:attempted-recon; sid:200004237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-bjrc0kfq.novitium.ca",nocase; classtype:attempted-recon; sid:200004238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-ehbmeskd.novitium.ca",nocase; classtype:attempted-recon; sid:200004239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-fit4h5qn.novitium.ca",nocase; classtype:attempted-recon; sid:200004240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-it5t72t0.novitium.ca",nocase; classtype:attempted-recon; sid:200004241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-m5aru8ccx.novitium.ca",nocase; classtype:attempted-recon; sid:200004242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-mdco0khq.novitium.ca",nocase; classtype:attempted-recon; sid:200004243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-mnfo36wrb.novitium.ca",nocase; classtype:attempted-recon; sid:200004244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-ovtwyu3uuc.novitium.ca",nocase; classtype:attempted-recon; sid:200004245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-p0ync3d5i2.novitium.ca",nocase; classtype:attempted-recon; sid:200004246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-qu5c8f4226.novitium.ca",nocase; classtype:attempted-recon; sid:200004247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-rnkw2khiu.novitium.ca",nocase; classtype:attempted-recon; sid:200004248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-s4oi40db90.novitium.ca",nocase; classtype:attempted-recon; sid:200004249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-vs04683fm.novitium.ca",nocase; classtype:attempted-recon; sid:200004250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-w59xt1ze7p.novitium.ca",nocase; classtype:attempted-recon; sid:200004251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-xkrgmiqe0.novitium.ca",nocase; classtype:attempted-recon; sid:200004252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-xufjnr56.novitium.ca",nocase; classtype:attempted-recon; sid:200004253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-zar8dbnedn.novitium.ca",nocase; classtype:attempted-recon; sid:200004254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"postsfb-zo4eyq9s9g.novitium.ca",nocase; classtype:attempted-recon; sid:200004255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pover.in.net",nocase; classtype:attempted-recon; sid:200004256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"poverty.monespace.net",nocase; classtype:attempted-recon; sid:200004257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"powercase.shoplineapp.com",nocase; classtype:attempted-recon; sid:200004258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"powertrusion.com",nocase; classtype:attempted-recon; sid:200004259; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pp-aid.com",nocase; classtype:attempted-recon; sid:200004260; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pphwm.app.link",nocase; classtype:attempted-recon; sid:200004261; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ppkalqudwah.ulm.ac.id",nocase; classtype:attempted-recon; sid:200004262; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prdqonl.cluster030.hosting.ovh.net",nocase; classtype:attempted-recon; sid:200004263; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"premiumnoidaescorts.com",nocase; classtype:attempted-recon; sid:200004264; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"preppingconfidence.com",nocase; classtype:attempted-recon; sid:200004265; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prevencionvialbcpzonasegura.esc-pons.com",nocase; classtype:attempted-recon; sid:200004266; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prevencionvialbcpzonaseguras.esc-pons.com",nocase; classtype:attempted-recon; sid:200004267; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"preview-doc-oicone.tk",nocase; classtype:attempted-recon; sid:200004268; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"preview-docs-ncdps.ml",nocase; classtype:attempted-recon; sid:200004269; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prikany.com",nocase; classtype:attempted-recon; sid:200004270; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prikolnaya.com",nocase; classtype:attempted-recon; sid:200004271; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"primeshopee.com",nocase; classtype:attempted-recon; sid:200004272; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"principal.servehalflife.com",nocase; classtype:attempted-recon; sid:200004273; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"printtoner.com.mx",nocase; classtype:attempted-recon; sid:200004274; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"privacy-notification-checkiing-page-recovery.my.id",nocase; classtype:attempted-recon; sid:200004275; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"privacy-observation-5587921365694256903.tk",nocase; classtype:attempted-recon; sid:200004276; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"privacy-observation-5587921365694256906.tk",nocase; classtype:attempted-recon; sid:200004277; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"privacy-observation-5587921365694256907.tk",nocase; classtype:attempted-recon; sid:200004278; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"privacy-observation-5587921365694256908.tk",nocase; classtype:attempted-recon; sid:200004279; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"privacy-revocerio-identitty-page-prtecti-updatse.web.id",nocase; classtype:attempted-recon; sid:200004280; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"privacy-update-page-protections-recovry-association.web.id",nocase; classtype:attempted-recon; sid:200004281; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"privacy-update-recovry-page-protections-association-secu.web.id",nocase; classtype:attempted-recon; sid:200004282; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"privacy-update-secu-recovriy-page-protection-association.web.id",nocase; classtype:attempted-recon; sid:200004283; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"privacy-update-secu-recovry-page-protection-association.web.id",nocase; classtype:attempted-recon; sid:200004284; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"privacypolicypagesecure.co.vu",nocase; classtype:attempted-recon; sid:200004285; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"privacys-page-updatee-protection-recovry-associatiion.web.id",nocase; classtype:attempted-recon; sid:200004286; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"private-quicksand.surge.sh",nocase; classtype:attempted-recon; sid:200004287; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proch.somee.com",nocase; classtype:attempted-recon; sid:200004288; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"productkeyforfree.com",nocase; classtype:attempted-recon; sid:200004289; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"professional-house-cleaning.ca",nocase; classtype:attempted-recon; sid:200004290; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"programasbeta.com",nocase; classtype:attempted-recon; sid:200004291; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"programe-alba.ro",nocase; classtype:attempted-recon; sid:200004292; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prok.webd.pl",nocase; classtype:attempted-recon; sid:200004293; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prolevelsignage.com",nocase; classtype:attempted-recon; sid:200004294; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promaclive00.byethost7.com",nocase; classtype:attempted-recon; sid:200004295; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promehedinti.ro",nocase; classtype:attempted-recon; sid:200004296; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promeric4.webcindario.com",nocase; classtype:attempted-recon; sid:200004297; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promerica-final.byethost12.com",nocase; classtype:attempted-recon; sid:200004298; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promerica-web2.byethost7.com",nocase; classtype:attempted-recon; sid:200004299; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promerica-web4.byethost24.com",nocase; classtype:attempted-recon; sid:200004300; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promericaa0.byethost12.com",nocase; classtype:attempted-recon; sid:200004301; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promericad.byethost6.com",nocase; classtype:attempted-recon; sid:200004302; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promericaisn.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200004303; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promericaonlifd.byethost15.com",nocase; classtype:attempted-recon; sid:200004304; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promericaonline.byethost6.com",nocase; classtype:attempted-recon; sid:200004305; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promericaonlint.byethost17.com",nocase; classtype:attempted-recon; sid:200004306; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promericasv.eb2a.com",nocase; classtype:attempted-recon; sid:200004307; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promericsvonli.byethost18.com",nocase; classtype:attempted-recon; sid:200004308; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promeriicaenline.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200004309; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"promexsv000.byethost7.com",nocase; classtype:attempted-recon; sid:200004310; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pronouncement-reconfrim-5537412698564562302.tk",nocase; classtype:attempted-recon; sid:200004311; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pronouncement-reconfrim-5537412698564562303.tk",nocase; classtype:attempted-recon; sid:200004312; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pronouncement-reconfrim-5537412698564562304.tk",nocase; classtype:attempted-recon; sid:200004313; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pronouncement-reconfrim-5537412698564562305.tk",nocase; classtype:attempted-recon; sid:200004314; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pronouncement-reconfrim-5537412698564562307.tk",nocase; classtype:attempted-recon; sid:200004315; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proomericaenline.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200004316; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"property-ads-marketplace.libidokala.com",nocase; classtype:attempted-recon; sid:200004317; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prophetwilson.com",nocase; classtype:attempted-recon; sid:200004318; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prosto-i-vkusno.com",nocase; classtype:attempted-recon; sid:200004319; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prosxsiuser.myfreesites.net",nocase; classtype:attempted-recon; sid:200004320; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"prote010001cr.000webhostapp.com",nocase; classtype:attempted-recon; sid:200004321; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"protect-4d56vca.surge.sh",nocase; classtype:attempted-recon; sid:200004322; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"protect.sabzgoltab.com",nocase; classtype:attempted-recon; sid:200004323; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"protect.theresortweddings.com",nocase; classtype:attempted-recon; sid:200004324; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"protection-newpayee-halifax.com",nocase; classtype:attempted-recon; sid:200004325; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"protectyouraccount.updatethejpamazon.club",nocase; classtype:attempted-recon; sid:200004326; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proteksion-accts1321sdsd.cf",nocase; classtype:attempted-recon; sid:200004327; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"protelesis.cl",nocase; classtype:attempted-recon; sid:200004328; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proton-mail.fr",nocase; classtype:attempted-recon; sid:200004329; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"provideronline.site",nocase; classtype:attempted-recon; sid:200004330; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"provimedsupplies.com",nocase; classtype:attempted-recon; sid:200004331; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pruebamaricoyo.hostfree.pw",nocase; classtype:attempted-recon; sid:200004332; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pruebaparami.hostfree.pw",nocase; classtype:attempted-recon; sid:200004333; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pruebaparayo.byethost7.com",nocase; classtype:attempted-recon; sid:200004334; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pruebassitio.unaux.com",nocase; classtype:attempted-recon; sid:200004335; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pse.ntx.mybluehost.me",nocase; classtype:attempted-recon; sid:200004336; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"psupport.apple.com.pple.com",nocase; classtype:attempted-recon; sid:200004337; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pt08.com",nocase; classtype:attempted-recon; sid:200004338; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ptn.co.id",nocase; classtype:attempted-recon; sid:200004339; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pubgneweventm2.com",nocase; classtype:attempted-recon; sid:200004340; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"publisan6373.byethost14.com",nocase; classtype:attempted-recon; sid:200004341; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"puciss.hyperphp.com",nocase; classtype:attempted-recon; sid:200004342; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"puedes.it",nocase; classtype:attempted-recon; sid:200004343; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"puffing.com.pk",nocase; classtype:attempted-recon; sid:200004344; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"puncakeswup.bar",nocase; classtype:attempted-recon; sid:200004345; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"punchdancestudio.com",nocase; classtype:attempted-recon; sid:200004346; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"puntobohemio.com",nocase; classtype:attempted-recon; sid:200004347; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"purgerassociateships.info",nocase; classtype:attempted-recon; sid:200004348; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"purgerdivulsed.info",nocase; classtype:attempted-recon; sid:200004349; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"purohotell.com",nocase; classtype:attempted-recon; sid:200004350; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"puroteksion-acctssds1321d.cf",nocase; classtype:attempted-recon; sid:200004351; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"purves-jcatkinson.co.uk",nocase; classtype:attempted-recon; sid:200004352; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pusat-facebook43.webnode.com",nocase; classtype:attempted-recon; sid:200004353; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"putsubtle.top",nocase; classtype:attempted-recon; sid:200004354; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"puul.ga",nocase; classtype:attempted-recon; sid:200004355; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pvgzfgmab0j.typeform.com",nocase; classtype:attempted-recon; sid:200004356; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pvppphpodkeipndncukxwvisym-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200004357; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pwpbzbyhpxjfaaufoeqzqpqmj.rockcoastclothing.com",nocase; classtype:attempted-recon; sid:200004358; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pytlo.com",nocase; classtype:attempted-recon; sid:200004359; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pzzjg.cn",nocase; classtype:attempted-recon; sid:200004360; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"q06huk.webwave.dev",nocase; classtype:attempted-recon; sid:200004361; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"q5ar4.skipdns.link",nocase; classtype:attempted-recon; sid:200004362; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"q6g474zyu9y.typeform.com",nocase; classtype:attempted-recon; sid:200004363; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qare.nl",nocase; classtype:attempted-recon; sid:200004364; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qbocd.csb.app",nocase; classtype:attempted-recon; sid:200004365; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qikgen.com.au",nocase; classtype:attempted-recon; sid:200004366; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qlgu1.codesandbox.io",nocase; classtype:attempted-recon; sid:200004367; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qpladccdthtvvpig-dot-sync-request-web-support.uk.r.appspot.com",nocase; classtype:attempted-recon; sid:200004368; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qrew5i.tk",nocase; classtype:attempted-recon; sid:200004369; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qsdqsx.ns12-wistee.fr",nocase; classtype:attempted-recon; sid:200004370; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"quad-as.de",nocase; classtype:attempted-recon; sid:200004371; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"quadfabrik.de",nocase; classtype:attempted-recon; sid:200004372; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qualitroge.weebly.com",nocase; classtype:attempted-recon; sid:200004373; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qubectravel.com",nocase; classtype:attempted-recon; sid:200004374; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"quiet-moji-1452.gonna.jp",nocase; classtype:attempted-recon; sid:200004375; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"quinaroja.com",nocase; classtype:attempted-recon; sid:200004376; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"quintanaevents.co",nocase; classtype:attempted-recon; sid:200004377; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"quipianura.bg.it",nocase; classtype:attempted-recon; sid:200004378; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"quirky-goodall-f1c19b.netlify.app",nocase; classtype:attempted-recon; sid:200004379; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"quota.creatorlink.net",nocase; classtype:attempted-recon; sid:200004380; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qw4g5w3sl31.typeform.com",nocase; classtype:attempted-recon; sid:200004381; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qwikkar.com",nocase; classtype:attempted-recon; sid:200004382; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qwywtxyyzmmztxiznpecgvngnv-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200004383; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qycn114.com",nocase; classtype:attempted-recon; sid:200004384; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r-web-2a3a9.web.app#bucky@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200004385; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r-web-2a3a9.web.app#ewhalley@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200004386; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r-web-2a3a9.web.app#mike_tracy@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200004387; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r-web-2a3a9.web.app#verg_yazzie@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200004388; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r.nl.enamora.de",nocase; classtype:attempted-recon; sid:200004389; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r.versorecto.org",nocase; classtype:attempted-recon; sid:200004390; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r2.ddlnk.net",nocase; classtype:attempted-recon; sid:200004391; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r2l.com.mx",nocase; classtype:attempted-recon; sid:200004392; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r7vfe.csb.app",nocase; classtype:attempted-recon; sid:200004393; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ra12s.hyperphp.com",nocase; classtype:attempted-recon; sid:200004394; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rabofree.blogspot.com",nocase; classtype:attempted-recon; sid:200004395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rabofree.blogspot.li",nocase; classtype:attempted-recon; sid:200004396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rackenfordlabs.com",nocase; classtype:attempted-recon; sid:200004397; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"racuncinta-indonesia.com",nocase; classtype:attempted-recon; sid:200004398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"radforddoors.cl",nocase; classtype:attempted-recon; sid:200004399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rajwebtechnology.com",nocase; classtype:attempted-recon; sid:200004400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakoten-co-jp.auqu0ei.cf",nocase; classtype:attempted-recon; sid:200004401; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakoten-co-jp.az4mod.ml",nocase; classtype:attempted-recon; sid:200004402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakoten-co-jp.hsb0ku.cf",nocase; classtype:attempted-recon; sid:200004403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakoten-co-jp.ldx3f7.cf",nocase; classtype:attempted-recon; sid:200004404; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakoten-co-jp.ltwqbq8.gq",nocase; classtype:attempted-recon; sid:200004405; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakoten-co-jp.ow8bda1.cf",nocase; classtype:attempted-recon; sid:200004406; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakoten-co-jp.ow8bda1.ga",nocase; classtype:attempted-recon; sid:200004407; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakoten-co-jp.ow8bda1.gq",nocase; classtype:attempted-recon; sid:200004408; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakoten.co.ip.8euq3pq.gq",nocase; classtype:attempted-recon; sid:200004409; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakoten.co.ip.8euq3pq.ml",nocase; classtype:attempted-recon; sid:200004410; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakoten.co.ip.w2qtjwo.cf",nocase; classtype:attempted-recon; sid:200004411; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"raktraphyp.byethost7.com",nocase; classtype:attempted-recon; sid:200004412; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakuten.co.jp.oadkxoe.cf",nocase; classtype:attempted-recon; sid:200004413; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rakuton-co.jp.o0owst.cn",nocase; classtype:attempted-recon; sid:200004414; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rambunctious-attention.surge.sh",nocase; classtype:attempted-recon; sid:200004415; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ramgarhiamatrimonial.ca",nocase; classtype:attempted-recon; sid:200004416; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ranchosanantonio5m.com",nocase; classtype:attempted-recon; sid:200004417; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ranjplay.com",nocase; classtype:attempted-recon; sid:200004418; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rap.coffee",nocase; classtype:attempted-recon; sid:200004419; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rappel-authentification-ecoute.freeweb.pk",nocase; classtype:attempted-recon; sid:200004420; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"razcdf.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200004421; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rbcmontgomery.com",nocase; classtype:attempted-recon; sid:200004422; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rbcroyalbanc.com",nocase; classtype:attempted-recon; sid:200004423; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rc1itemss.dnset.com",nocase; classtype:attempted-recon; sid:200004424; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rcproductionsjm.com",nocase; classtype:attempted-recon; sid:200004425; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rcweb-domain.web.app#living@zilch.nl",nocase; classtype:attempted-recon; sid:200004426; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rd8um.app.link",nocase; classtype:attempted-recon; sid:200004427; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rdeshapriya.com",nocase; classtype:attempted-recon; sid:200004428; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"re-direct-me.com",nocase; classtype:attempted-recon; sid:200004429; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"re-redirection-acc-id923872635122.blogspot.com",nocase; classtype:attempted-recon; sid:200004430; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"re-redirection-pp-account-id98763432.blogspot.com",nocase; classtype:attempted-recon; sid:200004431; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"re4nm.csb.app",nocase; classtype:attempted-recon; sid:200004432; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"react-ba2roi.stackblitz.io",nocase; classtype:attempted-recon; sid:200004433; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"real-estate-page-id-8821973834.theblucompany.com",nocase; classtype:attempted-recon; sid:200004434; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"real.de.seller.bookings.siharkaboy.boyolali.go.id",nocase; classtype:attempted-recon; sid:200004435; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"realclub.de",nocase; classtype:attempted-recon; sid:200004436; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"realcodashopfreediamonds.freeddns.com",nocase; classtype:attempted-recon; sid:200004437; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"realestate-page-homes.com",nocase; classtype:attempted-recon; sid:200004438; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"realestateagentlisting.tv",nocase; classtype:attempted-recon; sid:200004439; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"realfrischegarantie.de",nocase; classtype:attempted-recon; sid:200004440; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"realhypermarket.me",nocase; classtype:attempted-recon; sid:200004441; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"realmoneysend.com",nocase; classtype:attempted-recon; sid:200004442; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"realrenderstudio.it",nocase; classtype:attempted-recon; sid:200004443; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reauthenticate-walletbot.com",nocase; classtype:attempted-recon; sid:200004444; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"recallvapor.top",nocase; classtype:attempted-recon; sid:200004445; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"recapitulex.com",nocase; classtype:attempted-recon; sid:200004446; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"recidivism-apostrop.000webhostapp.com",nocase; classtype:attempted-recon; sid:200004447; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reconfirmpost287846656.us",nocase; classtype:attempted-recon; sid:200004448; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"records-tokyo.servepics.com",nocase; classtype:attempted-recon; sid:200004449; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"recoveraccount0.byethost3.com",nocase; classtype:attempted-recon; sid:200004450; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"recovered-activity-page-cover.my.id",nocase; classtype:attempted-recon; sid:200004451; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"recoverinst.ru",nocase; classtype:attempted-recon; sid:200004452; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"recso.org",nocase; classtype:attempted-recon; sid:200004453; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"recuperoradiosondeitalia.eu",nocase; classtype:attempted-recon; sid:200004454; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redbysfrgroupebox.myfreesites.net",nocase; classtype:attempted-recon; sid:200004455; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reddotarms.com",nocase; classtype:attempted-recon; sid:200004456; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redeem-microsoft-code.sitey.me",nocase; classtype:attempted-recon; sid:200004457; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redelivered-packages.org",nocase; classtype:attempted-recon; sid:200004458; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rediractionid547012016089540218057.blogspot.com",nocase; classtype:attempted-recon; sid:200004459; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redirect.app-wiegand-fbmmsnsj.k5tnncty9o-xmz4qzn5p42o.p.runcloud.link",nocase; classtype:attempted-recon; sid:200004460; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redirect.viglink.com?%uf%rj%fx%u3&key=fd5de1d096b38be9fffd6ddc1948df4f&u=%61%70%69%2e%61%64%64%74%68%69%73%2e%63%6f%6d%2f%6f%65%78%63%68%61%6e%67%65%2f%30%2e%38%2f%77%72%61%70%2f%6f%70%65%6e%67%72%61%70%68%e2%80%8c%75%72%6c%3dahr0chm6ly9ua3yuchvil3h5nt83oet4elzsag1mzndzjmfsdd1tzwrpysnav2x0wvhomfpvqnpkr2x1y0hkcgvtrxvim0puolbcy3ppmu4yzgrladg2ennfduhvdu02qxphujjmuhv5zw5ork5ecvu=",nocase; classtype:attempted-recon; sid:200004461; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redirect.voici-news.fr",nocase; classtype:attempted-recon; sid:200004462; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reditscbydeden82.duckdns.org",nocase; classtype:attempted-recon; sid:200004463; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redpichinfa.byethost7.com",nocase; classtype:attempted-recon; sid:200004464; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redtoptegmina.info",nocase; classtype:attempted-recon; sid:200004465; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reebe.snprobbx.pbz.r.de.a2ip.ru",nocase; classtype:attempted-recon; sid:200004466; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"referral.hosannahfministry.com.ng",nocase; classtype:attempted-recon; sid:200004467; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"regeninfraservices.com",nocase; classtype:attempted-recon; sid:200004468; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"regina.ninetendev.com",nocase; classtype:attempted-recon; sid:200004469; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"regionpostalelogsession.zyrosite.com",nocase; classtype:attempted-recon; sid:200004470; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"register-my-device.com",nocase; classtype:attempted-recon; sid:200004471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"register-page-certificated-000447.my.id",nocase; classtype:attempted-recon; sid:200004472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"registerpichinch.ihostfull.com",nocase; classtype:attempted-recon; sid:200004473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"registery001.byethost6.com",nocase; classtype:attempted-recon; sid:200004474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"registrdatapichi.ihostfull.com",nocase; classtype:attempted-recon; sid:200004475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"regrets.fun",nocase; classtype:attempted-recon; sid:200004476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reistermyrushcard.com",nocase; classtype:attempted-recon; sid:200004477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rekapuolam.blogspot.com",nocase; classtype:attempted-recon; sid:200004478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rektuen.nunmou.com",nocase; classtype:attempted-recon; sid:200004479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rekutanjpy.jp",nocase; classtype:attempted-recon; sid:200004480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"release-8373-mime-cast-e737737.s3.us-west-002.backblazeb2.com",nocase; classtype:attempted-recon; sid:200004481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"relevant.systems",nocase; classtype:attempted-recon; sid:200004482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reliabletaxservices.net",nocase; classtype:attempted-recon; sid:200004483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"remillardconsulting.com",nocase; classtype:attempted-recon; sid:200004484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"remittance369297292749.goshly.com",nocase; classtype:attempted-recon; sid:200004485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"remove-device.shop",nocase; classtype:attempted-recon; sid:200004486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rempitem.agilecrm.com",nocase; classtype:attempted-recon; sid:200004487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"remsy.app.link",nocase; classtype:attempted-recon; sid:200004488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rencon.ch.net2care.com",nocase; classtype:attempted-recon; sid:200004489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rendangunitutie.com",nocase; classtype:attempted-recon; sid:200004490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"renew.trusted-travelers-online.com",nocase; classtype:attempted-recon; sid:200004491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rentalconnectioninc-rz.tk",nocase; classtype:attempted-recon; sid:200004492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"repl-mess.myfreesites.net",nocase; classtype:attempted-recon; sid:200004493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"replilixecupiac0.byethost15.com",nocase; classtype:attempted-recon; sid:200004494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"replug.link",nocase; classtype:attempted-recon; sid:200004495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"request-payee-now.com",nocase; classtype:attempted-recon; sid:200004496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"resbet.blogspot.com",nocase; classtype:attempted-recon; sid:200004497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"resbetsgiris.blogspot.com",nocase; classtype:attempted-recon; sid:200004498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rescueforgivenreliefprogram.org",nocase; classtype:attempted-recon; sid:200004499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reset-billing-address.com",nocase; classtype:attempted-recon; sid:200004500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"restbetgir1.blogspot.com",nocase; classtype:attempted-recon; sid:200004501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"restbetgirisadresimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200004502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"restbetgirisadresimiz1.blogspot.com",nocase; classtype:attempted-recon; sid:200004503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"restorenetfllx.com",nocase; classtype:attempted-recon; sid:200004504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"restricted-newonline-payee.net",nocase; classtype:attempted-recon; sid:200004505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"restricted-newpayee.com",nocase; classtype:attempted-recon; sid:200004506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"resu.page.link",nocase; classtype:attempted-recon; sid:200004507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"retraiteenaction.ca",nocase; classtype:attempted-recon; sid:200004508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"retrospectiveplanningenforcementwestsussex.co.uk",nocase; classtype:attempted-recon; sid:200004509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"return.serveftp.com",nocase; classtype:attempted-recon; sid:200004510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"review-guilfordcountync.tk",nocase; classtype:attempted-recon; sid:200004511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"review-mynew-device.com",nocase; classtype:attempted-recon; sid:200004512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"review-page-activation-2021.my.id",nocase; classtype:attempted-recon; sid:200004513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"revisioneconfigurazione-clienti.000webhostapp.com",nocase; classtype:attempted-recon; sid:200004514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"revolut.b2bbooking.me",nocase; classtype:attempted-recon; sid:200004515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reward-garena-freefireff.blogspot.com",nocase; classtype:attempted-recon; sid:200004516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rewindingshop.com",nocase; classtype:attempted-recon; sid:200004517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rextraening.dk",nocase; classtype:attempted-recon; sid:200004518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rguga.ro",nocase; classtype:attempted-recon; sid:200004519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rhinomultimedia.com",nocase; classtype:attempted-recon; sid:200004520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rhrinternational.carambola.cl",nocase; classtype:attempted-recon; sid:200004521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"richardbashara.com",nocase; classtype:attempted-recon; sid:200004522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rightdiary.top",nocase; classtype:attempted-recon; sid:200004523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"riptideoperation.com",nocase; classtype:attempted-recon; sid:200004524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ritik33.github.io",nocase; classtype:attempted-recon; sid:200004525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"riversweeps.org",nocase; classtype:attempted-recon; sid:200004526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rizkyinterior.com",nocase; classtype:attempted-recon; sid:200004527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rj1kx.app.link",nocase; classtype:attempted-recon; sid:200004528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rjagqp.work",nocase; classtype:attempted-recon; sid:200004529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rkanet.com",nocase; classtype:attempted-recon; sid:200004530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rkgreany-seg3-2.kk.sopqa.arg.r.de.a2ip.ru",nocase; classtype:attempted-recon; sid:200004531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rkhotels.in",nocase; classtype:attempted-recon; sid:200004532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rleegreer.com",nocase; classtype:attempted-recon; sid:200004533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rlink.vn",nocase; classtype:attempted-recon; sid:200004534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rm-parcel11429-uk.com",nocase; classtype:attempted-recon; sid:200004535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rm-shippingprocess.com",nocase; classtype:attempted-recon; sid:200004536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rmsfcc.com",nocase; classtype:attempted-recon; sid:200004537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rmv.fb19421264.darona.ps",nocase; classtype:attempted-recon; sid:200004538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rmzengenharia.blogspot.com",nocase; classtype:attempted-recon; sid:200004539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rn3pc9bqfbv.typeform.com",nocase; classtype:attempted-recon; sid:200004540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rndom-vifd01.duckdns.org",nocase; classtype:attempted-recon; sid:200004541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roadgo.co.uk",nocase; classtype:attempted-recon; sid:200004542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roblox1231231.000webhostapp.com",nocase; classtype:attempted-recon; sid:200004543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"robloxaadg.000webhostapp.com",nocase; classtype:attempted-recon; sid:200004544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roccobonheur1-my-cheetah-website-copy.cheetah.builderall.com",nocase; classtype:attempted-recon; sid:200004545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rocketees.com",nocase; classtype:attempted-recon; sid:200004546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rocouaigiycsrueydjujronuaafrwncedmbuehht.yljxzx.cn",nocase; classtype:attempted-recon; sid:200004547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rodinagermaniya.ru",nocase; classtype:attempted-recon; sid:200004548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roisnoob.github.io",nocase; classtype:attempted-recon; sid:200004549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roitcou.hyperphp.com",nocase; classtype:attempted-recon; sid:200004550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rokutanm-ctmrrj.cc",nocase; classtype:attempted-recon; sid:200004551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rokutanm-rrbrb.cc",nocase; classtype:attempted-recon; sid:200004552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rolinadd.surveysparrow.com",nocase; classtype:attempted-recon; sid:200004553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"romatermit.ro",nocase; classtype:attempted-recon; sid:200004554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rondelbarrilito.com",nocase; classtype:attempted-recon; sid:200004555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roninupdate.com",nocase; classtype:attempted-recon; sid:200004556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rootburr.com",nocase; classtype:attempted-recon; sid:200004557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rosalinas-initial-project-30ac52.webflow.io",nocase; classtype:attempted-recon; sid:200004558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rotimi.pandaform.com",nocase; classtype:attempted-recon; sid:200004559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rotseezunft.ch.tcorner.fr",nocase; classtype:attempted-recon; sid:200004560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roundcube-production-cf.tx1.mailhostbox.com",nocase; classtype:attempted-recon; sid:200004561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roundtreeconsulting.net",nocase; classtype:attempted-recon; sid:200004562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roupakids.blogspot.com",nocase; classtype:attempted-recon; sid:200004563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"royal.fees-mail.com",nocase; classtype:attempted-recon; sid:200004564; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"royalpostcards.be",nocase; classtype:attempted-recon; sid:200004565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"royalwindsorpub.com",nocase; classtype:attempted-recon; sid:200004566; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rplg.co",nocase; classtype:attempted-recon; sid:200004567; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rreeufffsaussaa3.app.link",nocase; classtype:attempted-recon; sid:200004568; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rsdxpjtgqrzlacfootsbzolaqh-dot-gowa11111111.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200004569; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rseauxmobile01.ulcraft.com",nocase; classtype:attempted-recon; sid:200004570; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rstools.club",nocase; classtype:attempted-recon; sid:200004571; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rudraksha-rsudraksh-rudrakshabead-rudrakshabeads.com",nocase; classtype:attempted-recon; sid:200004572; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ruekrew.com",nocase; classtype:attempted-recon; sid:200004573; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"runescape-bond-event.com",nocase; classtype:attempted-recon; sid:200004574; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"runescape-bonds-event.com",nocase; classtype:attempted-recon; sid:200004575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"runescapeapk.com",nocase; classtype:attempted-recon; sid:200004576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"runescapeservices.com",nocase; classtype:attempted-recon; sid:200004577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"runni24.byethost7.com",nocase; classtype:attempted-recon; sid:200004578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"runningbrooks.top",nocase; classtype:attempted-recon; sid:200004579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rush.myvnc.com",nocase; classtype:attempted-recon; sid:200004580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"russianzimbragg.000webhostapp.com",nocase; classtype:attempted-recon; sid:200004581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rust-charge.com",nocase; classtype:attempted-recon; sid:200004582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rvices.runescape.com-m.ru",nocase; classtype:attempted-recon; sid:200004583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ryonstravel.com",nocase; classtype:attempted-recon; sid:200004584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s-paypalinfo.ml",nocase; classtype:attempted-recon; sid:200004585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s-sniffer.ru",nocase; classtype:attempted-recon; sid:200004586; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.codetasty.com",nocase; classtype:attempted-recon; sid:200004587; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.free.fr",nocase; classtype:attempted-recon; sid:200004588; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.kekk.is",nocase; classtype:attempted-recon; sid:200004589; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.luwank.com",nocase; classtype:attempted-recon; sid:200004590; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.runescape.com-ov.ru",nocase; classtype:attempted-recon; sid:200004591; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.yam.com",nocase; classtype:attempted-recon; sid:200004592; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s4flemon.z13.web.core.windows.net",nocase; classtype:attempted-recon; sid:200004593; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sa-www4-irs-gov-refund-irfof-wmsp.unaux.com",nocase; classtype:attempted-recon; sid:200004594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sa-www4-irs-gov.movementsinmotion.com",nocase; classtype:attempted-recon; sid:200004595; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"saatvikhomes.com",nocase; classtype:attempted-recon; sid:200004596; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sabaicabins.com",nocase; classtype:attempted-recon; sid:200004597; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"saborperuanomiami.com",nocase; classtype:attempted-recon; sid:200004598; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sabssyndicate.com.bd",nocase; classtype:attempted-recon; sid:200004599; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"saclamb.com",nocase; classtype:attempted-recon; sid:200004600; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sadervoyages.intnet.mu",nocase; classtype:attempted-recon; sid:200004601; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"safetyconsultantehs.com",nocase; classtype:attempted-recon; sid:200004602; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"safetyinformations.000webhostapp.com",nocase; classtype:attempted-recon; sid:200004603; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"safirbetgirisadresimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200004604; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"safirbetgiristikla.blogspot.com",nocase; classtype:attempted-recon; sid:200004605; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sahc892190jf19y83.yicori5768-t0ypy-yy.workers.dev",nocase; classtype:attempted-recon; sid:200004606; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sahyacollege.com",nocase; classtype:attempted-recon; sid:200004607; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"saibooksdemo.saitechnosolutions.net",nocase; classtype:attempted-recon; sid:200004608; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"said.servegame.com",nocase; classtype:attempted-recon; sid:200004609; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"saintbarkleyshoes.com",nocase; classtype:attempted-recon; sid:200004610; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sajkd12.blogspot.com",nocase; classtype:attempted-recon; sid:200004611; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"saldoshopeeepay.120k.join34.duckdns.org",nocase; classtype:attempted-recon; sid:200004612; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"saldospc.com",nocase; classtype:attempted-recon; sid:200004613; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"salmandawood.com",nocase; classtype:attempted-recon; sid:200004614; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"samaetio.com",nocase; classtype:attempted-recon; sid:200004615; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sambhullar.ca",nocase; classtype:attempted-recon; sid:200004616; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"samcool.org",nocase; classtype:attempted-recon; sid:200004617; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"samducksports.com",nocase; classtype:attempted-recon; sid:200004618; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"samircanel20.com",nocase; classtype:attempted-recon; sid:200004619; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"samnetakademi.com.tr",nocase; classtype:attempted-recon; sid:200004620; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"samo.st",nocase; classtype:attempted-recon; sid:200004621; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sampharm.uz",nocase; classtype:attempted-recon; sid:200004622; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"samvaadlife.com",nocase; classtype:attempted-recon; sid:200004623; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sanasunty.site",nocase; classtype:attempted-recon; sid:200004624; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sandboxww.top",nocase; classtype:attempted-recon; sid:200004625; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sandeeppk03.github.io",nocase; classtype:attempted-recon; sid:200004626; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sandiegooutdoorlivingca.com",nocase; classtype:attempted-recon; sid:200004627; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sangahqw1.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200004628; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sani3789.odns.fr",nocase; classtype:attempted-recon; sid:200004629; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sanjilkumar.com",nocase; classtype:attempted-recon; sid:200004630; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sanjosewebdeveloper.com",nocase; classtype:attempted-recon; sid:200004631; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sannittt.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200004632; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sanru.cd",nocase; classtype:attempted-recon; sid:200004633; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"santandaerbank.com",nocase; classtype:attempted-recon; sid:200004634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"santander-arriba.hostfree.pw",nocase; classtype:attempted-recon; sid:200004635; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"santander-way.myvnc.com",nocase; classtype:attempted-recon; sid:200004636; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"santanderpersonal.com",nocase; classtype:attempted-recon; sid:200004637; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"santanderpl.com",nocase; classtype:attempted-recon; sid:200004638; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"santanderusduyu.hostfree.pw",nocase; classtype:attempted-recon; sid:200004639; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"santandhsflgh.byethost8.com",nocase; classtype:attempted-recon; sid:200004640; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"santaninfover.byethost33.com",nocase; classtype:attempted-recon; sid:200004641; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"santtandeerrronl.byethost17.com",nocase; classtype:attempted-recon; sid:200004642; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"saranlar.com",nocase; classtype:attempted-recon; sid:200004643; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"saritapariyar.com.np",nocase; classtype:attempted-recon; sid:200004644; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"savingsfordentalcare.com",nocase; classtype:attempted-recon; sid:200004645; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sbcgloboooo.weebly.com",nocase; classtype:attempted-recon; sid:200004646; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sbemskanila.com",nocase; classtype:attempted-recon; sid:200004647; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sbi.mx",nocase; classtype:attempted-recon; sid:200004648; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sbpichinchaol.2host.in",nocase; classtype:attempted-recon; sid:200004649; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sc0714e7134.byethost11.com",nocase; classtype:attempted-recon; sid:200004650; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"scb9813h918fh9831821yh.pefecim563-oiuyt-oijh.workers.dev",nocase; classtype:attempted-recon; sid:200004651; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"scgrotto.org",nocase; classtype:attempted-recon; sid:200004652; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"schaaf.ch.net2care.com",nocase; classtype:attempted-recon; sid:200004653; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"schroffenstein.online.fr",nocase; classtype:attempted-recon; sid:200004654; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"schule-niederrohrdorf.ch",nocase; classtype:attempted-recon; sid:200004655; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"scomp00000.temp.swtest.ru",nocase; classtype:attempted-recon; sid:200004656; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sconsumer.e-pagos.cl",nocase; classtype:attempted-recon; sid:200004657; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"scooterarena.nl",nocase; classtype:attempted-recon; sid:200004658; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"scotiabank-yieldmorefinancing.ca",nocase; classtype:attempted-recon; sid:200004659; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"scouts.org.sv",nocase; classtype:attempted-recon; sid:200004660; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sd8sd88ds8sdf8sdf9sdfsdf9dfs0ds9dfs.s3.eu-west-1.amazonaws.com",nocase; classtype:attempted-recon; sid:200004661; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sdadadjewrjweudgjhxjsajshgjhcvnvveugticvbsdk.my-board.org",nocase; classtype:attempted-recon; sid:200004662; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sdsdfdsfddkgfkkgjhjhjljrhtrujvgg.my-board.org",nocase; classtype:attempted-recon; sid:200004663; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"se-connecter-au-webmail-la-poste--lapostenet0.yolasite.com",nocase; classtype:attempted-recon; sid:200004664; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seacoastsurgery.com",nocase; classtype:attempted-recon; sid:200004665; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seahoss.com",nocase; classtype:attempted-recon; sid:200004666; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seaportservicos.com.br",nocase; classtype:attempted-recon; sid:200004667; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"searchandco-origin.dev.tenpixls.com",nocase; classtype:attempted-recon; sid:200004668; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sebat-dhl.blogspot.com",nocase; classtype:attempted-recon; sid:200004669; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sebene27.github.io",nocase; classtype:attempted-recon; sid:200004670; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seceta.ro",nocase; classtype:attempted-recon; sid:200004671; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secret-group.duckdns.org",nocase; classtype:attempted-recon; sid:200004672; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secur-recovery-standardcommunity-identity.my.id",nocase; classtype:attempted-recon; sid:200004673; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-blogs.com",nocase; classtype:attempted-recon; sid:200004674; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-doc-sbcisd-net.tk",nocase; classtype:attempted-recon; sid:200004675; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-halifax-device.com",nocase; classtype:attempted-recon; sid:200004676; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-halifaxaccount.com",nocase; classtype:attempted-recon; sid:200004677; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-monitor.com",nocase; classtype:attempted-recon; sid:200004678; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-myaccountdetails.com",nocase; classtype:attempted-recon; sid:200004679; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-mynew-devices.com",nocase; classtype:attempted-recon; sid:200004680; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-mytransfer.com",nocase; classtype:attempted-recon; sid:200004681; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-onlinepayee.link",nocase; classtype:attempted-recon; sid:200004682; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-payeeremoval.com",nocase; classtype:attempted-recon; sid:200004683; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-runescape.xgm.rnp.mybluehost.me",nocase; classtype:attempted-recon; sid:200004684; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-ssl-cdn.com",nocase; classtype:attempted-recon; sid:200004685; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.bankofamerica.com-login-sign-in-signonv2screen.go.suzukihaiphong.com.vn",nocase; classtype:attempted-recon; sid:200004686; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.captisa.com",nocase; classtype:attempted-recon; sid:200004687; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.facebook.com.de.a2ip.ru",nocase; classtype:attempted-recon; sid:200004688; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.legalmetric.com",nocase; classtype:attempted-recon; sid:200004689; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.puandih.com",nocase; classtype:attempted-recon; sid:200004690; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.runescape.com-cn.ru",nocase; classtype:attempted-recon; sid:200004691; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.runescape.com-gb.ru",nocase; classtype:attempted-recon; sid:200004692; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.runescape.com-oc.ru",nocase; classtype:attempted-recon; sid:200004693; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.runescape.com-ro.ru",nocase; classtype:attempted-recon; sid:200004694; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.runescape.com-vc.ru",nocase; classtype:attempted-recon; sid:200004695; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.runescape.com-vzla.ru",nocase; classtype:attempted-recon; sid:200004696; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.runescapev.com",nocase; classtype:attempted-recon; sid:200004697; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.westernvasttrust.com",nocase; classtype:attempted-recon; sid:200004698; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure03r-chase.herokuapp.com",nocase; classtype:attempted-recon; sid:200004699; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure07id362321.duckdns.org",nocase; classtype:attempted-recon; sid:200004700; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure270.inmotionhosting.com",nocase; classtype:attempted-recon; sid:200004701; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure271.servconfig.com",nocase; classtype:attempted-recon; sid:200004702; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure279.inmotionhosting.com",nocase; classtype:attempted-recon; sid:200004703; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure285.inmotionhosting.com",nocase; classtype:attempted-recon; sid:200004704; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure290.inmotionhosting.com",nocase; classtype:attempted-recon; sid:200004705; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure300.inmotionhosting.com",nocase; classtype:attempted-recon; sid:200004706; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secured-mypayee.com",nocase; classtype:attempted-recon; sid:200004707; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securefaxing.knorish.com",nocase; classtype:attempted-recon; sid:200004708; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securefilefromyourcontact.macleayindoorsports.com.au",nocase; classtype:attempted-recon; sid:200004709; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securelloyd-help-app.com",nocase; classtype:attempted-recon; sid:200004710; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securemy-logindetails.com",nocase; classtype:attempted-recon; sid:200004711; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securesiteapp.com",nocase; classtype:attempted-recon; sid:200004712; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"security-mappl-information-account.piiquarry.com",nocase; classtype:attempted-recon; sid:200004713; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"security-page-community-standards.blogspot.com",nocase; classtype:attempted-recon; sid:200004714; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securitycode2021.hostfree.pw",nocase; classtype:attempted-recon; sid:200004715; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securityupdatereview-365online.com",nocase; classtype:attempted-recon; sid:200004716; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securty-supporrt.sun2seauvprotection.com.au",nocase; classtype:attempted-recon; sid:200004717; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secutityreport00.byethost16.com",nocase; classtype:attempted-recon; sid:200004718; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seenpichinchaot.2host.in",nocase; classtype:attempted-recon; sid:200004719; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seetheworldtravels.com.au",nocase; classtype:attempted-recon; sid:200004720; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sefvfesfewa.000webhostapp.com",nocase; classtype:attempted-recon; sid:200004721; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seguranca-online.byethost11.com",nocase; classtype:attempted-recon; sid:200004722; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"segurancaparavc.me",nocase; classtype:attempted-recon; sid:200004723; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seguraweb4646373.hostfree.pw",nocase; classtype:attempted-recon; sid:200004724; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seguridad27.byethost18.com",nocase; classtype:attempted-recon; sid:200004725; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seguridad89822.webcindario.com",nocase; classtype:attempted-recon; sid:200004726; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seguridadba.byethost6.com",nocase; classtype:attempted-recon; sid:200004727; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seguridadecuador.byethost17.com",nocase; classtype:attempted-recon; sid:200004728; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seguridadi0001.byethost3.com",nocase; classtype:attempted-recon; sid:200004729; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seguridprom82711.byethost13.com",nocase; classtype:attempted-recon; sid:200004730; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seguridprom82711.byethost6.com",nocase; classtype:attempted-recon; sid:200004731; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seguropichinchae.2host.in",nocase; classtype:attempted-recon; sid:200004732; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sekabetgiriss.blogspot.com",nocase; classtype:attempted-recon; sid:200004733; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sekabetgiriss1.blogspot.com",nocase; classtype:attempted-recon; sid:200004734; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sekabetgirissitemiz.blogspot.com",nocase; classtype:attempted-recon; sid:200004735; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"select.rw",nocase; classtype:attempted-recon; sid:200004736; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sellrego.com",nocase; classtype:attempted-recon; sid:200004737; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sem.my-drs.co.uk",nocase; classtype:attempted-recon; sid:200004738; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sen-manole.firebaseapp.com",nocase; classtype:attempted-recon; sid:200004739; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sendo-meso.firebaseapp.com",nocase; classtype:attempted-recon; sid:200004740; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sense.3utilities.com",nocase; classtype:attempted-recon; sid:200004741; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"senten.serveftp.com",nocase; classtype:attempted-recon; sid:200004742; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sentinelshowcase.com",nocase; classtype:attempted-recon; sid:200004743; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serene-shirley.13-93-165-215.plesk.page",nocase; classtype:attempted-recon; sid:200004744; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sergioporto.site",nocase; classtype:attempted-recon; sid:200004745; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serpost-pe-pay.com",nocase; classtype:attempted-recon; sid:200004746; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sertyxese.myfreesites.net",nocase; classtype:attempted-recon; sid:200004747; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serv-secured-1.com",nocase; classtype:attempted-recon; sid:200004748; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server-irs.cdn.gov.applicant-submission.com",nocase; classtype:attempted-recon; sid:200004749; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server-sparkasse.de",nocase; classtype:attempted-recon; sid:200004750; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server0012.byethost12.com",nocase; classtype:attempted-recon; sid:200004751; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"server003.byethost7.com",nocase; classtype:attempted-recon; sid:200004752; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serverexpres0013.byethost12.com",nocase; classtype:attempted-recon; sid:200004753; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servernuovaintesa.com",nocase; classtype:attempted-recon; sid:200004754; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serversonline.i.ng",nocase; classtype:attempted-recon; sid:200004755; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serverupdate.getforge.io",nocase; classtype:attempted-recon; sid:200004756; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servicabbout.blogspot.com",nocase; classtype:attempted-recon; sid:200004757; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"service-client00-my-cheetah-website.free.builderall.com",nocase; classtype:attempted-recon; sid:200004758; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"service-lkdn2020.gacconstrutora.com.br",nocase; classtype:attempted-recon; sid:200004759; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"service-mailsfr.yolasite.com",nocase; classtype:attempted-recon; sid:200004760; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serviceclient.site44.com",nocase; classtype:attempted-recon; sid:200004761; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servicecustumor.com",nocase; classtype:attempted-recon; sid:200004762; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services-leboncoin-paiement.com",nocase; classtype:attempted-recon; sid:200004763; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services-vodafone.com",nocase; classtype:attempted-recon; sid:200004764; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.com-ak.ru",nocase; classtype:attempted-recon; sid:200004765; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.com-m.cc",nocase; classtype:attempted-recon; sid:200004766; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.com-mss-forum.totalh.net",nocase; classtype:attempted-recon; sid:200004767; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.com-oc.ru",nocase; classtype:attempted-recon; sid:200004768; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.com-ro.ru",nocase; classtype:attempted-recon; sid:200004769; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.com-vc.ru",nocase; classtype:attempted-recon; sid:200004770; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.com-vzla.ru",nocase; classtype:attempted-recon; sid:200004771; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.com.rs-ds.xyz",nocase; classtype:attempted-recon; sid:200004772; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.rs-cx.xyz",nocase; classtype:attempted-recon; sid:200004773; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.rs-dd.xyz",nocase; classtype:attempted-recon; sid:200004774; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.rs-er.xyz",nocase; classtype:attempted-recon; sid:200004775; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.rs-gg.xyz",nocase; classtype:attempted-recon; sid:200004776; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.rs-ox.xyz",nocase; classtype:attempted-recon; sid:200004777; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.rs-se.xyz",nocase; classtype:attempted-recon; sid:200004778; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.rs-sx.xyz",nocase; classtype:attempted-recon; sid:200004779; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.rs-te.xyz",nocase; classtype:attempted-recon; sid:200004780; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"services.runescape.rs-yy.xyz",nocase; classtype:attempted-recon; sid:200004781; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servicesbanpichi.ihostfull.com",nocase; classtype:attempted-recon; sid:200004782; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servicesonline23.byethost7.com",nocase; classtype:attempted-recon; sid:200004783; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servicesorange.shop",nocase; classtype:attempted-recon; sid:200004784; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servicetermopanebucuresti.ro",nocase; classtype:attempted-recon; sid:200004785; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serviceupdateconfirmation.com",nocase; classtype:attempted-recon; sid:200004786; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serviciosbndigitales.com",nocase; classtype:attempted-recon; sid:200004787; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serviciosenlineasbn.com",nocase; classtype:attempted-recon; sid:200004788; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servidopichincha.byethost31.com",nocase; classtype:attempted-recon; sid:200004789; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servidor00006.byethost9.com",nocase; classtype:attempted-recon; sid:200004790; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servidor00016.byethost11.com",nocase; classtype:attempted-recon; sid:200004791; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servidor0010.byethost11.com",nocase; classtype:attempted-recon; sid:200004792; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"serviziapponline.com",nocase; classtype:attempted-recon; sid:200004793; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servlces.runescape.com-ov.ru",nocase; classtype:attempted-recon; sid:200004794; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servlices.runescape.com-ov.ru",nocase; classtype:attempted-recon; sid:200004795; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servweb.cf",nocase; classtype:attempted-recon; sid:200004796; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"setona.main.jp",nocase; classtype:attempted-recon; sid:200004797; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"settingsandprivacy.gq",nocase; classtype:attempted-recon; sid:200004798; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"settlementsclaimz.com",nocase; classtype:attempted-recon; sid:200004799; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"setupdirectory.com",nocase; classtype:attempted-recon; sid:200004800; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"setupmynorton.square.site",nocase; classtype:attempted-recon; sid:200004801; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sevoudryserviciobomail.dudaone.com",nocase; classtype:attempted-recon; sid:200004802; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sfr-espace-client.ru",nocase; classtype:attempted-recon; sid:200004803; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sfrpanel.lws.fr",nocase; classtype:attempted-recon; sid:200004804; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sftp.usin.com",nocase; classtype:attempted-recon; sid:200004805; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sg3plvwcpnl378889.prod.sin3.secureserver.net",nocase; classtype:attempted-recon; sid:200004806; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sgb-pageonline-original.com",nocase; classtype:attempted-recon; sid:200004807; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sgboxb.top",nocase; classtype:attempted-recon; sid:200004808; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sh199811.website.pl",nocase; classtype:attempted-recon; sid:200004809; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shadowpay.pp.ru",nocase; classtype:attempted-recon; sid:200004810; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shamajastore.co.ke",nocase; classtype:attempted-recon; sid:200004811; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shanayashoppy.com",nocase; classtype:attempted-recon; sid:200004812; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shanedrk.com",nocase; classtype:attempted-recon; sid:200004813; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shanestrailertraining.com",nocase; classtype:attempted-recon; sid:200004814; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"share-eu1.hsforms.com",nocase; classtype:attempted-recon; sid:200004815; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"share-relations.de",nocase; classtype:attempted-recon; sid:200004816; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"share.chamaileon.io",nocase; classtype:attempted-recon; sid:200004817; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sharefiles.app.link",nocase; classtype:attempted-recon; sid:200004818; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sharelink.sn.am",nocase; classtype:attempted-recon; sid:200004819; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shatzadcqpkkmxtinvqpwsakrm-dot-gowa11111111.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200004820; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shimamurakoutaro.com",nocase; classtype:attempted-recon; sid:200004821; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shop.prunescape.com.au",nocase; classtype:attempted-recon; sid:200004822; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shopee.khogiaodien247.com",nocase; classtype:attempted-recon; sid:200004823; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shortenlink.top",nocase; classtype:attempted-recon; sid:200004824; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shovalimyoqneam.co.il",nocase; classtype:attempted-recon; sid:200004825; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shtfrrty.com",nocase; classtype:attempted-recon; sid:200004826; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shtuchki.store",nocase; classtype:attempted-recon; sid:200004827; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shubhamskinclinic.in",nocase; classtype:attempted-recon; sid:200004828; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sicherheit-spk-psd2.de",nocase; classtype:attempted-recon; sid:200004829; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sicherheitsicherheits.de",nocase; classtype:attempted-recon; sid:200004830; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sicurezza-carte.it",nocase; classtype:attempted-recon; sid:200004831; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sicurr-mtb.com",nocase; classtype:attempted-recon; sid:200004832; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sicurty-login.com",nocase; classtype:attempted-recon; sid:200004833; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"siemik.github.io",nocase; classtype:attempted-recon; sid:200004834; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"signature-notes.com",nocase; classtype:attempted-recon; sid:200004835; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"signin-payeer.com",nocase; classtype:attempted-recon; sid:200004836; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"signin.ebay.de.whyymedia.com.au",nocase; classtype:attempted-recon; sid:200004837; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"signmaxxgh.com",nocase; classtype:attempted-recon; sid:200004838; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"signpainternyc.com",nocase; classtype:attempted-recon; sid:200004839; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"siida-disperindag.kalbarprov.go.id",nocase; classtype:attempted-recon; sid:200004840; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sikkertnabolag.dk",nocase; classtype:attempted-recon; sid:200004841; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"siklus.net",nocase; classtype:attempted-recon; sid:200004842; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sil2.duerr-haustechnik.de",nocase; classtype:attempted-recon; sid:200004843; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sillyabba.com",nocase; classtype:attempted-recon; sid:200004844; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simpledealers.com",nocase; classtype:attempted-recon; sid:200004845; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simplehostsetup.com",nocase; classtype:attempted-recon; sid:200004846; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simpletec.cl",nocase; classtype:attempted-recon; sid:200004847; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"singes.es",nocase; classtype:attempted-recon; sid:200004848; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sios.tech",nocase; classtype:attempted-recon; sid:200004849; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"siphen.com",nocase; classtype:attempted-recon; sid:200004850; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"siporados15585.blogspot.com",nocase; classtype:attempted-recon; sid:200004851; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sirak.se",nocase; classtype:attempted-recon; sid:200004852; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sirdarnell.org",nocase; classtype:attempted-recon; sid:200004853; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"site-4403463-3995-6112.mystrikingly.com",nocase; classtype:attempted-recon; sid:200004854; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"site9423623.92.webydo.com",nocase; classtype:attempted-recon; sid:200004855; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"site9423773.92.webydo.com",nocase; classtype:attempted-recon; sid:200004856; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"site9434107.92.webydo.com",nocase; classtype:attempted-recon; sid:200004857; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"site9548676.92.webydo.com",nocase; classtype:attempted-recon; sid:200004858; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"site9551459.92.webydo.com",nocase; classtype:attempted-recon; sid:200004859; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"site9552191.92.webydo.com",nocase; classtype:attempted-recon; sid:200004860; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"site9605282.92.webydo.com",nocase; classtype:attempted-recon; sid:200004861; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"site9605464.92.webydo.com",nocase; classtype:attempted-recon; sid:200004862; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sitebuilder130038.dynadot.com",nocase; classtype:attempted-recon; sid:200004863; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sitebuilder135844.dynadot.com",nocase; classtype:attempted-recon; sid:200004864; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sitebuilder138648.dynadot.com",nocase; classtype:attempted-recon; sid:200004865; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sitebuilder140489.dynadot.com",nocase; classtype:attempted-recon; sid:200004866; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites-mlb.basnodes.com",nocase; classtype:attempted-recon; sid:200004867; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"siteserversolutions.com",nocase; classtype:attempted-recon; sid:200004868; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"situs-facebook-resmi21.webnode.com",nocase; classtype:attempted-recon; sid:200004869; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"situs-pemulihan-resmi0.webnode.com",nocase; classtype:attempted-recon; sid:200004870; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sixlincolns.com",nocase; classtype:attempted-recon; sid:200004871; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sjsemi.com",nocase; classtype:attempted-recon; sid:200004872; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ski-dxb.com",nocase; classtype:attempted-recon; sid:200004873; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skillspro.net",nocase; classtype:attempted-recon; sid:200004874; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skinbarontow.ml",nocase; classtype:attempted-recon; sid:200004875; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skinpl.hostfree.pw",nocase; classtype:attempted-recon; sid:200004876; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skinprolp.hostfree.pw",nocase; classtype:attempted-recon; sid:200004877; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skinprolpler1.hostfree.pw",nocase; classtype:attempted-recon; sid:200004878; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skinprolpsv.hostfree.pw",nocase; classtype:attempted-recon; sid:200004879; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sklad-hub.ru",nocase; classtype:attempted-recon; sid:200004880; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sklepkody.pl",nocase; classtype:attempted-recon; sid:200004881; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skradvanidance.business.site",nocase; classtype:attempted-recon; sid:200004882; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"slapcoffee.com",nocase; classtype:attempted-recon; sid:200004883; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"slavamel.github.io",nocase; classtype:attempted-recon; sid:200004884; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sleepmaskz.com",nocase; classtype:attempted-recon; sid:200004885; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"slickparties.com",nocase; classtype:attempted-recon; sid:200004886; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"slmplenewforward.byethost31.com",nocase; classtype:attempted-recon; sid:200004887; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sloka.constantcontactsites.com",nocase; classtype:attempted-recon; sid:200004888; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"slotsno.com",nocase; classtype:attempted-recon; sid:200004889; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"slovenska-posta.co.sk.u1478897.cp.regruhosting.ru",nocase; classtype:attempted-recon; sid:200004890; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"slovenska-posta.sk.u1477485.cp.regruhosting.ru",nocase; classtype:attempted-recon; sid:200004891; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"slowlinebag.jp",nocase; classtype:attempted-recon; sid:200004892; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"slql.byethost7.com",nocase; classtype:attempted-recon; sid:200004893; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sm777.csb.app",nocase; classtype:attempted-recon; sid:200004894; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smail.youjiansxyddt.work",nocase; classtype:attempted-recon; sid:200004895; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smarteconomy.rs",nocase; classtype:attempted-recon; sid:200004896; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smartgos.com",nocase; classtype:attempted-recon; sid:200004897; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smartmco.com",nocase; classtype:attempted-recon; sid:200004898; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smartpage.lt",nocase; classtype:attempted-recon; sid:200004899; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smashpc.org",nocase; classtype:attempted-recon; sid:200004900; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc-carcl.com.s0djaz.cn",nocase; classtype:attempted-recon; sid:200004901; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc-cardvpass.cn",nocase; classtype:attempted-recon; sid:200004902; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc-jp.site",nocase; classtype:attempted-recon; sid:200004903; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.co.jp.rr04y2w.cn",nocase; classtype:attempted-recon; sid:200004904; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbc.cojp.supporrt.club",nocase; classtype:attempted-recon; sid:200004905; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbccojpsup.com",nocase; classtype:attempted-recon; sid:200004906; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbcsafecard.com",nocase; classtype:attempted-recon; sid:200004907; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbcwodeqingguoshoujicojp.top",nocase; classtype:attempted-recon; sid:200004908; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smbvccard-infio.top",nocase; classtype:attempted-recon; sid:200004909; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smcbc.careoed.com",nocase; classtype:attempted-recon; sid:200004910; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smdc-caed.cascrccrd.com",nocase; classtype:attempted-recon; sid:200004911; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smediaphotography.com",nocase; classtype:attempted-recon; sid:200004912; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smeo.org.mx",nocase; classtype:attempted-recon; sid:200004913; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smgolamalif.github.io",nocase; classtype:attempted-recon; sid:200004914; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smkkesehatanjember.sch.id",nocase; classtype:attempted-recon; sid:200004915; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smmsvocal.yolasite.com",nocase; classtype:attempted-recon; sid:200004916; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smnlkm.cyou",nocase; classtype:attempted-recon; sid:200004917; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sms-shorter.com",nocase; classtype:attempted-recon; sid:200004918; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smsenligne.myfreesites.net",nocase; classtype:attempted-recon; sid:200004919; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smsorangephonemail.myfreesites.net",nocase; classtype:attempted-recon; sid:200004920; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smsorangesmsmessage.myfreesites.net",nocase; classtype:attempted-recon; sid:200004921; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smss-mms.yolasite.com",nocase; classtype:attempted-recon; sid:200004922; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smsverificationmms.myfreesites.net",nocase; classtype:attempted-recon; sid:200004923; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"snajhyssssssssss.byethost31.com",nocase; classtype:attempted-recon; sid:200004924; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"snapchat.acccccount.com",nocase; classtype:attempted-recon; sid:200004925; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"snapchat.accounts.com.es",nocase; classtype:attempted-recon; sid:200004926; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sniperdz.com",nocase; classtype:attempted-recon; sid:200004927; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sniter.widyakartika.ac.id",nocase; classtype:attempted-recon; sid:200004928; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"snnbc-cardrs-kdmnc-com.skfhj.top",nocase; classtype:attempted-recon; sid:200004929; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"snnbo.co.jp.php27642323.quest",nocase; classtype:attempted-recon; sid:200004930; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"snprobbx.pbz.r.uk.a2ip.ru",nocase; classtype:attempted-recon; sid:200004931; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"snrsystem.com",nocase; classtype:attempted-recon; sid:200004932; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sntuyconfgurtion.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200004933; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sntuyconfir.byethost13.com",nocase; classtype:attempted-recon; sid:200004934; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"soaringskiesrentals.com",nocase; classtype:attempted-recon; sid:200004935; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sobisparkss-poser.blogspot.com",nocase; classtype:attempted-recon; sid:200004936; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"soci-molen.web.app",nocase; classtype:attempted-recon; sid:200004937; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"socialmediatraveler.com",nocase; classtype:attempted-recon; sid:200004938; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sockemdesign.com",nocase; classtype:attempted-recon; sid:200004939; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sofe-firma.firebaseapp.com",nocase; classtype:attempted-recon; sid:200004940; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"software.verify-secure.info",nocase; classtype:attempted-recon; sid:200004941; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"softwaremetrics.com",nocase; classtype:attempted-recon; sid:200004942; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"solarchampsllc.com",nocase; classtype:attempted-recon; sid:200004943; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"solicitarfirmaelectronica-sv.com",nocase; classtype:attempted-recon; sid:200004944; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"solitary-flower-7e0a.loginupdatemail.workers.dev",nocase; classtype:attempted-recon; sid:200004945; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"solutionfun.services",nocase; classtype:attempted-recon; sid:200004946; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"solutionsin-com-br.umbler.net",nocase; classtype:attempted-recon; sid:200004947; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"solyanayakomnata.ru",nocase; classtype:attempted-recon; sid:200004948; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sombc.careoed.com",nocase; classtype:attempted-recon; sid:200004949; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"somdcontractor.com",nocase; classtype:attempted-recon; sid:200004950; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"soneyamks.com",nocase; classtype:attempted-recon; sid:200004951; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sonne-medoon.firebaseapp.com",nocase; classtype:attempted-recon; sid:200004952; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sonofabridge.com.net2care.com",nocase; classtype:attempted-recon; sid:200004953; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sopac.org.py",nocase; classtype:attempted-recon; sid:200004954; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sorowhite53.byethost6.com",nocase; classtype:attempted-recon; sid:200004955; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sotly.me",nocase; classtype:attempted-recon; sid:200004956; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"souaxwaoh.myfreesites.net",nocase; classtype:attempted-recon; sid:200004957; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"soude-masi.firebaseapp.com",nocase; classtype:attempted-recon; sid:200004958; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sounprofessional.com",nocase; classtype:attempted-recon; sid:200004959; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"southport-farm-holidays.co.uk",nocase; classtype:attempted-recon; sid:200004960; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"souvenirsplace.com",nocase; classtype:attempted-recon; sid:200004961; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"soysodimac.estudiarfacil.com",nocase; classtype:attempted-recon; sid:200004962; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sp477389.sitebeat.site",nocase; classtype:attempted-recon; sid:200004963; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sp701876.sitebeat.site",nocase; classtype:attempted-recon; sid:200004964; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spa-carte-sicurezza.com",nocase; classtype:attempted-recon; sid:200004965; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spaacing-particule.ml",nocase; classtype:attempted-recon; sid:200004966; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spacecamp.in",nocase; classtype:attempted-recon; sid:200004967; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparka-einloggen-sicher.xyz",nocase; classtype:attempted-recon; sid:200004968; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparka-einloggen2021.xyz",nocase; classtype:attempted-recon; sid:200004969; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparka-kundenr1235234.xyz",nocase; classtype:attempted-recon; sid:200004970; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparka-kundenr5234234.xyz",nocase; classtype:attempted-recon; sid:200004971; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparka-kundenr5324523.xyz",nocase; classtype:attempted-recon; sid:200004972; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparka-kundenr56423.xyz",nocase; classtype:attempted-recon; sid:200004973; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparka-pushtan.de",nocase; classtype:attempted-recon; sid:200004974; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparka-sicher-einloggen-2021.xyz",nocase; classtype:attempted-recon; sid:200004975; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparka-sicheres-einloggen-2021.xyz",nocase; classtype:attempted-recon; sid:200004976; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparka-sicherheit-2021.xyz",nocase; classtype:attempted-recon; sid:200004977; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparka-sicherheit-einloggen.xyz",nocase; classtype:attempted-recon; sid:200004978; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparka-sicherheit-sicher.xyz",nocase; classtype:attempted-recon; sid:200004979; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse-1129.de",nocase; classtype:attempted-recon; sid:200004980; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse-aktualisierung83.com",nocase; classtype:attempted-recon; sid:200004981; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse-hannover.work",nocase; classtype:attempted-recon; sid:200004982; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse-kundenbetreuung.de",nocase; classtype:attempted-recon; sid:200004983; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse-newsystem.com",nocase; classtype:attempted-recon; sid:200004984; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse-push.de",nocase; classtype:attempted-recon; sid:200004985; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse-pushwartung.de",nocase; classtype:attempted-recon; sid:200004986; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse-scert-web.com",nocase; classtype:attempted-recon; sid:200004987; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse-scertsystem.com",nocase; classtype:attempted-recon; sid:200004988; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse-sicherheitshinweise.com",nocase; classtype:attempted-recon; sid:200004989; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse-spush.com",nocase; classtype:attempted-recon; sid:200004990; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse-system92.com",nocase; classtype:attempted-recon; sid:200004991; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse-tan.top",nocase; classtype:attempted-recon; sid:200004992; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse-updatesystem-web.com",nocase; classtype:attempted-recon; sid:200004993; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse-verfahren.com",nocase; classtype:attempted-recon; sid:200004994; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse.tan-verfahren-spk.com",nocase; classtype:attempted-recon; sid:200004995; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkassen-verifikationen.com",nocase; classtype:attempted-recon; sid:200004996; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparxinteriors.co.zw",nocase; classtype:attempted-recon; sid:200004997; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spectralwirejewelry.com",nocase; classtype:attempted-recon; sid:200004998; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spectrumstorageaccess.yahoosites.com",nocase; classtype:attempted-recon; sid:200004999; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"speedylogisticsllc.com",nocase; classtype:attempted-recon; sid:200005000; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spektrumchile.cl",nocase; classtype:attempted-recon; sid:200005001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spentamultimedia.com",nocase; classtype:attempted-recon; sid:200005002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spia-indonesia.org",nocase; classtype:attempted-recon; sid:200005003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spidertvapp.com",nocase; classtype:attempted-recon; sid:200005004; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spinosacenter.com",nocase; classtype:attempted-recon; sid:200005005; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spiritotarsogno.com",nocase; classtype:attempted-recon; sid:200005006; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-datenbank-spk.com",nocase; classtype:attempted-recon; sid:200005007; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-easycomfort.top",nocase; classtype:attempted-recon; sid:200005008; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-filiale.com",nocase; classtype:attempted-recon; sid:200005009; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-mail-service5.xyz",nocase; classtype:attempted-recon; sid:200005010; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-service-web.xyz",nocase; classtype:attempted-recon; sid:200005011; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-tan.top",nocase; classtype:attempted-recon; sid:200005012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk-tanverfahren.de",nocase; classtype:attempted-recon; sid:200005013; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spk.so",nocase; classtype:attempted-recon; sid:200005014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spkitem7.life",nocase; classtype:attempted-recon; sid:200005015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sponsorlens.cs.umn.edu",nocase; classtype:attempted-recon; sid:200005016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spontan.ch.net2care.com",nocase; classtype:attempted-recon; sid:200005017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spotify-home.com",nocase; classtype:attempted-recon; sid:200005018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spotlfy-subscribe.com",nocase; classtype:attempted-recon; sid:200005019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spp2.gratishosting.cl",nocase; classtype:attempted-recon; sid:200005020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spprtfc.000webhostapp.com",nocase; classtype:attempted-recon; sid:200005021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spreje.eu",nocase; classtype:attempted-recon; sid:200005022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spring-pond-62c4.autocreative.workers.dev#eimaste@stinpriza.org",nocase; classtype:attempted-recon; sid:200005023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spropes-auntmillies-com.slite.com",nocase; classtype:attempted-recon; sid:200005024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sprtcnicomicrsf.byethost17.com",nocase; classtype:attempted-recon; sid:200005025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"squadiae.com",nocase; classtype:attempted-recon; sid:200005026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"squardiae.com",nocase; classtype:attempted-recon; sid:200005027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"squarii.com",nocase; classtype:attempted-recon; sid:200005028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"srfgzdsfh4ergdsfg.agilecrm.com",nocase; classtype:attempted-recon; sid:200005029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"srilakshmiengg.com",nocase; classtype:attempted-recon; sid:200005030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"srnbc-card.com.d23782.cn",nocase; classtype:attempted-recon; sid:200005031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"srnbc-card.com.spqsp.cn",nocase; classtype:attempted-recon; sid:200005032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ssia.org.sg",nocase; classtype:attempted-recon; sid:200005033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ssl-cloud-r.s4-cloud980-0.workers.dev",nocase; classtype:attempted-recon; sid:200005034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ssmanlawam.com",nocase; classtype:attempted-recon; sid:200005035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sso-garena-vi.com",nocase; classtype:attempted-recon; sid:200005036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sso-garena-vn.com",nocase; classtype:attempted-recon; sid:200005037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ssrw.org",nocase; classtype:attempted-recon; sid:200005038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ssur.cc",nocase; classtype:attempted-recon; sid:200005039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ssvvt06bon.byethost8.com",nocase; classtype:attempted-recon; sid:200005040; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sswebmail-4w5twsr.web.app",nocase; classtype:attempted-recon; sid:200005041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"staging.rutascotiabank.resermap.com",nocase; classtype:attempted-recon; sid:200005042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stargiveaway.com",nocase; classtype:attempted-recon; sid:200005043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starlangsb.com",nocase; classtype:attempted-recon; sid:200005044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starliker.net",nocase; classtype:attempted-recon; sid:200005045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starlingbankplc.com",nocase; classtype:attempted-recon; sid:200005046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starmak.com.tr",nocase; classtype:attempted-recon; sid:200005047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starp2.com",nocase; classtype:attempted-recon; sid:200005048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starsoftheindustry.com",nocase; classtype:attempted-recon; sid:200005049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"startseite-verden.de",nocase; classtype:attempted-recon; sid:200005050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starttsboxfile.myfreesites.net",nocase; classtype:attempted-recon; sid:200005051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stateagencybe.tumblr.com",nocase; classtype:attempted-recon; sid:200005052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stateboy.top",nocase; classtype:attempted-recon; sid:200005053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"static-ak-fbcdn.atspace.com",nocase; classtype:attempted-recon; sid:200005054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"staticmemoriesphotography.ca",nocase; classtype:attempted-recon; sid:200005055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"status-track-dispatch.com",nocase; classtype:attempted-recon; sid:200005056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stcroixlofts.com",nocase; classtype:attempted-recon; sid:200005057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"steam-discords.com",nocase; classtype:attempted-recon; sid:200005058; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"steamcommynitu.com",nocase; classtype:attempted-recon; sid:200005059; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"steamcomunity.net.ru",nocase; classtype:attempted-recon; sid:200005060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"steamproxy.net",nocase; classtype:attempted-recon; sid:200005061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"steannconnunity.com",nocase; classtype:attempted-recon; sid:200005062; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"steemcommunity.aiq.ru",nocase; classtype:attempted-recon; sid:200005063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stendec.it",nocase; classtype:attempted-recon; sid:200005064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stevemaddenshoe.net",nocase; classtype:attempted-recon; sid:200005065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stevemaddensneakersrea.com",nocase; classtype:attempted-recon; sid:200005066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stevemaddenstivali.com",nocase; classtype:attempted-recon; sid:200005067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stevemadderomania.co",nocase; classtype:attempted-recon; sid:200005068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"steven-coldwellbth9965.web.app",nocase; classtype:attempted-recon; sid:200005069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stevencrews.com",nocase; classtype:attempted-recon; sid:200005070; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stewarts-stupendous-project-ee8707.webflow.io",nocase; classtype:attempted-recon; sid:200005071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stimulus-claim.com",nocase; classtype:attempted-recon; sid:200005072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stkynu.club",nocase; classtype:attempted-recon; sid:200005073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stolizaparketa.ru",nocase; classtype:attempted-recon; sid:200005074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"store.prunescape.com.au",nocase; classtype:attempted-recon; sid:200005075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"streamlightmotionmedia.com",nocase; classtype:attempted-recon; sid:200005076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stretchbuilder.com",nocase; classtype:attempted-recon; sid:200005077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stricttragedy.info",nocase; classtype:attempted-recon; sid:200005078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sts-onetime073737823-auth879304804394-encrypted798320939.s3.ap-southeast-2.amazonaws.com",nocase; classtype:attempted-recon; sid:200005079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"students2science.org",nocase; classtype:attempted-recon; sid:200005080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stunninggate.com",nocase; classtype:attempted-recon; sid:200005081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stylesbyaranda.com",nocase; classtype:attempted-recon; sid:200005082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stylifehomedecors.com",nocase; classtype:attempted-recon; sid:200005083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sub4sub.co",nocase; classtype:attempted-recon; sid:200005084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"subdomainnet1.byethost13.com",nocase; classtype:attempted-recon; sid:200005085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"subtitlesdb.com",nocase; classtype:attempted-recon; sid:200005086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"successgroup.org",nocase; classtype:attempted-recon; sid:200005087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"succvirtl.com",nocase; classtype:attempted-recon; sid:200005088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sucure-dcsonc.ml",nocase; classtype:attempted-recon; sid:200005089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sucure-doc-dcsonc.ga",nocase; classtype:attempted-recon; sid:200005090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sucursalenlineacr.com",nocase; classtype:attempted-recon; sid:200005091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sucursalpersona-stransaccionesbancolombia.com",nocase; classtype:attempted-recon; sid:200005092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sucursalpersona1.2host.me",nocase; classtype:attempted-recon; sid:200005093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sucursapersonastransacionebancolombiaccomn.small-business-solutions.biz",nocase; classtype:attempted-recon; sid:200005094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sucuvirtcolba.com",nocase; classtype:attempted-recon; sid:200005095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sudamshelar.in",nocase; classtype:attempted-recon; sid:200005096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sudaworks.com",nocase; classtype:attempted-recon; sid:200005097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suelunn.com",nocase; classtype:attempted-recon; sid:200005098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suisspost-tracking.com.ch.u1450107.cp.regruhosting.ru",nocase; classtype:attempted-recon; sid:200005099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suitsandfits.com.pk",nocase; classtype:attempted-recon; sid:200005100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suivi-cod2823999023.com",nocase; classtype:attempted-recon; sid:200005101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sultanbetgirisadresimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200005102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sultanbetgirisadresimiz1.blogspot.com",nocase; classtype:attempted-recon; sid:200005103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suminetconfir.hostfree.pw",nocase; classtype:attempted-recon; sid:200005104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sunbeltmembers.com",nocase; classtype:attempted-recon; sid:200005105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suncoastcreditunion.balancepro.org",nocase; classtype:attempted-recon; sid:200005106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sunge-ode.firebaseapp.com",nocase; classtype:attempted-recon; sid:200005107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sunmarkholidays.com",nocase; classtype:attempted-recon; sid:200005108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sunsetslushdupage.com",nocase; classtype:attempted-recon; sid:200005109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"supaserious.com",nocase; classtype:attempted-recon; sid:200005110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"supcuttfree.byethost7.com",nocase; classtype:attempted-recon; sid:200005111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"superbahisgir12.blogspot.com",nocase; classtype:attempted-recon; sid:200005112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"superbahisgir2.blogspot.com",nocase; classtype:attempted-recon; sid:200005113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"superbahisgirisadresimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200005114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"superbahisgirisadresimiz3.blogspot.com",nocase; classtype:attempted-recon; sid:200005115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"superbahisim1.blogspot.com",nocase; classtype:attempted-recon; sid:200005116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"superbiography.com",nocase; classtype:attempted-recon; sid:200005117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"supermilhas.com",nocase; classtype:attempted-recon; sid:200005118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"supernet-santa-1.hostfree.pw",nocase; classtype:attempted-recon; sid:200005119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"supernettsd-worl.byethost22.com",nocase; classtype:attempted-recon; sid:200005120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"supernetx.byethost32.com",nocase; classtype:attempted-recon; sid:200005121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"supersantderft.byethost14.com",nocase; classtype:attempted-recon; sid:200005122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"supersantlogg.22web.org",nocase; classtype:attempted-recon; sid:200005123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"supersexytrends.com",nocase; classtype:attempted-recon; sid:200005124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suplementoforca.bioextratus.com.br",nocase; classtype:attempted-recon; sid:200005125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suportecxacesso2020.com",nocase; classtype:attempted-recon; sid:200005126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suports-identiity-notification-secur-recovery.my.id",nocase; classtype:attempted-recon; sid:200005127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suports-identity-notiification-secur-recovery.my.id",nocase; classtype:attempted-recon; sid:200005128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suportsupernet.hostfree.pw",nocase; classtype:attempted-recon; sid:200005129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suportts-notification-idntity-secur-recover.my.id",nocase; classtype:attempted-recon; sid:200005130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suppliers.bitshepherd.org",nocase; classtype:attempted-recon; sid:200005131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"support-att.com",nocase; classtype:attempted-recon; sid:200005132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"support-security.paypal.com.komamen.com",nocase; classtype:attempted-recon; sid:200005133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"support-verify-my-newpayments.com",nocase; classtype:attempted-recon; sid:200005134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"support-verify-mydevices.com",nocase; classtype:attempted-recon; sid:200005135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"support.streamsteam.ca",nocase; classtype:attempted-recon; sid:200005136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"supportwhatsapp.com",nocase; classtype:attempted-recon; sid:200005137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"supremenet4555.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200005138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sur-vey.ru",nocase; classtype:attempted-recon; sid:200005139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surface.ddnsking.com",nocase; classtype:attempted-recon; sid:200005140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"susanlynnepeters.com",nocase; classtype:attempted-recon; sid:200005141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suspedpromericsv.hostfree.pw",nocase; classtype:attempted-recon; sid:200005142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sustech.cc",nocase; classtype:attempted-recon; sid:200005143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suupernett.byethost4.com",nocase; classtype:attempted-recon; sid:200005144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"suuupeernet.byethost7.com",nocase; classtype:attempted-recon; sid:200005145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sv.mikecrm.com",nocase; classtype:attempted-recon; sid:200005146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"svca.info",nocase; classtype:attempted-recon; sid:200005147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"svcohotmail.weebly.com",nocase; classtype:attempted-recon; sid:200005148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"svelte-kdy6dk.stackblitz.io",nocase; classtype:attempted-recon; sid:200005149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"svetikc.space",nocase; classtype:attempted-recon; sid:200005150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"svr-casloginsfrmail.ulanding.me",nocase; classtype:attempted-recon; sid:200005151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"svri-my-mtb.com",nocase; classtype:attempted-recon; sid:200005152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swap.elena.finance",nocase; classtype:attempted-recon; sid:200005153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swappauto.staging.lcsolutions.it",nocase; classtype:attempted-recon; sid:200005154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swickard-goo.gq",nocase; classtype:attempted-recon; sid:200005155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swickard-or.tk",nocase; classtype:attempted-recon; sid:200005156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swisscom.myfreesites.net",nocase; classtype:attempted-recon; sid:200005157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swisspost-delivering-parcel.trowelandfork.com",nocase; classtype:attempted-recon; sid:200005158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swisspost.info-versand.com",nocase; classtype:attempted-recon; sid:200005159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swisstelecom.info",nocase; classtype:attempted-recon; sid:200005160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"synaxisreadymix.com",nocase; classtype:attempted-recon; sid:200005161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"synergica.no",nocase; classtype:attempted-recon; sid:200005162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"synoxpigments.com.br",nocase; classtype:attempted-recon; sid:200005163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"syromalabarbrisbanesouth.org.au",nocase; classtype:attempted-recon; sid:200005164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"systenver-coban.byethost7.com",nocase; classtype:attempted-recon; sid:200005165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t-online-de.net",nocase; classtype:attempted-recon; sid:200005166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.mails.total.direct-energie.com",nocase; classtype:attempted-recon; sid:200005167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.mktla.com",nocase; classtype:attempted-recon; sid:200005168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t3t23tgewy34y53uw5hrsj5uu467547435324253tgwtw4t4wtwyw.zvmflqkp7j-ypj680je54l2.p.runcloud.link",nocase; classtype:attempted-recon; sid:200005169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t9y.me",nocase; classtype:attempted-recon; sid:200005170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"taalim.ma",nocase; classtype:attempted-recon; sid:200005171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tabaccheriadelborgo.net",nocase; classtype:attempted-recon; sid:200005172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tabitapeixoto.com",nocase; classtype:attempted-recon; sid:200005173; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tabloided.com",nocase; classtype:attempted-recon; sid:200005174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tadriib.com",nocase; classtype:attempted-recon; sid:200005175; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"taengball.co",nocase; classtype:attempted-recon; sid:200005176; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"taher-mohamed-ahmed-saad.github.io",nocase; classtype:attempted-recon; sid:200005177; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"taijishentie.com",nocase; classtype:attempted-recon; sid:200005178; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"taimitaivas.fi",nocase; classtype:attempted-recon; sid:200005179; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"taiwokupolatiandco.com",nocase; classtype:attempted-recon; sid:200005180; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"takbyte-stockholm.se",nocase; classtype:attempted-recon; sid:200005181; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"takingnote.learningmatters.tv",nocase; classtype:attempted-recon; sid:200005182; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"takmengapa.com",nocase; classtype:attempted-recon; sid:200005183; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"taljliwjbqcxgkwkaubudzoivu-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200005184; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"talkingdogsmobile.com",nocase; classtype:attempted-recon; sid:200005185; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tamilnadutourstravels.com",nocase; classtype:attempted-recon; sid:200005186; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tamkein.com",nocase; classtype:attempted-recon; sid:200005187; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tanbo.main.jp",nocase; classtype:attempted-recon; sid:200005188; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tantelinaviral21.duckdns.org",nocase; classtype:attempted-recon; sid:200005189; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"targetcareer.co.in",nocase; classtype:attempted-recon; sid:200005190; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tarik-fitness.com",nocase; classtype:attempted-recon; sid:200005191; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"taumiq.com",nocase; classtype:attempted-recon; sid:200005192; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"taxopus.com",nocase; classtype:attempted-recon; sid:200005193; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tb915hdh89.mfs.gg",nocase; classtype:attempted-recon; sid:200005194; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tbositescapecompany.com",nocase; classtype:attempted-recon; sid:200005195; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tby.eb-sites.com",nocase; classtype:attempted-recon; sid:200005196; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tcaa.com.hk",nocase; classtype:attempted-recon; sid:200005197; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tcaconnect.ac-page.com",nocase; classtype:attempted-recon; sid:200005198; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tcfcompanystore.com",nocase; classtype:attempted-recon; sid:200005199; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tcpipserver.net",nocase; classtype:attempted-recon; sid:200005200; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tdtdghd-hdhhdgj-bdbbdj-9g27u.ondigitalocean.app",nocase; classtype:attempted-recon; sid:200005201; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"teamfatbird.com",nocase; classtype:attempted-recon; sid:200005202; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"teamgoogle125590.psee.ly",nocase; classtype:attempted-recon; sid:200005203; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"teammetapp.azurefd.net",nocase; classtype:attempted-recon; sid:200005204; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"teamshared.net.ru",nocase; classtype:attempted-recon; sid:200005205; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"teamsuport.github.io",nocase; classtype:attempted-recon; sid:200005206; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tecflex.com.br",nocase; classtype:attempted-recon; sid:200005207; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tech4guru.com",nocase; classtype:attempted-recon; sid:200005208; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"techdirectbh.com",nocase; classtype:attempted-recon; sid:200005209; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"techfela.win",nocase; classtype:attempted-recon; sid:200005210; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"techservic001.byethost11.com",nocase; classtype:attempted-recon; sid:200005211; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tecnocerberus.cl",nocase; classtype:attempted-recon; sid:200005212; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tecnominproductos.com",nocase; classtype:attempted-recon; sid:200005213; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"teengamersnetwork.com",nocase; classtype:attempted-recon; sid:200005214; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"teeverse.in",nocase; classtype:attempted-recon; sid:200005215; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"teibertandassociates.com",nocase; classtype:attempted-recon; sid:200005216; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"telaitaucardryco.000webhostapp.com",nocase; classtype:attempted-recon; sid:200005217; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"telekom.mydisplayer.stream",nocase; classtype:attempted-recon; sid:200005218; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"telexaempresa.com",nocase; classtype:attempted-recon; sid:200005219; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tellmeliu.github.io",nocase; classtype:attempted-recon; sid:200005220; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tempatpinjamuang.co.id",nocase; classtype:attempted-recon; sid:200005221; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"templat65sldh.myfreesites.net",nocase; classtype:attempted-recon; sid:200005222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"temporary-url.com",nocase; classtype:attempted-recon; sid:200005223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tenisclubemc.com.br",nocase; classtype:attempted-recon; sid:200005224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"termerosapepe.it",nocase; classtype:attempted-recon; sid:200005225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"terpelsicumple.com",nocase; classtype:attempted-recon; sid:200005226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"terri2.gitlab.io",nocase; classtype:attempted-recon; sid:200005227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tervem.hu",nocase; classtype:attempted-recon; sid:200005228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"test.arintek.ru",nocase; classtype:attempted-recon; sid:200005229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"test.bayoucitybadges.org",nocase; classtype:attempted-recon; sid:200005230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"test.cin.ba",nocase; classtype:attempted-recon; sid:200005231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"test.dxbproductions.com",nocase; classtype:attempted-recon; sid:200005232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"test.mediaclock.com.au",nocase; classtype:attempted-recon; sid:200005233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"test.prunescape.com.au",nocase; classtype:attempted-recon; sid:200005234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"test.srit.ac.in",nocase; classtype:attempted-recon; sid:200005235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"test.teacrew.team",nocase; classtype:attempted-recon; sid:200005236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"test.webclient4.de",nocase; classtype:attempted-recon; sid:200005237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"test1.cognizantdev.com",nocase; classtype:attempted-recon; sid:200005238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"teste.listafood.com.br",nocase; classtype:attempted-recon; sid:200005239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"testingfortt-aj.com",nocase; classtype:attempted-recon; sid:200005240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"testjob.epizy.com",nocase; classtype:attempted-recon; sid:200005241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"texasfreedomrun.com",nocase; classtype:attempted-recon; sid:200005242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tg.pe",nocase; classtype:attempted-recon; sid:200005243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tgbhyu.hyperphp.com",nocase; classtype:attempted-recon; sid:200005244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thdud-2536.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200005245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"the56ression.ru",nocase; classtype:attempted-recon; sid:200005246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"theaceofspaeder.com",nocase; classtype:attempted-recon; sid:200005247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thebaseng.com",nocase; classtype:attempted-recon; sid:200005248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thebeachleague.com",nocase; classtype:attempted-recon; sid:200005249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thebusinessprofitsystem.com",nocase; classtype:attempted-recon; sid:200005250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thechillipicklecanteen.com",nocase; classtype:attempted-recon; sid:200005251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"theculturewire.com",nocase; classtype:attempted-recon; sid:200005252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thedigitaltimes.com",nocase; classtype:attempted-recon; sid:200005253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thedscomputers.com",nocase; classtype:attempted-recon; sid:200005254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"theduecfoinv.com",nocase; classtype:attempted-recon; sid:200005255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"theepic.in",nocase; classtype:attempted-recon; sid:200005256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thefarmmanagers.com",nocase; classtype:attempted-recon; sid:200005257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thefeelingwhole.com",nocase; classtype:attempted-recon; sid:200005258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thefishbowlltd.com",nocase; classtype:attempted-recon; sid:200005259; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thefocaltherapyfoundation.org",nocase; classtype:attempted-recon; sid:200005260; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thegraph.rewardtoken.info",nocase; classtype:attempted-recon; sid:200005261; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thehotelmart.com",nocase; classtype:attempted-recon; sid:200005262; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thekingsandqueens.in",nocase; classtype:attempted-recon; sid:200005263; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thelocalgamers.com",nocase; classtype:attempted-recon; sid:200005264; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thelyonsfamilyden.com",nocase; classtype:attempted-recon; sid:200005265; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"themarketingdream.com",nocase; classtype:attempted-recon; sid:200005266; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"themebird.com",nocase; classtype:attempted-recon; sid:200005267; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"themes.xclusivethemes.com",nocase; classtype:attempted-recon; sid:200005268; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"themkdiaries.com",nocase; classtype:attempted-recon; sid:200005269; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"themyams.com",nocase; classtype:attempted-recon; sid:200005270; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thenine9.com",nocase; classtype:attempted-recon; sid:200005271; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"theone-lotto.com",nocase; classtype:attempted-recon; sid:200005272; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thepaperdesign.com",nocase; classtype:attempted-recon; sid:200005273; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"therockacc.org",nocase; classtype:attempted-recon; sid:200005274; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thescrapescape.com",nocase; classtype:attempted-recon; sid:200005275; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"theswiftstitch.com",nocase; classtype:attempted-recon; sid:200005276; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thetrafficbar.com",nocase; classtype:attempted-recon; sid:200005277; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"theultimatelistener.com",nocase; classtype:attempted-recon; sid:200005278; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"theumashow.com",nocase; classtype:attempted-recon; sid:200005279; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thhththtgggbb.000webhostapp.com",nocase; classtype:attempted-recon; sid:200005280; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"things.serveirc.com",nocase; classtype:attempted-recon; sid:200005281; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thirsty-kepler-5b96ca.netlify.app",nocase; classtype:attempted-recon; sid:200005282; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"three-retail-live.devicetradein.co.uk",nocase; classtype:attempted-recon; sid:200005283; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thucphamlytuong.vn",nocase; classtype:attempted-recon; sid:200005284; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tighi.creatorlink.net",nocase; classtype:attempted-recon; sid:200005285; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tikiimage.devotedcreations.com",nocase; classtype:attempted-recon; sid:200005286; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tiktok-ticket.ru",nocase; classtype:attempted-recon; sid:200005287; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tilama.suermax.de",nocase; classtype:attempted-recon; sid:200005288; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"timeenigma.com#ggradnigo@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200005289; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinavegaphotography.com",nocase; classtype:attempted-recon; sid:200005290; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinify.ir",nocase; classtype:attempted-recon; sid:200005291; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyl.uk",nocase; classtype:attempted-recon; sid:200005292; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tisisa.com",nocase; classtype:attempted-recon; sid:200005293; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"titelinedrillingintl.yolasite.com",nocase; classtype:attempted-recon; sid:200005294; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tkx29.codesandbox.io",nocase; classtype:attempted-recon; sid:200005295; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tlatx.com",nocase; classtype:attempted-recon; sid:200005296; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tlorfplqnrrstiopkvgmarjwyp-dot-gowa11111111.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200005297; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tlzwyjwiygqyjvtwrzhykkjmkp-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200005298; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tm55trk.com",nocase; classtype:attempted-recon; sid:200005299; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tmimpex.pk",nocase; classtype:attempted-recon; sid:200005300; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tmphysio.de",nocase; classtype:attempted-recon; sid:200005301; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tng84.hyperphp.com",nocase; classtype:attempted-recon; sid:200005302; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"to-ken.biz",nocase; classtype:attempted-recon; sid:200005303; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"to.to",nocase; classtype:attempted-recon; sid:200005304; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"toancaupumps.com",nocase; classtype:attempted-recon; sid:200005305; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"toanhoc247.edu.vn",nocase; classtype:attempted-recon; sid:200005306; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"toddler-town.com",nocase; classtype:attempted-recon; sid:200005307; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"todosprodutos.com.br",nocase; classtype:attempted-recon; sid:200005308; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"toitedundefined.info",nocase; classtype:attempted-recon; sid:200005309; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tokullarmobilya.com",nocase; classtype:attempted-recon; sid:200005310; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tomori22.my.id",nocase; classtype:attempted-recon; sid:200005311; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tomsweb.xyz",nocase; classtype:attempted-recon; sid:200005312; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tool.3utilities.com",nocase; classtype:attempted-recon; sid:200005313; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tooljerejin.airsite.co",nocase; classtype:attempted-recon; sid:200005314; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"top10songsnews.com",nocase; classtype:attempted-recon; sid:200005315; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"top20bonus.com",nocase; classtype:attempted-recon; sid:200005316; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"top30colombiapp.com",nocase; classtype:attempted-recon; sid:200005317; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"topclassicrockvids.com",nocase; classtype:attempted-recon; sid:200005318; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"topskills.ru",nocase; classtype:attempted-recon; sid:200005319; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"topup-freefire999.duckdns.org",nocase; classtype:attempted-recon; sid:200005320; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"torrinwine.com",nocase; classtype:attempted-recon; sid:200005321; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"total.direct-energie.com",nocase; classtype:attempted-recon; sid:200005322; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tow1.photoclub-ebroicien.fr",nocase; classtype:attempted-recon; sid:200005323; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tpnm.info",nocase; classtype:attempted-recon; sid:200005324; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tpq74.codesandbox.io",nocase; classtype:attempted-recon; sid:200005325; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tpservices.runescape.com-nu.ru",nocase; classtype:attempted-recon; sid:200005326; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"track.drerries.com",nocase; classtype:attempted-recon; sid:200005327; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tracking.gobelets.info",nocase; classtype:attempted-recon; sid:200005328; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"trade-offers.link",nocase; classtype:attempted-recon; sid:200005329; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"traderstruth.biz",nocase; classtype:attempted-recon; sid:200005330; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tradeswarehouse.com",nocase; classtype:attempted-recon; sid:200005331; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"trafitoloquera.byethost33.com",nocase; classtype:attempted-recon; sid:200005332; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"trams.mot.go.th",nocase; classtype:attempted-recon; sid:200005333; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"trangnapthelienquan.com",nocase; classtype:attempted-recon; sid:200005334; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"transferenciasinternacionalesseguridadbnet.000webhostapp.com",nocase; classtype:attempted-recon; sid:200005335; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"transferpricing.firs.gov.ng",nocase; classtype:attempted-recon; sid:200005336; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"transit-e.com",nocase; classtype:attempted-recon; sid:200005337; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"transmancomplain.com",nocase; classtype:attempted-recon; sid:200005338; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"transmancomplain.net",nocase; classtype:attempted-recon; sid:200005339; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"travelingislifetours.com",nocase; classtype:attempted-recon; sid:200005340; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"travelzeed.com",nocase; classtype:attempted-recon; sid:200005341; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"travosh.com",nocase; classtype:attempted-recon; sid:200005342; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"travpayments.com",nocase; classtype:attempted-recon; sid:200005343; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"trelock.com",nocase; classtype:attempted-recon; sid:200005344; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"treqin.com",nocase; classtype:attempted-recon; sid:200005345; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"triathlonindia.com",nocase; classtype:attempted-recon; sid:200005346; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tricitiesguardian.com",nocase; classtype:attempted-recon; sid:200005347; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"triggermarketing.biz",nocase; classtype:attempted-recon; sid:200005348; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"trilles157.typeform.com",nocase; classtype:attempted-recon; sid:200005349; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"trk.fjenterprisemarketinginc.com",nocase; classtype:attempted-recon; sid:200005350; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"truckcalling.com",nocase; classtype:attempted-recon; sid:200005351; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"trucktrader.com.my",nocase; classtype:attempted-recon; sid:200005352; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"true-fish.ru",nocase; classtype:attempted-recon; sid:200005353; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"true.ddnsking.com",nocase; classtype:attempted-recon; sid:200005354; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"trueperson.remsend.com",nocase; classtype:attempted-recon; sid:200005355; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ts.hust.edu.vn",nocase; classtype:attempted-recon; sid:200005356; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tsallagti.ru",nocase; classtype:attempted-recon; sid:200005357; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tsecure-paxful.com",nocase; classtype:attempted-recon; sid:200005358; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tsojkzeiyukvolziurnjijjbzc-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200005359; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tsuzuki.co.id",nocase; classtype:attempted-recon; sid:200005360; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ttsqyr.classsizecounts.com",nocase; classtype:attempted-recon; sid:200005361; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tubepchiunuoc.com",nocase; classtype:attempted-recon; sid:200005362; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tudosobretudo.blog.br",nocase; classtype:attempted-recon; sid:200005363; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tupa90192.byethost7.com",nocase; classtype:attempted-recon; sid:200005364; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"turawa-ostoja.pl",nocase; classtype:attempted-recon; sid:200005365; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"turbantours.com",nocase; classtype:attempted-recon; sid:200005366; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"turboflightpros.com",nocase; classtype:attempted-recon; sid:200005367; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tuyntdxc.cf",nocase; classtype:attempted-recon; sid:200005368; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tuyntdxc.ga",nocase; classtype:attempted-recon; sid:200005369; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tuyntdxc.gq",nocase; classtype:attempted-recon; sid:200005370; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tuyntdxc.ml",nocase; classtype:attempted-recon; sid:200005371; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tvbdtkfqotcdcwquhqbyxhpeiv-dot-gowa11111111.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200005372; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"twitteranalytis.com",nocase; classtype:attempted-recon; sid:200005373; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"twowheelcool.com",nocase; classtype:attempted-recon; sid:200005374; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tx.vc",nocase; classtype:attempted-recon; sid:200005375; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"typesmartlyocr.com",nocase; classtype:attempted-recon; sid:200005376; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tyrecentre.ru",nocase; classtype:attempted-recon; sid:200005377; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tyzwox.webwave.dev",nocase; classtype:attempted-recon; sid:200005378; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u.japanrakutenfill.ga",nocase; classtype:attempted-recon; sid:200005379; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u.jprakutenfill.ml",nocase; classtype:attempted-recon; sid:200005380; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u.jprankutenpart.ga",nocase; classtype:attempted-recon; sid:200005381; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u.jprankutenpartdo.ml",nocase; classtype:attempted-recon; sid:200005382; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u.rakuten-win.cf",nocase; classtype:attempted-recon; sid:200005383; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u08qv44zu5h.typeform.com",nocase; classtype:attempted-recon; sid:200005384; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u12458371pj.ha004.t.justns.ru",nocase; classtype:attempted-recon; sid:200005385; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u1409685.cp.regruhosting.ru",nocase; classtype:attempted-recon; sid:200005386; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u22983419.ct.sendgrid.net",nocase; classtype:attempted-recon; sid:200005387; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u443456b3l.ha004.t.justns.ru",nocase; classtype:attempted-recon; sid:200005388; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u4ifw.csb.app",nocase; classtype:attempted-recon; sid:200005389; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u8tny.skipdns.link",nocase; classtype:attempted-recon; sid:200005390; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ubee.co.kr",nocase; classtype:attempted-recon; sid:200005391; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uber-order.pl-id77923350.xyz",nocase; classtype:attempted-recon; sid:200005392; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uberinquiry.anubbe.com.mx",nocase; classtype:attempted-recon; sid:200005393; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ublcsp.com",nocase; classtype:attempted-recon; sid:200005394; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ubw.9e7.myftpupload.com",nocase; classtype:attempted-recon; sid:200005395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ucek-up.000webhostapp.com",nocase; classtype:attempted-recon; sid:200005396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ucgverse.com",nocase; classtype:attempted-recon; sid:200005397; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ueditme.com",nocase; classtype:attempted-recon; sid:200005398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ufbk.jp.mkdinue.club",nocase; classtype:attempted-recon; sid:200005399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ufbk.jp.mkdinue.co",nocase; classtype:attempted-recon; sid:200005400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ufbk.jp.mkdinue.jp",nocase; classtype:attempted-recon; sid:200005401; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ufbk.jp.mkinuejr.club",nocase; classtype:attempted-recon; sid:200005402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uglcsonfonia.org",nocase; classtype:attempted-recon; sid:200005403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uguett.hyperphp.com",nocase; classtype:attempted-recon; sid:200005404; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uisbfsd.tk",nocase; classtype:attempted-recon; sid:200005405; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ujs612.activehosted.com",nocase; classtype:attempted-recon; sid:200005406; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uk-security9238.com",nocase; classtype:attempted-recon; sid:200005407; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uk0qx.codesandbox.io",nocase; classtype:attempted-recon; sid:200005408; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ukcare.in",nocase; classtype:attempted-recon; sid:200005409; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ukpostal-delivery.com",nocase; classtype:attempted-recon; sid:200005410; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ukpostal-fee.com",nocase; classtype:attempted-recon; sid:200005411; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ukresidential-servicesupport.com",nocase; classtype:attempted-recon; sid:200005412; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ulronn16yc8vpyedbtqfjghnrrjrpnjed9mdzzjuqbekzxhaqx.chenyunong.top",nocase; classtype:attempted-recon; sid:200005413; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ultimatecbdclub.com",nocase; classtype:attempted-recon; sid:200005414; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ultimatemotors.co.ke",nocase; classtype:attempted-recon; sid:200005415; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ultimateseguri9.ultimatefreehost.in",nocase; classtype:attempted-recon; sid:200005416; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"umbrellaclubla.com",nocase; classtype:attempted-recon; sid:200005417; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ummatamima.buet.ac.bd",nocase; classtype:attempted-recon; sid:200005418; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"umu.link",nocase; classtype:attempted-recon; sid:200005419; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"umzap.com",nocase; classtype:attempted-recon; sid:200005420; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"un9d1h3qbs9.typeform.com",nocase; classtype:attempted-recon; sid:200005421; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unacontinuaevoluzione.accesscam.org",nocase; classtype:attempted-recon; sid:200005422; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unam.myfreesites.net",nocase; classtype:attempted-recon; sid:200005423; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unauthorised-login-attempt872.com",nocase; classtype:attempted-recon; sid:200005424; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unauthoriserecentdevice.com",nocase; classtype:attempted-recon; sid:200005425; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unclelouie.com",nocase; classtype:attempted-recon; sid:200005426; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"undefinedbiopiracy.info",nocase; classtype:attempted-recon; sid:200005427; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"underdodrat.info",nocase; classtype:attempted-recon; sid:200005428; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unemploymentcenter.info",nocase; classtype:attempted-recon; sid:200005429; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unfairworkaustralia.com.au",nocase; classtype:attempted-recon; sid:200005430; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uni0nbnkoffphsavign.serveuser.com",nocase; classtype:attempted-recon; sid:200005431; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unify.appbox.biz",nocase; classtype:attempted-recon; sid:200005432; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unimaisfm.com.br",nocase; classtype:attempted-recon; sid:200005433; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unimentperu.uniment.org",nocase; classtype:attempted-recon; sid:200005434; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unionheightsresidental.com",nocase; classtype:attempted-recon; sid:200005435; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unisonsouthayr.org.uk",nocase; classtype:attempted-recon; sid:200005436; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap-app.ielement.io",nocase; classtype:attempted-recon; sid:200005437; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap.ch",nocase; classtype:attempted-recon; sid:200005438; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap.deals",nocase; classtype:attempted-recon; sid:200005439; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap.openwallet.dev",nocase; classtype:attempted-recon; sid:200005440; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap.pages.dev",nocase; classtype:attempted-recon; sid:200005441; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap.seal.finance",nocase; classtype:attempted-recon; sid:200005442; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap.token.im",nocase; classtype:attempted-recon; sid:200005443; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap.trading",nocase; classtype:attempted-recon; sid:200005444; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap.tw",nocase; classtype:attempted-recon; sid:200005445; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswap.vn",nocase; classtype:attempted-recon; sid:200005446; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniswapeth.net",nocase; classtype:attempted-recon; sid:200005447; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitus.mk.ua",nocase; classtype:attempted-recon; sid:200005448; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unlimitepharmacy.com",nocase; classtype:attempted-recon; sid:200005449; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unlock-suspension.com",nocase; classtype:attempted-recon; sid:200005450; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unm4sk-pt2.localserver.net",nocase; classtype:attempted-recon; sid:200005451; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unregister-device-seclloyd.com",nocase; classtype:attempted-recon; sid:200005452; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unregpayee-lb.com",nocase; classtype:attempted-recon; sid:200005453; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unsightlyirresponsibleerror.sugurit.repl.co",nocase; classtype:attempted-recon; sid:200005454; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"update-1.mailfirewal.repl.co",nocase; classtype:attempted-recon; sid:200005455; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"update-account-instagram.idigitalzone.com",nocase; classtype:attempted-recon; sid:200005456; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"update-cyxhjas23qjhk.de",nocase; classtype:attempted-recon; sid:200005457; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"update-officeinfo.finecashflow.com",nocase; classtype:attempted-recon; sid:200005458; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"update365online-secure.com",nocase; classtype:attempted-recon; sid:200005459; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"updatemysantan.com",nocase; classtype:attempted-recon; sid:200005460; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"updateseason.com",nocase; classtype:attempted-recon; sid:200005461; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"updatevoda-billing.com",nocase; classtype:attempted-recon; sid:200005462; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"updted-access.demopage.co",nocase; classtype:attempted-recon; sid:200005463; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"upgrade-25gb-email.alfaoneinfotech.net",nocase; classtype:attempted-recon; sid:200005464; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"upgrade-25gb-email.thecornerstudio.com.au",nocase; classtype:attempted-recon; sid:200005465; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ups-onlinetracking.myastship.info",nocase; classtype:attempted-recon; sid:200005466; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urbannetw45ork.ru",nocase; classtype:attempted-recon; sid:200005467; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urbenorte.com",nocase; classtype:attempted-recon; sid:200005468; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urgent-halifaxlogin.com",nocase; classtype:attempted-recon; sid:200005469; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlday.cc",nocase; classtype:attempted-recon; sid:200005470; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlme.cc",nocase; classtype:attempted-recon; sid:200005471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlth.me",nocase; classtype:attempted-recon; sid:200005472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urusartuyu.byethost7.com",nocase; classtype:attempted-recon; sid:200005473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"usaerrtyhui.blogspot.com",nocase; classtype:attempted-recon; sid:200005474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"usdtmarkets.com",nocase; classtype:attempted-recon; sid:200005475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"user-restore.com",nocase; classtype:attempted-recon; sid:200005476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"userreport01.byethost16.com",nocase; classtype:attempted-recon; sid:200005477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"users.tpg.com.au",nocase; classtype:attempted-recon; sid:200005478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"usps-delivery-support.logitel.com.au",nocase; classtype:attempted-recon; sid:200005479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"usps-tax-payment-track-id-928183921.logitel.com.au",nocase; classtype:attempted-recon; sid:200005480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"usr.eaglecaravansaustralia.com.au",nocase; classtype:attempted-recon; sid:200005481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"utilizzamps.com",nocase; classtype:attempted-recon; sid:200005482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uuid-validation.run-us-west2.goorm.io",nocase; classtype:attempted-recon; sid:200005483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uuqcd6jmtq.stat-pulse.com",nocase; classtype:attempted-recon; sid:200005484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uuuadoiy.gq",nocase; classtype:attempted-recon; sid:200005485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uuuadoiy.ml",nocase; classtype:attempted-recon; sid:200005486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uvar.uno",nocase; classtype:attempted-recon; sid:200005487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uyafd.tk",nocase; classtype:attempted-recon; sid:200005488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uytg.hyperphp.com",nocase; classtype:attempted-recon; sid:200005489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uzaqztk7ovr.typeform.com",nocase; classtype:attempted-recon; sid:200005490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"v.sys-mhlw.ga",nocase; classtype:attempted-recon; sid:200005491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"v.sys-mhlw.gq",nocase; classtype:attempted-recon; sid:200005492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"v.sys-mhlw.ml",nocase; classtype:attempted-recon; sid:200005493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"v.sys-mhlwgo.cf",nocase; classtype:attempted-recon; sid:200005494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"v.sys-mhlwgo.ga",nocase; classtype:attempted-recon; sid:200005495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"v.sys-mhlwgo.gq",nocase; classtype:attempted-recon; sid:200005496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"v2pancakeswap.info",nocase; classtype:attempted-recon; sid:200005497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"v7cf.gratishosting.cl",nocase; classtype:attempted-recon; sid:200005498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"v7zrh.codesandbox.io",nocase; classtype:attempted-recon; sid:200005499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vaikis.eu",nocase; classtype:attempted-recon; sid:200005500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vakifiadem.b-cdn.net",nocase; classtype:attempted-recon; sid:200005501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"valenteplay.com.br",nocase; classtype:attempted-recon; sid:200005502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"validacaixa2.blob.core.windows.net",nocase; classtype:attempted-recon; sid:200005503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"validate-onlinesecurity.com",nocase; classtype:attempted-recon; sid:200005504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"validation-newpayee.com",nocase; classtype:attempted-recon; sid:200005505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"validationsystem.creatorlink.net",nocase; classtype:attempted-recon; sid:200005506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"validtion-accts131sd.ml",nocase; classtype:attempted-recon; sid:200005507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"valocsfunes.ga",nocase; classtype:attempted-recon; sid:200005508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vanmarckegroup-my.sharepoint.com",nocase; classtype:attempted-recon; sid:200005509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vanvleetfamilyfarm.com",nocase; classtype:attempted-recon; sid:200005510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vaoas.cc",nocase; classtype:attempted-recon; sid:200005511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vassallo.com.ar",nocase; classtype:attempted-recon; sid:200005512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vcpjo.weblium.site",nocase; classtype:attempted-recon; sid:200005513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vechainthorconnects.net",nocase; classtype:attempted-recon; sid:200005514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vegas-x.net",nocase; classtype:attempted-recon; sid:200005515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vegemil.vn",nocase; classtype:attempted-recon; sid:200005516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vehicam.com",nocase; classtype:attempted-recon; sid:200005517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"veja-pl.com",nocase; classtype:attempted-recon; sid:200005518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"velvish.com",nocase; classtype:attempted-recon; sid:200005519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vendorcmdecport.vzpla.net",nocase; classtype:attempted-recon; sid:200005520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ventspin.com",nocase; classtype:attempted-recon; sid:200005521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verfication.verifyuser.ru",nocase; classtype:attempted-recon; sid:200005522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verfiz.me",nocase; classtype:attempted-recon; sid:200005523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verifica-titolare-mpsdispositivo.com",nocase; classtype:attempted-recon; sid:200005524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verificar-7482376.vzpla.net",nocase; classtype:attempted-recon; sid:200005525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verification-orange0.yolasite.com",nocase; classtype:attempted-recon; sid:200005526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verification.page.home.support.app-netflix.com.mavhcodigital.com",nocase; classtype:attempted-recon; sid:200005527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verificationmessage.blob.core.windows.net",nocase; classtype:attempted-recon; sid:200005528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verifikasi-akun-anda0011.weeblysite.com",nocase; classtype:attempted-recon; sid:200005529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verifikasi-akun-facebook0022.weeblysite.com",nocase; classtype:attempted-recon; sid:200005530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verifikasi-identitas-co-id24.webnode.com",nocase; classtype:attempted-recon; sid:200005531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verifiyedbluetickfeedback.ml",nocase; classtype:attempted-recon; sid:200005532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verify.chase.billing.info.igualdad.cl",nocase; classtype:attempted-recon; sid:200005533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verify.paypal-help-service.com",nocase; classtype:attempted-recon; sid:200005534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verify.session-id.com",nocase; classtype:attempted-recon; sid:200005535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verifyamazon.xxuz.com",nocase; classtype:attempted-recon; sid:200005536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verifymytransfer.com",nocase; classtype:attempted-recon; sid:200005537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verifywell-85477.web.app",nocase; classtype:attempted-recon; sid:200005538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verifyyourinfo.thebasketballfactoryinc.com",nocase; classtype:attempted-recon; sid:200005539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verikasi-account2021.weebly.com",nocase; classtype:attempted-recon; sid:200005540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vermmtb.com",nocase; classtype:attempted-recon; sid:200005541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verzeichnisse.creatorlink.net",nocase; classtype:attempted-recon; sid:200005542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vestacommercialinc.com",nocase; classtype:attempted-recon; sid:200005543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahis211.blogspot.com",nocase; classtype:attempted-recon; sid:200005544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahisbet.blogspot.com",nocase; classtype:attempted-recon; sid:200005545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahisgirissite.blogspot.com",nocase; classtype:attempted-recon; sid:200005546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahisgunceladres.blogspot.com",nocase; classtype:attempted-recon; sid:200005547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahisimgir.blogspot.com",nocase; classtype:attempted-recon; sid:200005548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahiss.blogspot.com",nocase; classtype:attempted-recon; sid:200005549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahiss1.blogspot.com",nocase; classtype:attempted-recon; sid:200005550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahissgir.blogspot.com",nocase; classtype:attempted-recon; sid:200005551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahissguncel.blogspot.com",nocase; classtype:attempted-recon; sid:200005552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevobahsgirisim.blogspot.com",nocase; classtype:attempted-recon; sid:200005553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vevoobahis.blogspot.com",nocase; classtype:attempted-recon; sid:200005554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vfr1.22web.org",nocase; classtype:attempted-recon; sid:200005555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vhs.link",nocase; classtype:attempted-recon; sid:200005556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"viabcp-seguro.xyz",nocase; classtype:attempted-recon; sid:200005557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vibrant-perlman.23-94-190-112.plesk.page",nocase; classtype:attempted-recon; sid:200005558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vices.eu",nocase; classtype:attempted-recon; sid:200005559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"victorarath99.github.io",nocase; classtype:attempted-recon; sid:200005560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vidco.dotcompal.co",nocase; classtype:attempted-recon; sid:200005561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"videobigo.com",nocase; classtype:attempted-recon; sid:200005562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"videowatchviral.blogspot.com",nocase; classtype:attempted-recon; sid:200005563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vidio-12.duckdns.org",nocase; classtype:attempted-recon; sid:200005564; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vidmova.xyz",nocase; classtype:attempted-recon; sid:200005565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vietschi.de",nocase; classtype:attempted-recon; sid:200005566; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"viettel-com-dot-c2c01-531c7.uc.r.appspot.com",nocase; classtype:attempted-recon; sid:200005567; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vikingwear.com",nocase; classtype:attempted-recon; sid:200005568; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vilanovacenter.com",nocase; classtype:attempted-recon; sid:200005569; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vinahay.com",nocase; classtype:attempted-recon; sid:200005570; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vincicash.com",nocase; classtype:attempted-recon; sid:200005571; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vipbillspaymentcenternegosyo.com",nocase; classtype:attempted-recon; sid:200005572; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vipfbtools.com",nocase; classtype:attempted-recon; sid:200005573; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"virii-my-mtb.com",nocase; classtype:attempted-recon; sid:200005574; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"virtual1dattss.com",nocase; classtype:attempted-recon; sid:200005575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"virtuarbnc.000webhostapp.com",nocase; classtype:attempted-recon; sid:200005576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vis-stort.github.io",nocase; classtype:attempted-recon; sid:200005577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"visadpsgiftcard.com",nocase; classtype:attempted-recon; sid:200005578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"visawingsoverseas.com",nocase; classtype:attempted-recon; sid:200005579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vishwakrupasteelindustries.com",nocase; classtype:attempted-recon; sid:200005580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"visione.co.id",nocase; classtype:attempted-recon; sid:200005581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"visualspider.top",nocase; classtype:attempted-recon; sid:200005582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"viuii.cn",nocase; classtype:attempted-recon; sid:200005583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vivaanadventure.com",nocase; classtype:attempted-recon; sid:200005584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vivocrm.ru",nocase; classtype:attempted-recon; sid:200005585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk-coolsgirl.ru",nocase; classtype:attempted-recon; sid:200005586; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk-dreamsgirls.ru",nocase; classtype:attempted-recon; sid:200005587; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.wtf",nocase; classtype:attempted-recon; sid:200005588; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vlces.runescape.com-oa.ru",nocase; classtype:attempted-recon; sid:200005589; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vmi454420.contaboserver.net",nocase; classtype:attempted-recon; sid:200005590; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vmospi111.freecluster.eu",nocase; classtype:attempted-recon; sid:200005591; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vocal-esp.yolasite.com",nocase; classtype:attempted-recon; sid:200005592; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vocalcoachingbysloane.com",nocase; classtype:attempted-recon; sid:200005593; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"voda-services.com",nocase; classtype:attempted-recon; sid:200005594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vodafone.bill1820.com",nocase; classtype:attempted-recon; sid:200005595; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vodafonenotice.com",nocase; classtype:attempted-recon; sid:200005596; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vodaupdatepayment.com",nocase; classtype:attempted-recon; sid:200005597; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vodrenelmi.temp.swtest.ru",nocase; classtype:attempted-recon; sid:200005598; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"voed.ru",nocase; classtype:attempted-recon; sid:200005599; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"voincesae.com",nocase; classtype:attempted-recon; sid:200005600; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"voiture.in",nocase; classtype:attempted-recon; sid:200005601; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"volvocarskc.us1.list-manage.com",nocase; classtype:attempted-recon; sid:200005602; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"votre-messagerie-vocale-orange30.yolasite.com",nocase; classtype:attempted-recon; sid:200005603; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"votre.service.client.forfait.orange.mobile.travelforever.co.uk",nocase; classtype:attempted-recon; sid:200005604; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"votrec0nsultationonlineboxclient.company.site",nocase; classtype:attempted-recon; sid:200005605; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"votreservi.temp.swtest.ru",nocase; classtype:attempted-recon; sid:200005606; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vozdeangola.com",nocase; classtype:attempted-recon; sid:200005607; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vpapara.com",nocase; classtype:attempted-recon; sid:200005608; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vps41123.inmotionhosting.com",nocase; classtype:attempted-recon; sid:200005609; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vqfeglpgsyvybmxptlirriqqvn-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200005610; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vqs.org.au",nocase; classtype:attempted-recon; sid:200005611; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vrbankingg.me",nocase; classtype:attempted-recon; sid:200005612; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vrbe.in",nocase; classtype:attempted-recon; sid:200005613; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vt3pa0.webwave.dev",nocase; classtype:attempted-recon; sid:200005614; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vtennis.vn",nocase; classtype:attempted-recon; sid:200005615; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vtxmail2018.myfreesites.net",nocase; classtype:attempted-recon; sid:200005616; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vurl.bz",nocase; classtype:attempted-recon; sid:200005617; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vvpees-me-index.chskkh.cn",nocase; classtype:attempted-recon; sid:200005618; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vvpees-me-index.glqfr40.cn",nocase; classtype:attempted-recon; sid:200005619; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vvpees-me-index.gsy8nvc.cn",nocase; classtype:attempted-recon; sid:200005620; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vvpees-me-index.hw31g0.cn",nocase; classtype:attempted-recon; sid:200005621; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vvpees-me-index.hyvdjuo.cn",nocase; classtype:attempted-recon; sid:200005622; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vvpees-me-index.j5vz2e0.cn",nocase; classtype:attempted-recon; sid:200005623; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vvpees-me-index.jedsorr.cn",nocase; classtype:attempted-recon; sid:200005624; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vvpees-me-index.jsekzbo.cn",nocase; classtype:attempted-recon; sid:200005625; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vvpees-me-index.khtllo.cn",nocase; classtype:attempted-recon; sid:200005626; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vvpees-me-index.kq3i0u4.cn",nocase; classtype:attempted-recon; sid:200005627; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vvpees-me-index.la0adf.cn",nocase; classtype:attempted-recon; sid:200005628; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vvpees-me-index.lk3nid.cn",nocase; classtype:attempted-recon; sid:200005629; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vvpees-me-index.lpwsv6.cn",nocase; classtype:attempted-recon; sid:200005630; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vwbank.inforia.net",nocase; classtype:attempted-recon; sid:200005631; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vwvvbcpi-zonasegura.com",nocase; classtype:attempted-recon; sid:200005632; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vwwviabcp.solicitudalnstante1.com",nocase; classtype:attempted-recon; sid:200005633; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vxdse.myfreesites.net",nocase; classtype:attempted-recon; sid:200005634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vxmu688484.byethost7.com",nocase; classtype:attempted-recon; sid:200005635; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vyixwx.webwave.dev",nocase; classtype:attempted-recon; sid:200005636; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vzrew.creatorlink.net",nocase; classtype:attempted-recon; sid:200005637; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vzuywafijlrpvnjtzqxkbnjoif-dot-gowa11111111.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200005638; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"w01292112a.000webhostapp.com",nocase; classtype:attempted-recon; sid:200005639; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"w2.deraya.org",nocase; classtype:attempted-recon; sid:200005640; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"w2fshop.com.br",nocase; classtype:attempted-recon; sid:200005641; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"w352883-www.fnweb.no",nocase; classtype:attempted-recon; sid:200005642; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"w352885-www.fnweb.no",nocase; classtype:attempted-recon; sid:200005643; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"w3max.com",nocase; classtype:attempted-recon; sid:200005644; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"w5czf.csb.app",nocase; classtype:attempted-recon; sid:200005645; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"w6634s.webwave.dev",nocase; classtype:attempted-recon; sid:200005646; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"w915f.achievementeffort.xyz",nocase; classtype:attempted-recon; sid:200005647; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"w915f.honestyfavorite.xyz",nocase; classtype:attempted-recon; sid:200005648; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"w915f.significantparalysis.xyz",nocase; classtype:attempted-recon; sid:200005649; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wa-grupdewasa2021.duckdns.org",nocase; classtype:attempted-recon; sid:200005650; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wagrupnotnot8.duckdns.org",nocase; classtype:attempted-recon; sid:200005651; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wahed-koudsi2001.github.io",nocase; classtype:attempted-recon; sid:200005652; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"waisterase.com",nocase; classtype:attempted-recon; sid:200005653; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wallawallaguardian.com",nocase; classtype:attempted-recon; sid:200005654; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"walldesign.com.tr",nocase; classtype:attempted-recon; sid:200005655; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wallectconnect.co",nocase; classtype:attempted-recon; sid:200005656; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wallet-mymanero.com",nocase; classtype:attempted-recon; sid:200005657; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wallet-steam.ml",nocase; classtype:attempted-recon; sid:200005658; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wallets-synchronise.com",nocase; classtype:attempted-recon; sid:200005659; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"walletsweblink.com",nocase; classtype:attempted-recon; sid:200005660; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"walletupdating.com",nocase; classtype:attempted-recon; sid:200005661; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"walletxcons.com",nocase; classtype:attempted-recon; sid:200005662; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wana78420.myfreesites.net",nocase; classtype:attempted-recon; sid:200005663; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wapiae.com.ar",nocase; classtype:attempted-recon; sid:200005664; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"warmbuyer.xyz",nocase; classtype:attempted-recon; sid:200005665; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"warningshadows.org",nocase; classtype:attempted-recon; sid:200005666; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"warpromerica.byethost33.com",nocase; classtype:attempted-recon; sid:200005667; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"warsa.bandungkab.go.id",nocase; classtype:attempted-recon; sid:200005668; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wasimiw940.temp.swtest.ru",nocase; classtype:attempted-recon; sid:200005669; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"watan99.com",nocase; classtype:attempted-recon; sid:200005670; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"watchlove.michaelkorsoutlet2u.cn",nocase; classtype:attempted-recon; sid:200005671; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"watermelonineasterhay.com",nocase; classtype:attempted-recon; sid:200005672; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"waycacoke.com",nocase; classtype:attempted-recon; sid:200005673; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"waycoklked.com",nocase; classtype:attempted-recon; sid:200005674; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wazefornay.byethost16.com",nocase; classtype:attempted-recon; sid:200005675; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wazneinfo24.pl",nocase; classtype:attempted-recon; sid:200005676; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wdjtyhmlvglzqrqmtmhf.rockcoastclothing.com",nocase; classtype:attempted-recon; sid:200005677; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"we-are.team",nocase; classtype:attempted-recon; sid:200005678; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"we.ghclones.repl.co",nocase; classtype:attempted-recon; sid:200005679; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"weaponoil.top",nocase; classtype:attempted-recon; sid:200005680; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wearabletechtogo.com",nocase; classtype:attempted-recon; sid:200005681; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"weaveessentialgoodness.cloud",nocase; classtype:attempted-recon; sid:200005682; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web-armas.royale-freefire1garena-bonus.com",nocase; classtype:attempted-recon; sid:200005683; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web-rechungbetrag-domain.de",nocase; classtype:attempted-recon; sid:200005684; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web-santander.byethost31.com",nocase; classtype:attempted-recon; sid:200005685; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web.bredbanque.trans.sylog.co",nocase; classtype:attempted-recon; sid:200005686; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web.royale-freefire1garena-bonus.com",nocase; classtype:attempted-recon; sid:200005687; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web1577.webbox444.server-home.org",nocase; classtype:attempted-recon; sid:200005688; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web2-edu-online.ru",nocase; classtype:attempted-recon; sid:200005689; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"web6442.web07.bero-webspace.de",nocase; classtype:attempted-recon; sid:200005690; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webagricoapp.byethost5.com",nocase; classtype:attempted-recon; sid:200005691; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webbacpichi.byethost14.com",nocase; classtype:attempted-recon; sid:200005692; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webbbb.yolasite.com",nocase; classtype:attempted-recon; sid:200005693; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webcentrinim.wapka.website",nocase; classtype:attempted-recon; sid:200005694; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webdatamltrainingdiag842.blob.core.windows.net",nocase; classtype:attempted-recon; sid:200005695; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webdisk.granadoemurahara.com.br",nocase; classtype:attempted-recon; sid:200005696; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webexert.com",nocase; classtype:attempted-recon; sid:200005697; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webexoduspro.com",nocase; classtype:attempted-recon; sid:200005698; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webfamily.com.br",nocase; classtype:attempted-recon; sid:200005699; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webfiddle.net",nocase; classtype:attempted-recon; sid:200005700; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webgaliciatxt.ihostfull.com",nocase; classtype:attempted-recon; sid:200005701; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webhostingbingo.com",nocase; classtype:attempted-recon; sid:200005702; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webintersol.com",nocase; classtype:attempted-recon; sid:200005703; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webm1al.fromewill.cf",nocase; classtype:attempted-recon; sid:200005704; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmail-2aaa0.web.app",nocase; classtype:attempted-recon; sid:200005705; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmail-e174d.web.app",nocase; classtype:attempted-recon; sid:200005706; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmail-sso8uyg.web.app",nocase; classtype:attempted-recon; sid:200005707; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmail.appemdobro.com",nocase; classtype:attempted-recon; sid:200005708; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmail.nitelifebuzz.com",nocase; classtype:attempted-recon; sid:200005709; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmail.njea.org",nocase; classtype:attempted-recon; sid:200005710; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmail.telephone-sfr.com",nocase; classtype:attempted-recon; sid:200005711; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmail.webapps-espclient.com",nocase; classtype:attempted-recon; sid:200005712; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmailadmin0.myfreesites.net",nocase; classtype:attempted-recon; sid:200005713; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmall.updatethejpamazon.top",nocase; classtype:attempted-recon; sid:200005714; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"weboutlookstorageaccess.activehosted.com",nocase; classtype:attempted-recon; sid:200005715; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webpromerica.webcindario.com",nocase; classtype:attempted-recon; sid:200005716; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webrevalidate.com",nocase; classtype:attempted-recon; sid:200005717; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webservicocef.com",nocase; classtype:attempted-recon; sid:200005718; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"website--355347865560300265249-bank.business.site",nocase; classtype:attempted-recon; sid:200005719; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webstorageadm.wixsite.com",nocase; classtype:attempted-recon; sid:200005720; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webstories.eu",nocase; classtype:attempted-recon; sid:200005721; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wecluihfrf-76tygh.web.app",nocase; classtype:attempted-recon; sid:200005722; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wecr470d90e2b1ca04d07fe2a5308245c2ec.cloudns.nz",nocase; classtype:attempted-recon; sid:200005723; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wedbancaonline.byethost13.com",nocase; classtype:attempted-recon; sid:200005724; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"weddingknock.top",nocase; classtype:attempted-recon; sid:200005725; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"weddingstaffcompanies.com",nocase; classtype:attempted-recon; sid:200005726; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"welcometospringfieldmo.com",nocase; classtype:attempted-recon; sid:200005727; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wells-fargo-service.com",nocase; classtype:attempted-recon; sid:200005728; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wellsfargo-help-center.com",nocase; classtype:attempted-recon; sid:200005729; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wellsfargos.aicsolutions.co.za",nocase; classtype:attempted-recon; sid:200005730; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wemaweea.000webhostapp.com",nocase; classtype:attempted-recon; sid:200005731; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wessex.fr",nocase; classtype:attempted-recon; sid:200005732; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"westernpapersl.com",nocase; classtype:attempted-recon; sid:200005733; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"westete.xyz",nocase; classtype:attempted-recon; sid:200005734; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"westpaclimited.com",nocase; classtype:attempted-recon; sid:200005735; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"westportvillagegallery.com",nocase; classtype:attempted-recon; sid:200005736; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wetra.4632.giov.swanngonorthwestregion.cf",nocase; classtype:attempted-recon; sid:200005737; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wetransfer-view-documentonline.yolasite.com",nocase; classtype:attempted-recon; sid:200005738; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"weuanine.com",nocase; classtype:attempted-recon; sid:200005739; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wewtraders.com",nocase; classtype:attempted-recon; sid:200005740; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wgcommunities.com",nocase; classtype:attempted-recon; sid:200005741; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whatepouhill.byethost15.com",nocase; classtype:attempted-recon; sid:200005742; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whatsapp-18.ikwb.com",nocase; classtype:attempted-recon; sid:200005743; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whatsapp-clone-teamwork.firebaseapp.com",nocase; classtype:attempted-recon; sid:200005744; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whatsapp-grubsx1.zzux.com",nocase; classtype:attempted-recon; sid:200005745; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whatsapp.blazagency.com",nocase; classtype:attempted-recon; sid:200005746; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whatsapp18girl.4pu.com",nocase; classtype:attempted-recon; sid:200005747; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whatsapps.instanthq.com",nocase; classtype:attempted-recon; sid:200005748; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whatsapps.mrslove.com",nocase; classtype:attempted-recon; sid:200005749; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whattsapps.misecure.com",nocase; classtype:attempted-recon; sid:200005750; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whdlvjebkwgoblxjtluhurnjnj-dot-gowa11111111.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200005751; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"when.servebeer.com",nocase; classtype:attempted-recon; sid:200005752; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whitelabelcreations.com",nocase; classtype:attempted-recon; sid:200005753; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whitelist-network.com",nocase; classtype:attempted-recon; sid:200005754; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whoisnooey.com",nocase; classtype:attempted-recon; sid:200005755; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whtaiseoigcoolgoiuerlkjgodlaeg.xyz",nocase; classtype:attempted-recon; sid:200005756; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"widadkamillah.github.io",nocase; classtype:attempted-recon; sid:200005757; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"widesdays.com",nocase; classtype:attempted-recon; sid:200005758; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wifi.retinad.com",nocase; classtype:attempted-recon; sid:200005759; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wikiarch.cz",nocase; classtype:attempted-recon; sid:200005760; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wildcard.novitium.ca",nocase; classtype:attempted-recon; sid:200005761; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wildcard.streamsteam.ca",nocase; classtype:attempted-recon; sid:200005762; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wildcard.tv1space.az",nocase; classtype:attempted-recon; sid:200005763; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"williamscocrimestoppers.org",nocase; classtype:attempted-recon; sid:200005764; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"willmasters.org.uk",nocase; classtype:attempted-recon; sid:200005765; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"willtoaccssnowand.cf",nocase; classtype:attempted-recon; sid:200005766; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wimracttus.com",nocase; classtype:attempted-recon; sid:200005767; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"win720.top",nocase; classtype:attempted-recon; sid:200005768; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"windowshost404902.s3-ap-southeast-1.amazonaws.com",nocase; classtype:attempted-recon; sid:200005769; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"winville.biz",nocase; classtype:attempted-recon; sid:200005770; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wireconfirmation68c10a25442a3e13.blogspot.com",nocase; classtype:attempted-recon; sid:200005771; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wires-business-starter.webflow.io",nocase; classtype:attempted-recon; sid:200005772; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wirtschaft.baesweiler.de",nocase; classtype:attempted-recon; sid:200005773; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wisconsin-dmv-mv3001.com",nocase; classtype:attempted-recon; sid:200005774; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"with.ddnsking.com",nocase; classtype:attempted-recon; sid:200005775; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"withyoumall.updatethejpamazon.work",nocase; classtype:attempted-recon; sid:200005776; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wj2vltyze29.typeform.com",nocase; classtype:attempted-recon; sid:200005777; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wkazisan.github.io",nocase; classtype:attempted-recon; sid:200005778; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wlnsna.top",nocase; classtype:attempted-recon; sid:200005779; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wn82b.skipdns.link",nocase; classtype:attempted-recon; sid:200005780; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wonderful.gr",nocase; classtype:attempted-recon; sid:200005781; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"woomcenter.com",nocase; classtype:attempted-recon; sid:200005782; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"woquito1-ecttps2.hostkda.com",nocase; classtype:attempted-recon; sid:200005783; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"worcester-passing-pharmacy-paxil.trycloudflare.com",nocase; classtype:attempted-recon; sid:200005784; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"word.3utilities.com",nocase; classtype:attempted-recon; sid:200005785; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"workcuencapptss1.hostkda.com",nocase; classtype:attempted-recon; sid:200005786; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"workforcerelief.com",nocase; classtype:attempted-recon; sid:200005787; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"workprotocoles-com.webs.com",nocase; classtype:attempted-recon; sid:200005788; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"worldwidepbx.com",nocase; classtype:attempted-recon; sid:200005789; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wp-login.azurewebsites.net",nocase; classtype:attempted-recon; sid:200005790; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wp.d-sso.com",nocase; classtype:attempted-recon; sid:200005791; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.0s8dvm.cn",nocase; classtype:attempted-recon; sid:200005792; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.5veki2.cn",nocase; classtype:attempted-recon; sid:200005793; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.aliz4k.cn",nocase; classtype:attempted-recon; sid:200005794; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.d5s6yuv.cn",nocase; classtype:attempted-recon; sid:200005795; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.epgnlu.cn",nocase; classtype:attempted-recon; sid:200005796; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.fcf40z9.cn",nocase; classtype:attempted-recon; sid:200005797; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.frmzt0.cn",nocase; classtype:attempted-recon; sid:200005798; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.n09443.cn",nocase; classtype:attempted-recon; sid:200005799; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.qingdaotulips.cn",nocase; classtype:attempted-recon; sid:200005800; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.rfw65j.cn",nocase; classtype:attempted-recon; sid:200005801; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.rivatobias2.cn",nocase; classtype:attempted-recon; sid:200005802; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.sanyangkeji2012.cn",nocase; classtype:attempted-recon; sid:200005803; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.sdtwtr.cn",nocase; classtype:attempted-recon; sid:200005804; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.shanghaizxzs.cn",nocase; classtype:attempted-recon; sid:200005805; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.shritafinn.cn",nocase; classtype:attempted-recon; sid:200005806; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.to0m7w.cn",nocase; classtype:attempted-recon; sid:200005807; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.wa8gvl.cn",nocase; classtype:attempted-recon; sid:200005808; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.xz6mvd.cn",nocase; classtype:attempted-recon; sid:200005809; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.y0cpqm.cn",nocase; classtype:attempted-recon; sid:200005810; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.yanzide118521.cn",nocase; classtype:attempted-recon; sid:200005811; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.ytjiade.cn",nocase; classtype:attempted-recon; sid:200005812; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.yuebanghuaxiang.cn",nocase; classtype:attempted-recon; sid:200005813; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqass-index.zhiguangshou00.cn",nocase; classtype:attempted-recon; sid:200005814; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wqdqnna.ga",nocase; classtype:attempted-recon; sid:200005815; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wrap.co",nocase; classtype:attempted-recon; sid:200005816; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wriot-alternate.app.link",nocase; classtype:attempted-recon; sid:200005817; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wsxwaaaa.web.app",nocase; classtype:attempted-recon; sid:200005818; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wu7q5.app.link",nocase; classtype:attempted-recon; sid:200005819; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wulalalela.cyou",nocase; classtype:attempted-recon; sid:200005820; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wvwv.xn--zonsegurasbn1cmp-hmb1nth.com",nocase; classtype:attempted-recon; sid:200005821; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ww2.activartusoperacionesenlinea.zonasegurabeta.com.pe.vegam.co",nocase; classtype:attempted-recon; sid:200005822; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wwproamerivto.byethost13.com",nocase; classtype:attempted-recon; sid:200005823; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-046cw.skipdns.link",nocase; classtype:attempted-recon; sid:200005824; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-4ng31.skipdns.link",nocase; classtype:attempted-recon; sid:200005825; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-cursosdigitalesmx-com.filesusr.com",nocase; classtype:attempted-recon; sid:200005826; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-dd91n.skipdns.link",nocase; classtype:attempted-recon; sid:200005827; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-degelyehuda-org-il.filesusr.com",nocase; classtype:attempted-recon; sid:200005828; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-e2g5k.skipdns.link",nocase; classtype:attempted-recon; sid:200005829; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-europe564598-com.filesusr.com",nocase; classtype:attempted-recon; sid:200005830; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-europessign-com.filesusr.com",nocase; classtype:attempted-recon; sid:200005831; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-hi9z3.skipdns.link",nocase; classtype:attempted-recon; sid:200005832; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-key-com.test.edgekey.net",nocase; classtype:attempted-recon; sid:200005833; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-n2q3r.skipdns.link",nocase; classtype:attempted-recon; sid:200005834; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-paypoy.banks-bvurs-co-jp.nuanen.top",nocase; classtype:attempted-recon; sid:200005835; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-paypoy.banks-mbkcd-co-jp.chuasi.top",nocase; classtype:attempted-recon; sid:200005836; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-paypoy.banks-nbych-co-jp.shuolo.top",nocase; classtype:attempted-recon; sid:200005837; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-paypoy.banks-nvyhs-co-jp.shunri.top",nocase; classtype:attempted-recon; sid:200005838; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-paypoy.banks-ovlxns-co-jp.tuaner.top",nocase; classtype:attempted-recon; sid:200005839; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-paypoy.banks-sybtf-co-jp.shuabi.top",nocase; classtype:attempted-recon; sid:200005840; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-paypoy.banks-wxhdc-co-jp.yuanta.top",nocase; classtype:attempted-recon; sid:200005841; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-s302y.skipdns.link",nocase; classtype:attempted-recon; sid:200005842; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-snbc.cardrs-gvxtd-com.kanbai.top",nocase; classtype:attempted-recon; sid:200005843; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-snbc.cardrs-ovmsh-com.zbsstdf.fun",nocase; classtype:attempted-recon; sid:200005844; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-snbc.cardrs-pacej-com.lanbei.top",nocase; classtype:attempted-recon; sid:200005845; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www.httpservlces.runescape.com-m.ru",nocase; classtype:attempted-recon; sid:200005846; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www.m.ervlces.runescape.com-fe.ru",nocase; classtype:attempted-recon; sid:200005847; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www.m.pma.runescape.com-m.ru",nocase; classtype:attempted-recon; sid:200005848; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www.m.tpservlces.runescape.com-ov.ru",nocase; classtype:attempted-recon; sid:200005849; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www.pma.runescape.com-gb.ru",nocase; classtype:attempted-recon; sid:200005850; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www3.colegiosantaangelamerici.edu.co",nocase; classtype:attempted-recon; sid:200005851; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wxcefappmobile.com",nocase; classtype:attempted-recon; sid:200005852; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wxyicacxwzypydwqaovplzetgg-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200005853; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wypadki24.e-kei.pl",nocase; classtype:attempted-recon; sid:200005854; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wzplh.app.link",nocase; classtype:attempted-recon; sid:200005855; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"x2mqj8a.app.link",nocase; classtype:attempted-recon; sid:200005856; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xaydungtamhoanganh.com",nocase; classtype:attempted-recon; sid:200005857; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xcvbm.hyperphp.com",nocase; classtype:attempted-recon; sid:200005858; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xess-nitro.com",nocase; classtype:attempted-recon; sid:200005859; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xfinityconnect4you.blogspot.com",nocase; classtype:attempted-recon; sid:200005860; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xfitpalestre.com",nocase; classtype:attempted-recon; sid:200005861; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xgyul.codesandbox.io",nocase; classtype:attempted-recon; sid:200005862; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xh13v.mjt.lu",nocase; classtype:attempted-recon; sid:200005863; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xh140.mjt.lu",nocase; classtype:attempted-recon; sid:200005864; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xh14n.mjt.lu",nocase; classtype:attempted-recon; sid:200005865; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xh156.mjt.lu",nocase; classtype:attempted-recon; sid:200005866; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xh1ou.mjt.lu",nocase; classtype:attempted-recon; sid:200005867; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xh1pl.mjt.lu",nocase; classtype:attempted-recon; sid:200005868; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xh1u4.mjt.lu",nocase; classtype:attempted-recon; sid:200005869; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xh7sz.hyperphp.com",nocase; classtype:attempted-recon; sid:200005870; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xhlgt.mjt.lu",nocase; classtype:attempted-recon; sid:200005871; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xhlr4.mjt.lu",nocase; classtype:attempted-recon; sid:200005872; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xhlvl.mjt.lu",nocase; classtype:attempted-recon; sid:200005873; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xhmnq.mjt.lu",nocase; classtype:attempted-recon; sid:200005874; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xhmnu.mjt.lu",nocase; classtype:attempted-recon; sid:200005875; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xhmnv.mjt.lu",nocase; classtype:attempted-recon; sid:200005876; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xhmqu.mjt.lu",nocase; classtype:attempted-recon; sid:200005877; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xhs02.mjt.lu",nocase; classtype:attempted-recon; sid:200005878; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xid-human-validation.run-us-west2.goorm.io",nocase; classtype:attempted-recon; sid:200005879; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xiorsil.freecluster.eu",nocase; classtype:attempted-recon; sid:200005880; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xj333.mjt.lu",nocase; classtype:attempted-recon; sid:200005881; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xj33s.mjt.lu",nocase; classtype:attempted-recon; sid:200005882; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xj33w.mjt.lu",nocase; classtype:attempted-recon; sid:200005883; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xj3pr.mjt.lu",nocase; classtype:attempted-recon; sid:200005884; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xj45g.mjt.lu",nocase; classtype:attempted-recon; sid:200005885; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xj45o.mjt.lu",nocase; classtype:attempted-recon; sid:200005886; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xj4og.mjt.lu",nocase; classtype:attempted-recon; sid:200005887; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xjm7s.mjt.lu",nocase; classtype:attempted-recon; sid:200005888; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xjmr7.mjt.lu",nocase; classtype:attempted-recon; sid:200005889; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xju3s.mjt.lu",nocase; classtype:attempted-recon; sid:200005890; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xjupr.mjt.lu",nocase; classtype:attempted-recon; sid:200005891; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xkdwm.csb.app",nocase; classtype:attempted-recon; sid:200005892; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xkljfg.ml",nocase; classtype:attempted-recon; sid:200005893; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xlebcacitbtgbejjfyjzsnhujh-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200005894; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xmley.codesandbox.io",nocase; classtype:attempted-recon; sid:200005895; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--45q115c4wl.jp",nocase; classtype:attempted-recon; sid:200005896; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--bankofmerca-3ij68171c.vg",nocase; classtype:attempted-recon; sid:200005897; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--bnkofmerc-qcbee85c.vg",nocase; classtype:attempted-recon; sid:200005898; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--gmal-sya.com",nocase; classtype:attempted-recon; sid:200005899; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--ltappen-80a.se",nocase; classtype:attempted-recon; sid:200005900; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--metemsk-twa.com",nocase; classtype:attempted-recon; sid:200005901; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--pacincia-xl-qbb.com",nocase; classtype:attempted-recon; sid:200005902; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--pckswap-8va0c7c53d.com",nocase; classtype:attempted-recon; sid:200005903; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--pckswp-ita5bd1d47d.com",nocase; classtype:attempted-recon; sid:200005904; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--pensea-2p8b.com",nocase; classtype:attempted-recon; sid:200005905; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--pxful-v11b.com",nocase; classtype:attempted-recon; sid:200005906; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--rpondeur-vocal12-bqb.yolasite.com",nocase; classtype:attempted-recon; sid:200005907; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--ugbd1cbxo23egh.com",nocase; classtype:attempted-recon; sid:200005908; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xolxol.phwww.vlces.runescape.com-oa.ru",nocase; classtype:attempted-recon; sid:200005909; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xpixl.me",nocase; classtype:attempted-recon; sid:200005910; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xqhq4.mjt.lu",nocase; classtype:attempted-recon; sid:200005911; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xqr3i.mjt.lu",nocase; classtype:attempted-recon; sid:200005912; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xqr3n.mjt.lu",nocase; classtype:attempted-recon; sid:200005913; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xqr3u.mjt.lu",nocase; classtype:attempted-recon; sid:200005914; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xrx6r.mjt.lu",nocase; classtype:attempted-recon; sid:200005915; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xrxh1.mjt.lu",nocase; classtype:attempted-recon; sid:200005916; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xrxh2.mjt.lu",nocase; classtype:attempted-recon; sid:200005917; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xrxhl.mjt.lu",nocase; classtype:attempted-recon; sid:200005918; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xsop5vp0rfd.typeform.com",nocase; classtype:attempted-recon; sid:200005919; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xtbnkpro.hostfree.pw",nocase; classtype:attempted-recon; sid:200005920; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xtio.ch",nocase; classtype:attempted-recon; sid:200005921; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xtw42.mjt.lu",nocase; classtype:attempted-recon; sid:200005922; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xxx-com-dot-c2c01-531c7.uc.r.appspot.com",nocase; classtype:attempted-recon; sid:200005923; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xyproject.xtensio.com",nocase; classtype:attempted-recon; sid:200005924; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xyysyndromepedia.com",nocase; classtype:attempted-recon; sid:200005925; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"y3s2ye.webwave.dev",nocase; classtype:attempted-recon; sid:200005926; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"y768766y.byethost6.com",nocase; classtype:attempted-recon; sid:200005927; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yaasssdag.weebly.com",nocase; classtype:attempted-recon; sid:200005928; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yaboshi.com",nocase; classtype:attempted-recon; sid:200005929; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yaewom.yeovessn.com",nocase; classtype:attempted-recon; sid:200005930; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yafa-coach.co.il",nocase; classtype:attempted-recon; sid:200005931; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yaggdagg.weebly.com",nocase; classtype:attempted-recon; sid:200005932; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yahooatttio.weebly.com",nocase; classtype:attempted-recon; sid:200005933; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yahoos-initial-project-cf784a.webflow.io",nocase; classtype:attempted-recon; sid:200005934; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yahuomall.square.site",nocase; classtype:attempted-recon; sid:200005935; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yairix.github.io",nocase; classtype:attempted-recon; sid:200005936; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yakutcement.ru",nocase; classtype:attempted-recon; sid:200005937; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yalena.me",nocase; classtype:attempted-recon; sid:200005938; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yamysd.com",nocase; classtype:attempted-recon; sid:200005939; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yaninasozopol.com",nocase; classtype:attempted-recon; sid:200005940; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yaopeowm.yeovessn.com",nocase; classtype:attempted-recon; sid:200005941; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yape.greenter.dev",nocase; classtype:attempted-recon; sid:200005942; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yaqoobi.org",nocase; classtype:attempted-recon; sid:200005943; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yashengineers.co.in",nocase; classtype:attempted-recon; sid:200005944; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ybs.51haoyayi.cn",nocase; classtype:attempted-recon; sid:200005945; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"year.servehttp.com",nocase; classtype:attempted-recon; sid:200005946; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yetpack.com",nocase; classtype:attempted-recon; sid:200005947; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ygdguwg.dgzwtmga.cn",nocase; classtype:attempted-recon; sid:200005948; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yoplwg2740634.byethost17.com",nocase; classtype:attempted-recon; sid:200005949; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"youngil.co.kr",nocase; classtype:attempted-recon; sid:200005950; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yourdeathstar.com",nocase; classtype:attempted-recon; sid:200005951; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yourthegame.xyz",nocase; classtype:attempted-recon; sid:200005952; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"youtudaysmensfoo.byethost31.com",nocase; classtype:attempted-recon; sid:200005953; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"youwingirisimiz.blogspot.com",nocase; classtype:attempted-recon; sid:200005954; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yqybbevgko.stephen-abdo.workers.dev",nocase; classtype:attempted-recon; sid:200005955; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ytco.in",nocase; classtype:attempted-recon; sid:200005956; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ythfdsf.aio49f4vsd.workers.dev",nocase; classtype:attempted-recon; sid:200005957; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ytthn.com",nocase; classtype:attempted-recon; sid:200005958; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yusril-moh.000webhostapp.com",nocase; classtype:attempted-recon; sid:200005959; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yuuu6.codesandbox.io",nocase; classtype:attempted-recon; sid:200005960; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yvaledesoser.t.justns.ru",nocase; classtype:attempted-recon; sid:200005961; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yvesauzon0-mon-site-web-cheetah.cheetah.builderall.com",nocase; classtype:attempted-recon; sid:200005962; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yvessgaspard-mon-site-web-cheetah.free.builderall.com",nocase; classtype:attempted-recon; sid:200005963; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yvqkqq.top",nocase; classtype:attempted-recon; sid:200005964; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ywlrwalvihcbekfschnroffqhf-dot-goff039302032323.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200005965; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"z-pay.biz",nocase; classtype:attempted-recon; sid:200005966; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"z3voicrxxvs.typeform.com",nocase; classtype:attempted-recon; sid:200005967; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"z93729n9.beget.tech",nocase; classtype:attempted-recon; sid:200005968; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zacma.bialystok.pl",nocase; classtype:attempted-recon; sid:200005969; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zadi.me",nocase; classtype:attempted-recon; sid:200005970; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zahlbaum.de",nocase; classtype:attempted-recon; sid:200005971; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zanbeel.com",nocase; classtype:attempted-recon; sid:200005972; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zap810451-1.plesk05.zap-webspace.com",nocase; classtype:attempted-recon; sid:200005973; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zcr7y.club",nocase; classtype:attempted-recon; sid:200005974; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zcrtygroup.club",nocase; classtype:attempted-recon; sid:200005975; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zdlymx.top",nocase; classtype:attempted-recon; sid:200005976; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zealous-babbage-9c5941.netlify.app",nocase; classtype:attempted-recon; sid:200005977; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zeebracross.com",nocase; classtype:attempted-recon; sid:200005978; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zeig.ml",nocase; classtype:attempted-recon; sid:200005979; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zekkafreitas-vando-magazine.cheetah.builderall.com",nocase; classtype:attempted-recon; sid:200005980; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zfhub.com.br",nocase; classtype:attempted-recon; sid:200005981; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zi-3-gporange1.free.builderall.com",nocase; classtype:attempted-recon; sid:200005982; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zimbabwe.net.za",nocase; classtype:attempted-recon; sid:200005983; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zip10.skipdns.link",nocase; classtype:attempted-recon; sid:200005984; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zix-zero.org.ru",nocase; classtype:attempted-recon; sid:200005985; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zkjio0.com",nocase; classtype:attempted-recon; sid:200005986; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zlej3mqyoty.typeform.com",nocase; classtype:attempted-recon; sid:200005987; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zoho-active.web.app",nocase; classtype:attempted-recon; sid:200005988; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zoho-adminserv.web.app",nocase; classtype:attempted-recon; sid:200005989; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zoho-mailservices.web.app",nocase; classtype:attempted-recon; sid:200005990; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zoho-online.web.app",nocase; classtype:attempted-recon; sid:200005991; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zoho-suspensionpanel.web.app",nocase; classtype:attempted-recon; sid:200005992; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zoho-validationserv.web.app",nocase; classtype:attempted-recon; sid:200005993; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zonasegourabeta.viasbcp.live",nocase; classtype:attempted-recon; sid:200005994; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zonasegura-pichincha.pe-ini.com",nocase; classtype:attempted-recon; sid:200005995; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zonasegura-pichincha.pe-nts.com",nocase; classtype:attempted-recon; sid:200005996; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zonasegurabetarbcp.site",nocase; classtype:attempted-recon; sid:200005997; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zonasegurabn1pe.online",nocase; classtype:attempted-recon; sid:200005998; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zonaseguran1.bn.virtual.cartinperu.com",nocase; classtype:attempted-recon; sid:200005999; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zonasegurapichincha.pe-ini.com",nocase; classtype:attempted-recon; sid:200006000; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zonaseguravirtualbn.online",nocase; classtype:attempted-recon; sid:200006001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zonaseguridadec.2host.me",nocase; classtype:attempted-recon; sid:200006002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zonasergurabetabcp.online",nocase; classtype:attempted-recon; sid:200006003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zonasgvrabnprevencionpe1.xyz",nocase; classtype:attempted-recon; sid:200006004; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zonassegurabetasviabcpe.com",nocase; classtype:attempted-recon; sid:200006005; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zonassegurabetasviasbcpe.com",nocase; classtype:attempted-recon; sid:200006006; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zonassegurabetaviabcp-pe.com",nocase; classtype:attempted-recon; sid:200006007; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zonassegurabetaviabcpe.com",nocase; classtype:attempted-recon; sid:200006008; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zoomstart.onlinestartserviceforyourworkstudymeeting.indyflat-tax.com",nocase; classtype:attempted-recon; sid:200006009; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zorten.com",nocase; classtype:attempted-recon; sid:200006010; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zphum.skipdns.link",nocase; classtype:attempted-recon; sid:200006011; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpmjikyjmhrzakneiddpiifdla-dot-gowa11111111.rj.r.appspot.com",nocase; classtype:attempted-recon; sid:200006012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zvuqh.app.link",nocase; classtype:attempted-recon; sid:200006013; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"045a3c0.wcomhost.com",nocase; http_uri; content:"/ameli-assurance/remboursement/login/",nocase; classtype:attempted-recon; sid:200006014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"045a3c0.wcomhost.com",nocase; http_uri; content:"/ameli-assurance/remboursement/login/iframe-page2.html",nocase; classtype:attempted-recon; sid:200006015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"048618c.netsolhost.com",nocase; http_uri; content:"/chase/secure.php?8f377965d91a85323ff298d1521c290f=",nocase; classtype:attempted-recon; sid:200006016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"0492d3a.wcomhost.com",nocase; http_uri; content:"/ameli-assurance/vos-remboursements/portailas/",nocase; classtype:attempted-recon; sid:200006017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"10bet.com",nocase; http_uri; content:"/sports-betting-bonus/?siteid=50538",nocase; classtype:attempted-recon; sid:200006018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"123formbuilder.com",nocase; http_uri; content:"/form-5134768/serra-es",nocase; classtype:attempted-recon; sid:200006019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"123formbuilder.com",nocase; http_uri; content:"/form-5220557/",nocase; classtype:attempted-recon; sid:200006020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"123formbuilder.com",nocase; http_uri; content:"/form-5559915/microsoft-team",nocase; classtype:attempted-recon; sid:200006021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"123formbuilder.com",nocase; http_uri; content:"/form-5578660/form",nocase; classtype:attempted-recon; sid:200006022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"141.118.125.34.bc.googleusercontent.com",nocase; http_uri; content:"/sms/?=/internetbanking.caixa.gov.br/renovar/=assinatura/eletronica",nocase; classtype:attempted-recon; sid:200006023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"141.118.125.34.bc.googleusercontent.com",nocase; http_uri; content:"/sms/?=/internetbanking.caixa.gov.br/renovar/=assinatura/eletronica#",nocase; classtype:attempted-recon; sid:200006024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"141.118.125.34.bc.googleusercontent.com",nocase; http_uri; content:"/sms/?=/internetbanking.caixa.gov.br/renovar/=assinatura/eletronica/",nocase; classtype:attempted-recon; sid:200006025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"141.118.125.34.bc.googleusercontent.com",nocase; http_uri; content:"/sms/?=/internetbanking.caixa.gov.br/renovar/=assinatura/eletronica0",nocase; classtype:attempted-recon; sid:200006026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"141.118.125.34.bc.googleusercontent.com",nocase; http_uri; content:"/sms/?=/internetbanking.caixa.gov.br/renovar/=assinatura/eletronica1",nocase; classtype:attempted-recon; sid:200006027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"141.118.125.34.bc.googleusercontent.com",nocase; http_uri; content:"/sms/?=/internetbanking.caixa.gov.br/renovar/=assinatura/eletronica2",nocase; classtype:attempted-recon; sid:200006028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"141.118.125.34.bc.googleusercontent.com",nocase; http_uri; content:"/sms/?=/internetbanking.caixa.gov.br/renovar/=assinatura/eletronica3",nocase; classtype:attempted-recon; sid:200006029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"141.118.125.34.bc.googleusercontent.com",nocase; http_uri; content:"/sms/?=/internetbanking.caixa.gov.br/renovar/=assinatura/eletronicaa",nocase; classtype:attempted-recon; sid:200006030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"141.118.125.34.bc.googleusercontent.com",nocase; http_uri; content:"/sms/?=/internetbanking.caixa.gov.br/renovar/=assinatura/eletronican",nocase; classtype:attempted-recon; sid:200006031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"141.118.125.34.bc.googleusercontent.com",nocase; http_uri; content:"/sms/?=/internetbanking.caixa.gov.br/renovar/=assinatura/eletronicax",nocase; classtype:attempted-recon; sid:200006032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"141.118.125.34.bc.googleusercontent.com",nocase; http_uri; content:"/sms/?=/internetbanking.caixa.gov.br/renovar/=assinatura/eletronicm",nocase; classtype:attempted-recon; sid:200006033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"157.240.18.15",nocase; http_uri; content:"/?id=http://www.cdph.ca.gov/programs/chcq/lcp/pages/afl-20-33.aspx&amp\;fields=og_object{engagement}&amp\;callback=_ate.cbs.rcb_fiqs0",nocase; classtype:attempted-recon; sid:200006034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"157.240.18.35",nocase; http_uri; content:"/?_fb_noscript=1",nocase; classtype:attempted-recon; sid:200006035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"157.240.22.35",nocase; http_uri; content:"/?_fb_noscript=1",nocase; classtype:attempted-recon; sid:200006036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"164.145.95.34.bc.googleusercontent.com",nocase; http_uri; content:"/atualizacao/sinbc/?auth=e0oweiqzvazs3fkdtebmh5bsrdwyh7blk4jczvxonru8ik0igqfvatjouosiidz3pabeg93llcoeejyqxdrtxlyjcbzp6yfk4yssz3cogt8amdqbvgkt0hf46dmz28adsiiki3rm6jcsxw88ay9hvw",nocase; classtype:attempted-recon; sid:200006037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1drv.ms",nocase; http_uri; content:"/b/s!auksoo1k68f1grbxbhid1sl-ye8w",nocase; classtype:attempted-recon; sid:200006038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1drv.ms",nocase; http_uri; content:"/o/s!asdoqhdzchzkceksme1zxz0tbys",nocase; classtype:attempted-recon; sid:200006039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1drv.ms",nocase; http_uri; content:"/o/s!bdl5r1ki9tc3gqvi-1haort04ahz?e=2lalmxflvewx2tjousf09g&amp\;at=9",nocase; classtype:attempted-recon; sid:200006040; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1drv.ms",nocase; http_uri; content:"/o/s!biwi80oasoewgxoqavzz0prwohuk?e=c-d9fhgd9ue1qswmmond5w&amp\;at=9",nocase; classtype:attempted-recon; sid:200006041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1drv.ms",nocase; http_uri; content:"/u/s!akaql-drpuriguznqx6yfuzunc_ava?e=woq9jy",nocase; classtype:attempted-recon; sid:200006042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1drv.ms",nocase; http_uri; content:"/u/s!aklt5-l7t4i2xvktl7g9mdgfcknm?e=cfngyw",nocase; classtype:attempted-recon; sid:200006043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1drv.ms",nocase; http_uri; content:"/u/s!aqzh3mzuvkddmbmdyu98fbfw9doy?e=mdjorx",nocase; classtype:attempted-recon; sid:200006044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1drv.ms",nocase; http_uri; content:"/u/s!auzzdh9o3pd3cutlhnbnixde2iu?e=bypust",nocase; classtype:attempted-recon; sid:200006045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1drv.ms",nocase; http_uri; content:"/u/s!avhfkscca3-jeadxnym7-7yxw9g?e=o7d49o",nocase; classtype:attempted-recon; sid:200006046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1drv.ms",nocase; http_uri; content:"/w/s!aguoqd84zse3gt7r1mqpd90amvv3",nocase; classtype:attempted-recon; sid:200006047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1drv.ms",nocase; http_uri; content:"/w/s!at6abcmxoqeqgrrahazju3fo1ojj",nocase; classtype:attempted-recon; sid:200006048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1drv.ms",nocase; http_uri; content:"/xs/s!am4xl7rvugywaxod-4xmpezy4mk?wdformid=%7ba1c5478a-c065-4b6f-b415-c1a0973f4392%7d",nocase; classtype:attempted-recon; sid:200006049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"1drv.ms",nocase; http_uri; content:"/xs/s!am4xl7rvugywaxod-4xmpezy4mk?wdformid=%7ba1c5478a-c065-4b6f-b415-c1a0973f4392%7d%3e",nocase; classtype:attempted-recon; sid:200006050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"218.220.125.34.bc.googleusercontent.com",nocase; http_uri; content:"/sms/?hash=renovar%202021%20sms",nocase; classtype:attempted-recon; sid:200006051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"377080202567359722137708020256735972.blogspot.com",nocase; http_uri; content:"/?m=0%5c",nocase; classtype:attempted-recon; sid:200006052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"3rdstreetmarket.com",nocase; http_uri; content:"/wp-content/themes/3rdst/8-login-form/",nocase; classtype:attempted-recon; sid:200006053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"43-245-61-213.cprapid.com",nocase; http_uri; content:"/index.php/false/false/py1n.html/discovercard.com/dfs/accounthome/summary/-www.schwab.com/secure.accurint.com/unfcu2.org/login1/wachovia.com/myaccounts.aspx/investing.schwab.com/secure",nocase; classtype:attempted-recon; sid:200006054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"46.196.247.35.bc.googleusercontent.com",nocase; http_uri; content:"/atualizacao/sinbc/home/v1/login/?auth=2oxmrcecjd1afj5was1ruch1cgdaubtiwmswjttn6ug4oyqcjnhmpzqg8c0lgjxeinxkiqbjxt3eaifx5vvbqew4t0anizkjoidn2cwnayoxcorj6htj9uj3wwt6rdiywrigttqpor09dkoxeoy1cg",nocase; classtype:attempted-recon; sid:200006055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"46.196.247.35.bc.googleusercontent.com",nocase; http_uri; content:"/atualizacao/sinbc/home/v1/login/?auth=3oxmrcecjd1afj5was1ruch1cgdaubtiwmswjttn6ug4oyqcjnhmpzqg8c0lgjxeinxkiqbjxt3eaifx5vvbqew4t0anizkjoidn2cwnayoxcorj6htj9uj3wwt6rdiywrigttqpor09dkoxeoy1cg",nocase; classtype:attempted-recon; sid:200006056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"46.196.247.35.bc.googleusercontent.com",nocase; http_uri; content:"/atualizacao/sinbc/home/v1/login/?auth=lchqus8gssgjbyi4x2chpl5t5igztsik9q7cjf4lqfwenuucuaplvfte5xsloxct6aycgqm43eucznyci8kjbg85mmbninsii6tqgbsdls45f6rmdo7f9preqlf2zeep3ebedurdrivmzhbddfzh5f",nocase; classtype:attempted-recon; sid:200006057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"46.196.247.35.bc.googleusercontent.com",nocase; http_uri; content:"/atualizacao/sinbc/home/v1/login/?auth=mk7xicgem2ve5hriuebnkr7el7kakm3zgc8uikkogzjw5q3wvyord1qg6vljw7atxhsh9sd31rppo9tdinvsdniouiykpn5nor62hknln2oa1q3wtdngnf4uurq2ypc00vnpd43khxpk8apbasnkgg",nocase; classtype:attempted-recon; sid:200006058; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"46.196.247.35.bc.googleusercontent.com",nocase; http_uri; content:"/atualizacao/sinbc/home/v2/login/?auth=qqzhkpmbmrgcnufs35kwclfmxiu4dh0nftfughzvvjsjn0ivyizmpaugoupfiaxondispdy1qw6u0uot5v8czqnl7s6gtgoygpc05osneiu5trq3af4lb70m1rsy46xhttni1dsbuavad88dcvoskv",nocase; classtype:attempted-recon; sid:200006059; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"46.196.247.35.bc.googleusercontent.com",nocase; http_uri; content:"/atualizacao/sinbc/home/v2/login/?auth=wqcp5co7fduh7rxd4tumzvmldub81mbq7k3av9ssvrlfxrxku8kc6rn2twc5lwm89kyd3lazwiolynj6w6n6zwyo6heqqm6bjmaejswjczeuo7nfj4izhq5ejewn8bsruinzn0itnjwnyhpkzg0ief",nocase; classtype:attempted-recon; sid:200006060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"46.196.247.35.bc.googleusercontent.com",nocase; http_uri; content:"/atualizacao/sinbc/home/v2/seguranca/?auth=9uipy1zeqdjqyu58hfp7elqvirnxtozxyqvgloqxz8bg69psuqkuedtv8abdwupoa7t0al8zbjrwz9vwup4kn9pddzqv9dzt3ud3goc8ol8a85qqusqe33uoblrhl2i3ouxn4jzqz92ux0natwzemi",nocase; classtype:attempted-recon; sid:200006061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"46.196.247.35.bc.googleusercontent.com",nocase; http_uri; content:"/atualizacao/sinbc/home/v2/seguranca/?auth=mqa65vt1bv5ujjwl9swyatzzi19uvjvy24kjow7eppaw7jqznmurypaiya7oc4s91ydomz9hacgx67c2j35gtzjrchiugkzmrjzbah3jsdvns9qlqqp4ixwxqjthqgkkxnkbpd8swowenhiqdecmqb",nocase; classtype:attempted-recon; sid:200006062; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"46.196.247.35.bc.googleusercontent.com",nocase; http_uri; content:"/atualizacao/sinbc/home/v2/seguranca/?auth=oqa65vt1bv5ujjwl9swyatzzi19uvjvy24kjow7eppaw7jqznmurypaiya7oc4s91ydomz9hacgx67c2j35gtzjrchiugkzmrjzbah3jsdvns9qlqqp4ixwxqjthqgkkxnkbpd8swowenhiqdecmqb",nocase; classtype:attempted-recon; sid:200006063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"46.196.247.35.bc.googleusercontent.com",nocase; http_uri; content:"/atualizacao/sinbc/home/v2/seguranca/?auth=pqa65vt1bv5ujjwl9swyatzzi19uvjvy24kjow7eppaw7jqznmurypaiya7oc4s91ydomz9hacgx67c2j35gtzjrchiugkzmrjzbah3jsdvns9qlqqp4ixwxqjthqgkkxnkbpd8swowenhiqdecmqb",nocase; classtype:attempted-recon; sid:200006064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"46.196.247.35.bc.googleusercontent.com",nocase; http_uri; content:"/atualizacao/sinbc/home/v2/seguranca/?auth=xqa65vt1bv5ujjwl9swyatzzi19uvjvy24kjow7eppaw7jqznmurypaiya7oc4s91ydomz9hacgx67c2j35gtzjrchiugkzmrjzbah3jsdvns9qlqqp4ixwxqjthqgkkxnkbpd8swowenhiqdecmqb",nocase; classtype:attempted-recon; sid:200006065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"46.196.247.35.bc.googleusercontent.com",nocase; http_uri; content:"/atualizacao/sinbc/home/v2/seguranca/?auth=zqa65vt1bv5ujjwl9swyatzzi19uvjvy24kjow7eppaw7jqznmurypaiya7oc4s91ydomz9hacgx67c2j35gtzjrchiugkzmrjzbah3jsdvns9qlqqp4ixwxqjthqgkkxnkbpd8swowenhiqdecmqb",nocase; classtype:attempted-recon; sid:200006066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"46.196.247.35.bc.googleusercontent.com",nocase; http_uri; content:"/atualizacao/sinbc/home/v4/login/?auth=uhnhllsv5eruj0114y7spskwjd6k0st8bpjtndo3irw5bdmoiw1wuu0ggnennq9sr4fiwogruh3h7vhajt7fbxvlw6dvble4pejdxr2wcepchbl05xujlaxhzndbgjghpzuobqgsimxd6yyafbyted",nocase; classtype:attempted-recon; sid:200006067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"46.196.247.35.bc.googleusercontent.com",nocase; http_uri; content:"/atualizacao/sinbc/home/v4/seguranca/?auth=bn5neccbepwzdne6ebclzixt8r9sheyqo0k0q7gmo8pfwnaqwyhxmncqxv2rcpzwocg1uwgwde51cyc1jhkfgkdgfxs6llrcfxbkbkvi9wl15ueoplzwnxxxxf9rzuqaaasvpp0bkn2prowlcbkfwq",nocase; classtype:attempted-recon; sid:200006068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"46.196.247.35.bc.googleusercontent.com",nocase; http_uri; content:"/atualizacao/sinbc/home/v4/seguranca/?auth=cn5neccbepwzdne6ebclzixt8r9sheyqo0k0q7gmo8pfwnaqwyhxmncqxv2rcpzwocg1uwgwde51cyc1jhkfgkdgfxs6llrcfxbkbkvi9wl15ueoplzwnxxxxf9rzuqaaasvpp0bkn2prowlcbkfwq",nocase; classtype:attempted-recon; sid:200006069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"46.196.247.35.bc.googleusercontent.com",nocase; http_uri; content:"/atualizacao/sinbc/home/v4/seguranca/?auth=qn5neccbepwzdne6ebclzixt8r9sheyqo0k0q7gmo8pfwnaqwyhxmncqxv2rcpzwocg1uwgwde51cyc1jhkfgkdgfxs6llrcfxbkbkvi9wl15ueoplzwnxxxxf9rzuqaaasvpp0bkn2prowlcbkfwq",nocase; classtype:attempted-recon; sid:200006070; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"46.196.247.35.bc.googleusercontent.com",nocase; http_uri; content:"/atualizacao/sinbc/home/v4/seguranca/?auth=xn5neccbepwzdne6ebclzixt8r9sheyqo0k0q7gmo8pfwnaqwyhxmncqxv2rcpzwocg1uwgwde51cyc1jhkfgkdgfxs6llrcfxbkbkvi9wl15ueoplzwnxxxxf9rzuqaaasvpp0bkn2prowlcbkfwq",nocase; classtype:attempted-recon; sid:200006071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"46.196.247.35.bc.googleusercontent.com",nocase; http_uri; content:"/atualizacao/sinbc/home/v4/seguranca/?auth=yn5neccbepwzdne6ebclzixt8r9sheyqo0k0q7gmo8pfwnaqwyhxmncqxv2rcpzwocg1uwgwde51cyc1jhkfgkdgfxs6llrcfxbkbkvi9wl15ueoplzwnxxxxf9rzuqaaasvpp0bkn2prowlcbkfwq",nocase; classtype:attempted-recon; sid:200006072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"46.196.247.35.bc.googleusercontent.com",nocase; http_uri; content:"/atualizacao/sinbc/home/v4/seguranca/?auth=zn5neccbepwzdne6ebclzixt8r9sheyqo0k0q7gmo8pfwnaqwyhxmncqxv2rcpzwocg1uwgwde51cyc1jhkfgkdgfxs6llrcfxbkbkvi9wl15ueoplzwnxxxxf9rzuqaaasvpp0bkn2prowlcbkfwq",nocase; classtype:attempted-recon; sid:200006073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"46.196.247.35.bc.googleusercontent.com",nocase; http_uri; content:"/atualizacao/sinbc/mobile/v5/login/?auth=ukzjcdhun48xyqjisv6uzu5vdckkofar0vu7uhf3mglaxi1szkvtfz3okyj7jdyv9sqh4xwcgyzxqgwoncszisixiw4kxl846zqwgl1wyibmznxcxgk0jlngmruigsrnac86xjnefb7jvxtyfqzddq",nocase; classtype:attempted-recon; sid:200006074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"5x.to",nocase; http_uri; content:"/3ax",nocase; classtype:attempted-recon; sid:200006075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"6b6ee980cb147a4ec53464500670dd46-dot-goff039302032323.rj.r.appspot.com",nocase; http_uri; content:"/#?em=jennifer.blachford@nb.com",nocase; classtype:attempted-recon; sid:200006076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"8010361370310234068010361370310234.blogspot.com",nocase; http_uri; content:"/?m=0%5c",nocase; classtype:attempted-recon; sid:200006077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"a-q-f.com",nocase; http_uri; content:"/openpc/directlogin.do",nocase; classtype:attempted-recon; sid:200006078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aadaedu-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/sherring_aada_edu1/epxaaqphuzvnqoye4vgldzkbzmud1mij-ek8r72wltpdyq?e=szm5ky",nocase; classtype:attempted-recon; sid:200006079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"abnmart.co.in",nocase; http_uri; content:"/orne/",nocase; classtype:attempted-recon; sid:200006080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?passive=1209600&continue=https://sites.google.com/view/viewbill-bt-1/bt&followup=https://sites.google.com/view/viewbill-bt-1/bt",nocase; classtype:attempted-recon; sid:200006081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?passive=1209600&osid=1&continue=https://plus.google.com/%26&followup=https://plus.google.com/%26",nocase; classtype:attempted-recon; sid:200006082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&amp\;passive=1209600&amp\;continue=https://storage.cloud.google.com/staging.maintainancecomponeta.appspot.com/bsnnindex.html&amp\;followup=https://storage.cloud.google.com/staging.maintainancecomponeta.appspot.com/bsnnindex.html",nocase; classtype:attempted-recon; sid:200006083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/1lordman1man3/oscman2.html&followup=https://storage.cloud.google.com/1lordman1man3/oscman2.html",nocase; classtype:attempted-recon; sid:200006084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/appspotv450i7r8h9vf9y6yt8uiuft58f7uf5yye36u0jtyf78uuyfyy/index.html&followup=https://storage.cloud.google.com/appspotv450i7r8h9vf9y6yt8uiuft58f7uf5yye36u0jtyf78uuyfyy/index.html",nocase; classtype:attempted-recon; sid:200006085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/employt44to49cclrlolcrl94lnlxo.appspot.com/index.html&followup=https://storage.cloud.google.com/employt44to49cclrlolcrl94lnlxo.appspot.com/index.html",nocase; classtype:attempted-recon; sid:200006086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/maintainancecomponeta.appspot.com/mineindex.html&followup=https://storage.cloud.google.com/maintainancecomponeta.appspot.com/mineindex.html",nocase; classtype:attempted-recon; sid:200006087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/officpcpspbcncuser.appspot.com/index.htm&followup=https://storage.cloud.google.com/officpcpspbcncuser.appspot.com/index.htm",nocase; classtype:attempted-recon; sid:200006088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/poopnoomprops-oo987700ok/newrbindex.html&followup=https://storage.cloud.google.com/poopnoomprops-oo987700ok/newrbindex.html",nocase; classtype:attempted-recon; sid:200006089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/staging.maintainancecomponeta.appspot.com/bsnnindex.html&followup=https://storage.cloud.google.com/staging.maintainancecomponeta.appspot.com/bsnnindex.html",nocase; classtype:attempted-recon; sid:200006090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/user517497679326978.appspot.com/index.html&followup=https://storage.cloud.google.com/user517497679326978.appspot.com/index.html",nocase; classtype:attempted-recon; sid:200006091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/user7773578ixh1092839.appspot.com/index.html&followup=https://storage.cloud.google.com/user7773578ixh1092839.appspot.com/index.html",nocase; classtype:attempted-recon; sid:200006092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accounts.google.com",nocase; http_uri; content:"/servicelogin?service=cds&passive=1209600&continue=https://storage.cloud.google.com/xzrdzcdruerp.appspot.com/index.html&followup=https://storage.cloud.google.com/xzrdzcdruerp.appspot.com/index.html",nocase; classtype:attempted-recon; sid:200006093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accurate-insight.com",nocase; http_uri; content:"/wp-admin/pmg/office-new-rd85-modify-footer",nocase; classtype:attempted-recon; sid:200006094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"accurate-insight.com",nocase; http_uri; content:"/wp-admin/pmg/office-new-rd85-modify-footer/",nocase; classtype:attempted-recon; sid:200006095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"acortar.link",nocase; http_uri; content:"/yxwyrl",nocase; classtype:attempted-recon; sid:200006096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"adornbit.com",nocase; http_uri; content:"/en",nocase; classtype:attempted-recon; sid:200006097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aijcs.blogspot.com",nocase; http_uri; content:"/2005/03/colourful-life-of-aij.html",nocase; classtype:attempted-recon; sid:200006098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"airbrakes-my.sharepoint.com",nocase; http_uri; content:"/:b:/g/personal/fran_airbrake_ie/eqc3jfpbonbnqnibgpaej70bhh4buhabliuakttnd6zeyq?e=szvft8",nocase; classtype:attempted-recon; sid:200006099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alfredtalkelogisticservices-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/venus_gardose_talke_com/_layouts/15/wopiframe.aspx?guestaccesstoken=8extkunxrkqozifs2sycqmk4ox0ntao7cizsavm5mjc=&amp\;docid=1_14abcf62971634e6b8387df30ef7d978b&amp\;wdformid={83a6cfc0-5689-4aa4-ab13-96952b8999ba}&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200006100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aliah.ac.in",nocase; http_uri; content:"/2n020/setmodule/",nocase; classtype:attempted-recon; sid:200006101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"allnewhaircut.com",nocase; http_uri; content:"/smi.cers/bmss.php",nocase; classtype:attempted-recon; sid:200006102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"alternanetworks-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/thomas_salemkour_open-xerox_com/eq5ps-07ovvnl5eo4rrthymb7a9euvzss3urntui3dvyyq?e=kqnstw",nocase; classtype:attempted-recon; sid:200006103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ambrosecourt.com",nocase; http_uri; content:"/our/ourtime/ourtime.html",nocase; classtype:attempted-recon; sid:200006104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"amenainvest-my.sharepoint.com",nocase; http_uri; content:"/personal/sebastiangerlach_amena-invest_de/_layouts/15/authenticate.aspx",nocase; classtype:attempted-recon; sid:200006105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ams3.digitaloceanspaces.com",nocase; http_uri; content:"/jhgroupcapital100ptainmentediliziacrobatica/index.html",nocase; classtype:attempted-recon; sid:200006106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ams3.digitaloceanspaces.com",nocase; http_uri; content:"/njk/25_40_24_5e_40_26_40_26_28_29_23_23_5e_23_24_26_5e_25_26_40_5e_28_23_26.html",nocase; classtype:attempted-recon; sid:200006107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ams3.digitaloceanspaces.com",nocase; http_uri; content:"/offonline2ret/index.html",nocase; classtype:attempted-recon; sid:200006108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ams3.digitaloceanspaces.com",nocase; http_uri; content:"/onenotedrive2/index.html",nocase; classtype:attempted-recon; sid:200006109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anekaslot.com",nocase; http_uri; content:"/jps/webmail_reset.htm",nocase; classtype:attempted-recon; sid:200006110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"annarborhandsonmuseum-my.sharepoint.com",nocase; http_uri; content:"/personal/jklute_aahom_org/_layouts/15/wopiframe.aspx?sourcedoc={32b08432-df6e-45ce-b9dd-bd06a2fd8ffc}&amp\;action=default&amp\;originalpath=ahr0chm6ly9hbm5hcmjvcmhhbmrzb25tdxnldw0tbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvamtsdxrlx2fhag9tx29yzy9faktfc0rkdtm4nuz1zdi5qnfmowpfd0j2u3ewwjvxag1isnnittdkdvg4rdbrp3j0aw1lptnhmwxmtui0mtbn",nocase; classtype:attempted-recon; sid:200006111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"annarborhandsonmuseum-my.sharepoint.com",nocase; http_uri; content:"/personal/jklute_aahom_org/_layouts/15/wopiframe2.aspx?sourcedoc={32b08432-df6e-45ce-b9dd-bd06a2fd8ffc}&amp\;action=default&amp\;originalpath=ahr0chm6ly9hbm5hcmjvcmhhbmrzb25tdxnldw0tbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvamtsdxrlx2fhag9tx29yzy9faktfc0rkdtm4nuz1zdi5qnfmowpfd0j2u3ewwjvxag1isnnittdkdvg4rdbrp3j0aw1lptnhmwxmtui0mtbn",nocase; classtype:attempted-recon; sid:200006112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"anniewright-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/mary_belisle_aw_org/_layouts/15/wopiframe.aspx?guestaccesstoken=rxpjqbfln4drfnv4sgfnnqwyldsjbnceldcpqdpe7hu%3d&docid=1_120e0a15e74f24c589d87788d99c1c667&wdformid=%7b493b5cd7%2d227e%2d4339%2d98b3%2da8644c8ce588%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200006113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"api.addthis.com",nocase; http_uri; content:"/oexchange/0.8/wrap/opengraph?url=ahr0chm6ly93zxetnmrlodiud2vilmfwcc8znzg1mje5lze1lziwmjfjdw5plmn6nto1nibbttu6ntygqu13zwjtyxn0zxi5lze1lziwmjeznzg1mjfjdw5plmn6nto1nibbttu6ntygqu13zwjtyxn0zxiznzg1mje5lze1lziwmjfjdw5plmn6nto1nibbttu6ntygqu0znzg1mjf3zwjtyxn0zxi5lze1lziwmjfjdw5plmn6nto1nibbttm3oduymtu6ntygqu13zwjtyxn0zxiznzg1mjejd2vibwfzdgvyqgn1bmkuy3o=",nocase; classtype:attempted-recon; sid:200006114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"api.addthis.com",nocase; http_uri; content:"/oexchange/0.8/wrap/opengraph?url=ahr0chm6ly9ua3yuchvil3h5nt83oet4elzsag1mzndzjmfsdd1tzwrpysnav2x0wvhomfpvqnpkr2x1y0hkcgvtrxvim0puolbcy3ppmu4yzgrladg2ennfduhvdu02qxphujjmuhv5zw5ork5ecvu=",nocase; classtype:attempted-recon; sid:200006115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"api.bdisl.com",nocase; http_uri; content:"/redirect?s=857592&amp\;at=4&amp\;rt=api&amp\;o=37248906&amp\;s1=2d8a1db7066ae145-5e70fb7b763882480f1ffb01&amp\;s2=&amp\;s3=",nocase; classtype:attempted-recon; sid:200006116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"api.bdisl.com",nocase; http_uri; content:"/redirect?s=857592&amp\;at=4&amp\;rt=api&amp\;o=96574574&amp\;s1=d2cb2653d154e850-5ea5960ca629f275326f9e81&amp\;s2=&amp\;s3=",nocase; classtype:attempted-recon; sid:200006117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"api.bdisl.com",nocase; http_uri; content:"/redirect?s=857592&amp\;at=4&amp\;rt=api&amp\;o=96668170&amp\;s1=2b94eb26dd71a6e0-5ea5961f20937a71e917f602&amp\;s2=&amp\;s3=",nocase; classtype:attempted-recon; sid:200006118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apkandroid.ru",nocase; http_uri; content:"/caja-de-herramientas/mx.com.vepormas.cajadeherramientas/downloading.html",nocase; classtype:attempted-recon; sid:200006119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"apkfun.com",nocase; http_uri; content:"/reale-seguros.html",nocase; classtype:attempted-recon; sid:200006120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.box.com",nocase; http_uri; content:"/s/43l7nxncafyxdiaecwxblt0yo2hn7epz",nocase; classtype:attempted-recon; sid:200006121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.box.com",nocase; http_uri; content:"/s/aju8uu3l7x4uusi7v53z09uk6rvwd161",nocase; classtype:attempted-recon; sid:200006122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.box.com",nocase; http_uri; content:"/s/b9fu9axf9rcv7bhjp80fpcm8zna5wcwi",nocase; classtype:attempted-recon; sid:200006123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.box.com",nocase; http_uri; content:"/s/bog5q0dw9nxw2zs7e01m5y6zw23oeszj",nocase; classtype:attempted-recon; sid:200006124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.box.com",nocase; http_uri; content:"/s/x6agocx9zvj049azirk4aw3xrqdedqhl",nocase; classtype:attempted-recon; sid:200006125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.box.com",nocase; http_uri; content:"/s/ymr0ltw3hmn8icxebz16gjhcyhqa49w4",nocase; classtype:attempted-recon; sid:200006126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.digitaledunet.com",nocase; http_uri; content:"/bin/connect.api.bank.of.america.com.secure.auth.dashboard.auto.sign.in.user.info.webmai1.id/b0fa/4da68e36/",nocase; classtype:attempted-recon; sid:200006127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.pandadoc.com",nocase; http_uri; content:"/p/96f48ddb9415f1307e22c50a18ad07c1785a5164?",nocase; classtype:attempted-recon; sid:200006128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.simplenote.com",nocase; http_uri; content:"/p/22f3qw",nocase; classtype:attempted-recon; sid:200006129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.simplenote.com",nocase; http_uri; content:"/p/cmxgsj",nocase; classtype:attempted-recon; sid:200006130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.simplenote.com",nocase; http_uri; content:"/p/lhwhl9",nocase; classtype:attempted-recon; sid:200006131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.simplenote.com",nocase; http_uri; content:"/publish/xhrdvc",nocase; classtype:attempted-recon; sid:200006132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.surveymethods.com",nocase; http_uri; content:"/enduser.aspx?aa8ee2fdabeef7fcaf",nocase; classtype:attempted-recon; sid:200006133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.surveymethods.com",nocase; http_uri; content:"/enduser.aspx?dffb9788de948a8bdd",nocase; classtype:attempted-recon; sid:200006134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"app.surveymethods.com",nocase; http_uri; content:"/enduser.aspx?f9ddb1aef8b2adacff",nocase; classtype:attempted-recon; sid:200006135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appurl.io",nocase; http_uri; content:"/2skowwypyb",nocase; classtype:attempted-recon; sid:200006136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appurl.io",nocase; http_uri; content:"/6dfhh1yrol",nocase; classtype:attempted-recon; sid:200006137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appurl.io",nocase; http_uri; content:"/fuppf4qa9u",nocase; classtype:attempted-recon; sid:200006138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appurl.io",nocase; http_uri; content:"/gwcwfaxmun",nocase; classtype:attempted-recon; sid:200006139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appurl.io",nocase; http_uri; content:"/izmlfzanc-",nocase; classtype:attempted-recon; sid:200006140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appurl.io",nocase; http_uri; content:"/k8hy2cvo8x",nocase; classtype:attempted-recon; sid:200006141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appurl.io",nocase; http_uri; content:"/wywajnlbtl",nocase; classtype:attempted-recon; sid:200006142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"appurl.io",nocase; http_uri; content:"/xiwmghfmg3",nocase; classtype:attempted-recon; sid:200006143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"archive.behappyevent.com",nocase; http_uri; content:"/dnes_9s?tdx_br=a4fwlnblbgkcla6mwjyyaiz1ykkkwkzfamcaqhy0j2ljagriypuu/margareta.nordstrand%40er.lu.se",nocase; classtype:attempted-recon; sid:200006144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"archive.behappyevent.com",nocase; http_uri; content:"/tvok_6r?kha_dn=a4fwlnfrbgkclyv1wm5paicjykcdomzjb4crpx9xkwpfbgkjy31yjmpkaigd/norzaihan.norhashim@qsrbrands.com.my",nocase; classtype:attempted-recon; sid:200006145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"arisebuildscom-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/gene_arisebuilds_com/eggkjirnlknoh4k8dkclnxcbpfg-oj1ihz4vpywlomnezw?e=gqgvfz",nocase; classtype:attempted-recon; sid:200006146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"armyeitaas.sharepoint-mil.us",nocase; http_uri; content:"/teams/army365howtoguides/sitepages/army-365-how-to-guides.aspx",nocase; classtype:attempted-recon; sid:200006147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aro365539014-my.sharepoint.com",nocase; http_uri; content:"/:b:/g/personal/brittany_rivertownfinance_com/ebd7xlmfefbajikalhwkrw4bj9qm2y55sehnafmgtfcdvg?e=4*3ariqguh&amp\;at=9",nocase; classtype:attempted-recon; sid:200006148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"artificialconnect.com",nocase; http_uri; content:"/s/anmeldung.php",nocase; classtype:attempted-recon; sid:200006149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"artificialconnect.com",nocase; http_uri; content:"/s/anmeldung.php?starten=4geqwfau8kaypmmfbcrv0zhhxbrd7q&amp\;shuffluri?=csmdd37bht6zgxq2ijem",nocase; classtype:attempted-recon; sid:200006150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"aruba-iv.blogspot.com",nocase; http_uri; content:"/?m=1",nocase; classtype:attempted-recon; sid:200006151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asiiadinova.goosecreektradingpost.com",nocase; http_uri; content:"/dropbx",nocase; classtype:attempted-recon; sid:200006152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asiiadinova.goosecreektradingpost.com",nocase; http_uri; content:"/dropbx/mrrivfqsx0w56yjs2n12ktqjai9rntduscz8tuksuljc9aqnx1hcetketfhhcuobuyrx1tde7ar",nocase; classtype:attempted-recon; sid:200006153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asiiadinova.goosecreektradingpost.com",nocase; http_uri; content:"/dropbx/mrrivfqsx0w56yjs2n12ktqjai9rntduscz8tuksuljc9aqnx1hcetketfhhcuobuyrx1tde7ar/",nocase; classtype:attempted-recon; sid:200006154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asiiadinova.goosecreektradingpost.com",nocase; http_uri; content:"/dropbx/zydqa2rp1pbhn5jfl8pcnq7rcox3i2ombnku03sbwoybgnquohbtmjtpe8mspvambxifeafwhez",nocase; classtype:attempted-recon; sid:200006155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"asiiadinova.goosecreektradingpost.com",nocase; http_uri; content:"/dropbx/zydqa2rp1pbhn5jfl8pcnq7rcox3i2ombnku03sbwoybgnquohbtmjtpe8mspvambxifeafwhez/",nocase; classtype:attempted-recon; sid:200006156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"assoalhosmadeiras.blogspot.com",nocase; http_uri; content:"/?m=1",nocase; classtype:attempted-recon; sid:200006157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atagucsea.com",nocase; http_uri; content:"/wp-content/themes/twentyfifteen/cloud9/gucemail",nocase; classtype:attempted-recon; sid:200006158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atagucsea.com",nocase; http_uri; content:"/wp-content/themes/twentyfifteen/cloud9/gucemail/",nocase; classtype:attempted-recon; sid:200006159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atagucsea.com",nocase; http_uri; content:"/wp-content/themes/twentyfifteen/guce.advertising/8736443",nocase; classtype:attempted-recon; sid:200006160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atagucsea.com",nocase; http_uri; content:"/wp-content/themes/twentyfifteen/guce.advertising/8736443/",nocase; classtype:attempted-recon; sid:200006161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atefnet.com",nocase; http_uri; content:"/js/calendar/login/customer_center/customer-idpp00c699/",nocase; classtype:attempted-recon; sid:200006162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atefnet.com",nocase; http_uri; content:"/js/calendar/login/customer_center/customer-idpp00c699/myaccount/signin/?country.x=us&locale.x=en_us",nocase; classtype:attempted-recon; sid:200006163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atmostechnology-my.sharepoint.com",nocase; http_uri; content:"/personal/amalia_atmostechnology_co_uk/_layouts/15/wopiframe.aspx?guestaccesstoken=uiyaiqprc2ikxq0mezirqthais%2fdp9mp1hyqhjkscj0%3d&docid=1_1cbd4797f2749435a8f30af1a3f2d36b5&wdformid=%7b890161c9%2deb6d%2d44fc%2d9a59%2d0e4400a27203%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200006164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atriumlandscape-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/sue_atriumlandscape_com/_layouts/15/wopiframe.aspx?guestaccesstoken=f77ihhc%2fxkig6gfhqiddogtmjqoxm0%2fq%2bb2euyif%2bri%3d&docid=1_1c9c826e0945c4aae87a3cf1547b535ab&wdformid=%7b3565fd77%2dd37d%2d4ccf%2db660%2d25cb35a12799%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200006165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atriumlandscape-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/sue_atriumlandscape_com/_layouts/15/wopiframe.aspx?guestaccesstoken=nrg8nkxnkyji2axm9efekdi62u6cuvrsxcypzfz9jay=&amp\;docid=1_10932d3dd2ac2478f833ee56388ecb767&amp\;wdformid={faebec1d-bc38-42bf-be94-47ebb62d7501}&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200006166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atriumlandscape-my.sharepoint.com",nocase; http_uri; content:"/personal/sue_atriumlandscape_com/_layouts/15/wopiframe.aspx?guestaccesstoken=f77ihhc%2fxkig6gfhqiddogtmjqoxm0%2fq%2bb2euyif%2bri%3d&docid=1_1c9c826e0945c4aae87a3cf1547b535ab&wdformid=%7b3565fd77%2dd37d%2d4ccf%2db660%2d25cb35a12799%7d&action=formsubmit&cid=f76562aa-9283-40ef-8ac9-15e5e7722d9b",nocase; classtype:attempted-recon; sid:200006167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atriumlandscape-my.sharepoint.com",nocase; http_uri; content:"/personal/sue_atriumlandscape_com/_layouts/15/wopiframe.aspx?guestaccesstoken=nrg8nkxnkyji2axm9efekdi62u6cuvrsxcypzfz9jay%3d&docid=1_10932d3dd2ac2478f833ee56388ecb767&wdformid=%7bfaebec1d%2dbc38%2d42bf%2dbe94%2d47ebb62d7501%7d&action=formsubmit&cid=06548627-9647-42de-a0c7-75a424aaacde",nocase; classtype:attempted-recon; sid:200006168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"atriumlandscape-my.sharepoint.com",nocase; http_uri; content:"/personal/sue_atriumlandscape_com/_layouts/15/wopiframe.aspx?guestaccesstoken=nrg8nkxnkyji2axm9efekdi62u6cuvrsxcypzfz9jay=&amp\;docid=1_10932d3dd2ac2478f833ee56388ecb767&amp\;wdformid={faebec1d-bc38-42bf-be94-47ebb62d7501}&amp\;action=formsubmit&amp\;cid=06548627-9647-42de-a0c7-75a424aaacde",nocase; classtype:attempted-recon; sid:200006169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attemplate.com",nocase; http_uri; content:"/nam/login?id=cgfezmnpamevsljgc2dnovfpdguyu2izmwh4ek5kvvv0s09vvwhkt0qragt3zlc5clqrnlbtvu12mctnzujvqnjuk0dvbkhpnfrxber1mwqys3rpnmewzm1haedrl2fytxlzcjfnuzfhqlgzcxjsvws3z3plclpdotlnndbzvi9ry1jwunj0whhnuwhivzbymtjqewlkqu5rtg1mm0ftu0izdwzhbzvfzwhzdty3c2c3mhnsm0j6actoctrxu3jqbza2aw1st0tll05oofbnbmrumeq3tthsrlrisjlttnfuntbiqnn0d0hjvdm4r0jnzmjhruxpqxrvnhg1mtnkdgrxk2c5dkc2tc9la0y5tufcovrybjjvdna1ngjvsu1ik1ditlvcewfkajnvafawu05yzni3zunsy1vuawqxz1g",nocase; classtype:attempted-recon; sid:200006170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"attemptdetectedpayment.com",nocase; http_uri; content:"/lloydsbank",nocase; classtype:attempted-recon; sid:200006171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"auduboninstitute-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/kramsey_auduboninstitute_org/evesqu6pzsxojjljb-ygjewbwb6dv_wn9ebmuzghm1jkbw?e=bcysta",nocase; classtype:attempted-recon; sid:200006172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"authorsationsetting-lloydsmanagement.com",nocase; http_uri; content:"/login.php",nocase; classtype:attempted-recon; sid:200006173; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"avalancheactionsport.com",nocase; http_uri; content:"/doc/index.php",nocase; classtype:attempted-recon; sid:200006174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"awdescargas.com",nocase; http_uri; content:"/peliculas",nocase; classtype:attempted-recon; sid:200006175; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"backendlessappcontent.com",nocase; http_uri; content:"/aa6f11c5-da73-fdc9-ff17-2ab002e32400/07dfc344-2601-41f8-92c7-a79a9ae5af0f/files/web/index.html",nocase; classtype:attempted-recon; sid:200006176; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ballost.org",nocase; http_uri; content:"/barbara_palvinic_breakingnews/?a=barbara_palvin&amp\;p=bitcoin_prime&amp\;cep=qra0tipfgaboldz77_jbsy_ezw3obpceykaqvhypvbzx7xzkctmjl0begcfdvwvcxytsr6voipvtjqtcmvyqhqj-m1fziqmka5jed0jfi4yld_pks1-s4hv7nmw3-chwol7szgua0lpcfcwkjbrktdpcvmtnqrzc2lpkupgrhk-voxqdxv5ihshklxa8kggze-pgbjahdbpwgter8zynuvlcxtjh8uaburxdgcnajygihskbucpqxlamo_qzrmcei8xl4jd3sy4lmwyphk4vwl63-ftji72xhoq0pj5iwxpgc7gdwdyznauhtxf-iyhp0s9yxrnlzsl4v4anyu89q-j8zlx0mfj_8na1q2mjqtjfyxiu8bvg0exrhzo-3gy6-vdhage13eudintavhvlfontd-qbjywx5nhik-6xm4u-yvtfvpmd_jnkkvf515r05pd1loyc_themttltp0dznp3wpgwfq6-lzhhvy9jwboql8avkg6d1wrw1pahkfif_n36hviyjvmlfivfstiqcepp65cbnti6kqhiysjuwieb72zcxnftjjocm3egaeiw&amp\;lptoken=16f22589212161c89401&amp\;keyword=job+search+&amp\;geo=hu&amp\;campaignname=hu+dp+desktop+asap&amp\;device=desktop&amp\;os=windows+10&amp\;browser=firefox+89&amp\;carrier=unknown&amp\;source=434214235&amp\;bid=0.0065&amp\;clickid=86368833580",nocase; classtype:attempted-recon; sid:200006177; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bamboobypanda.com",nocase; http_uri; content:"/r",nocase; classtype:attempted-recon; sid:200006178; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bamboobypanda.com",nocase; http_uri; content:"/r/",nocase; classtype:attempted-recon; sid:200006179; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bankcheckingsavings.com",nocase; http_uri; content:"/citibank-bonuses",nocase; classtype:attempted-recon; sid:200006180; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bankcheckingsavings.com",nocase; http_uri; content:"/citibank-bonuses/",nocase; classtype:attempted-recon; sid:200006181; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"baovesusonglcxt.com",nocase; http_uri; content:"/wp-includes/index.html",nocase; classtype:attempted-recon; sid:200006182; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"barberoutlet.com",nocase; http_uri; content:"/wp-includes/app/wave/wave/index.html?#misa.ani@yandex.ru",nocase; classtype:attempted-recon; sid:200006183; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"barberoutlet.com",nocase; http_uri; content:"/wp-includes/vcv/wave/wave/index.html?#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200006184; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bardaiconnect.com",nocase; http_uri; content:"/app/listeners/ae/n-nv6588123/ae/ae/verify/sms.php",nocase; classtype:attempted-recon; sid:200006185; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bbfunding-my.sharepoint.com",nocase; http_uri; content:"/personal/accounting_bluebridgefunding_com/_layouts/15/doc.aspx?sourcedoc={f0763374-6329-450f-94a4-11512ab3e2fe}&amp\;action=default&amp\;slrid=1cf04e9f-706e-0000-469d-3c7942c5beb8&amp\;originalpath=ahr0chm6ly9iymz1bmrpbmctbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvywnjb3vudgluz19ibhvlynjpzgdlznvuzgluz19jb20vrw5remr2qxbzdzlgbetrulvtcxo0djrcttnvrxnuvhjrm1fjae9qemetamxrqt9ydgltzt1ozy1mtmjqdjewzw&amp\;cid=81889f02-24c2-4efa-9e1e-1ccac075a22c",nocase; classtype:attempted-recon; sid:200006186; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bbfunding-my.sharepoint.com",nocase; http_uri; content:"/personal/accounting_bluebridgefunding_com/_layouts/15/doc.aspx?sourcedoc={f0763374-6329-450f-94a4-11512ab3e2fe}&amp\;action=default&amp\;slrid=3d693f9f-20ed-0000-3f04-fe0e8f6dfa87&amp\;originalpath=ahr0chm6ly9iymz1bmrpbmctbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvywnjb3vudgluz19ibhvlynjpzgdlznvuzgluz19jb20vrw5remr2qxbzdzlgbetrulvtcxo0djrcttnvrxnuvhjrm1fjae",nocase; classtype:attempted-recon; sid:200006187; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bbfunding-my.sharepoint.com",nocase; http_uri; content:"/personal/accounting_bluebridgefunding_com/_layouts/15/doc.aspx?sourcedoc={f0763374-6329-450f-94a4-11512ab3e2fe}&amp\;action=default&amp\;slrid=5961409f-c08a-0000-3fa1-75b979fb3192&amp\;originalpath=ahr0chm6ly9iymz1bmrpbmctbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvywnjb3vudgluz19ibhvlynjpzgdlznvuzgluz19jb20vrw5remr2qxbzdzlgbetrulvtcxo0djrcttnvrxnuvhjrm1fjae9qemetamxrqt9ydgltzt1yac0ycxkzttewzw&amp\;cid=c5f1ae7f-ac1c-4323-a07c-260e95800ab9",nocase; classtype:attempted-recon; sid:200006188; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bbfunding-my.sharepoint.com",nocase; http_uri; content:"/personal/accounting_bluebridgefunding_com/_layouts/15/doc.aspx?sourcedoc={f0763374-6329-450f-94a4-11512ab3e2fe}&amp\;action=default&amp\;slrid=59d2529f-d007-0000-3f10-e11b5cf398b3&amp\;originalpath=ahr0chm6ly9iymz1bmrpbmctbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvywnjb3vudgluz19ibhvlynjpzgdlznvuzgluz19jb20vrw5remr2qxbzdzlgbetrulvtcxo0djrcttnvrxnuvhjrm1fjae9qemetamxrqt9ydgltzt0zdnbfaxpqntewzw&amp\;cid=57281b4c-f8f3-415a-b048-b94ef5111d89",nocase; classtype:attempted-recon; sid:200006189; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bbfunding-my.sharepoint.com",nocase; http_uri; content:"/personal/accounting_bluebridgefunding_com/_layouts/15/doc.aspx?sourcedoc={f0763374-6329-450f-94a4-11512ab3e2fe}&amp\;action=default&amp\;slrid=62d2529f-7028-0000-3f04-f6b0a072a22a&amp\;originalpath=ahr0chm6ly9iymz1bmrpbmctbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvywnjb3vudgluz19ibhvlynjpzgdlznvuzgluz19jb20vrw5remr2qxbzdzlgbetrulvtcxo0djrcttnvrxnuvhjrm1fjae9qemetamxrqt9ydgltzt1jx3ktb1rqntewzw&amp\;cid=619fb8f1-b627-419b-80b1-cfd7e7cfa29b",nocase; classtype:attempted-recon; sid:200006190; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bbfunding-my.sharepoint.com",nocase; http_uri; content:"/personal/accounting_bluebridgefunding_com/_layouts/15/doc.aspx?sourcedoc={f0763374-6329-450f-94a4-11512ab3e2fe}&amp\;action=default&amp\;slrid=7927489f-2081-0000-4704-eb1a7ea7761d&amp\;originalpath=ahr0chm6ly9iymz1bmrpbmctbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvywnjb3vudgluz19ibhvlynjpzgdlznvuzgluz19jb20vrw5remr2qxbzdzlgbetrulvtcxo0djrcttnvrxnuvhjrm1fjae9qemetamxrqt9ydgltzt0zeg04whlqzjewzw&amp\;cid=69a9adbf-9a76-4925-abca-a25903c1383e",nocase; classtype:attempted-recon; sid:200006191; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bdsfa.sharepoint.com",nocase; http_uri; content:"/_layouts/15/wopiframe.aspx?guestaccesstoken=pbswcmyerrbau9nv%209vcodtblni2sahsdqci9c/qyr4=&amp\;docid=1_11dad9ed160d14dafa586323403d7fef8&amp\;wdformid={62e5338c-c4ba-43fd-ab98-d884748022e2}&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200006192; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bdsfa.sharepoint.com",nocase; http_uri; content:"/_layouts/15/wopiframe.aspx?guestaccesstoken=pbswcmyerrbau9nv%2b9vcodtblni2sahsdqci9c%2fqyr4%3d&docid=1_11dad9ed160d14dafa586323403d7fef8&wdformid=%7b62e5338c%2dc4ba%2d43fd%2dab98%2dd884748022e2%7d%2f&action=formsubmit",nocase; classtype:attempted-recon; sid:200006193; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bdsfa.sharepoint.com",nocase; http_uri; content:"/_layouts/15/wopiframe.aspx?guestaccesstoken=pbswcmyerrbau9nv%2b9vcodtblni2sahsdqci9c%2fqyr4%3d&docid=1_11dad9ed160d14dafa586323403d7fef8&wdformid=%7b62e5338c%2dc4ba%2d43fd%2dab98%2dd884748022e2%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200006194; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beansbulletsbandagesandyou.com",nocase; http_uri; content:"/bullets/wp-admin/user/algr/16668/?authorization_uri=https:%2f%2fallegro.pl%2fauth%2foauth%2fauthorize%3fclient_id%3dtb5sff3crxeyspdn%26redirect_uri%3dhttps:%2f%2fallegro.pl%2flogin%2fauth%26response_type%3dcode%26state%3dbxmolp&oauth=true",nocase; classtype:attempted-recon; sid:200006195; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beansbulletsbandagesandyou.com",nocase; http_uri; content:"/bullets/wp-admin/user/algr/5e7f0/?authorization_uri=https:%2f%2fallegro.pl%2fauth%2foauth%2fauthorize%3fclient_id%3dtb5sff3crxeyspdn%26redirect_uri%3dhttps:%2f%2fallegro.pl%2flogin%2fauth%26response_type%3dcode%26state%3dbxmolp&oauth=true",nocase; classtype:attempted-recon; sid:200006196; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beansbulletsbandagesandyou.com",nocase; http_uri; content:"/bullets/wp-admin/user/algr/?266331554-rynqlwcrvfz",nocase; classtype:attempted-recon; sid:200006197; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beansbulletsbandagesandyou.com",nocase; http_uri; content:"/bullets/wp-admin/user/algr/?333295712-opnmttsvxxp",nocase; classtype:attempted-recon; sid:200006198; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"beansbulletsbandagesandyou.com",nocase; http_uri; content:"/bullets/wp-admin/user/algr/?465525269-wlsarsvqpvp",nocase; classtype:attempted-recon; sid:200006199; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"betasus022.blogspot.com",nocase; http_uri; content:"//",nocase; classtype:attempted-recon; sid:200006200; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bhd-leon-do.eshost.com.ar",nocase; http_uri; content:"/?i=1",nocase; classtype:attempted-recon; sid:200006201; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"binggegeit.com",nocase; http_uri; content:"/wp-content/plugins/masterx/americanexpress-com.login.ent.3443n44u43/amex/amex/home",nocase; classtype:attempted-recon; sid:200006202; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"binggegeit.com",nocase; http_uri; content:"/wp-content/plugins/masterx/americanexpress-com.login.ent.3443n44u43/amex/amex/home/",nocase; classtype:attempted-recon; sid:200006203; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"biolinky.co",nocase; http_uri; content:"/exodusmobile",nocase; classtype:attempted-recon; sid:200006204; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fgday",nocase; classtype:attempted-recon; sid:200006205; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fjxoo",nocase; classtype:attempted-recon; sid:200006206; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fl4ss",nocase; classtype:attempted-recon; sid:200006207; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fq8j7",nocase; classtype:attempted-recon; sid:200006208; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fq8ka",nocase; classtype:attempted-recon; sid:200006209; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fr2lg",nocase; classtype:attempted-recon; sid:200006210; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fr2np",nocase; classtype:attempted-recon; sid:200006211; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fr3xl",nocase; classtype:attempted-recon; sid:200006212; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fr3xl/",nocase; classtype:attempted-recon; sid:200006213; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fr3xt",nocase; classtype:attempted-recon; sid:200006214; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fr3xv",nocase; classtype:attempted-recon; sid:200006215; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fr3xw",nocase; classtype:attempted-recon; sid:200006216; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fr3xw/",nocase; classtype:attempted-recon; sid:200006217; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frbmx",nocase; classtype:attempted-recon; sid:200006218; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frcsy",nocase; classtype:attempted-recon; sid:200006219; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frdxo",nocase; classtype:attempted-recon; sid:200006220; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frgpu",nocase; classtype:attempted-recon; sid:200006221; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frme6",nocase; classtype:attempted-recon; sid:200006222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frn5x",nocase; classtype:attempted-recon; sid:200006223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/froaf",nocase; classtype:attempted-recon; sid:200006224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frp2n",nocase; classtype:attempted-recon; sid:200006225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frpqv",nocase; classtype:attempted-recon; sid:200006226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frs5v",nocase; classtype:attempted-recon; sid:200006227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frsfc",nocase; classtype:attempted-recon; sid:200006228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frstw",nocase; classtype:attempted-recon; sid:200006229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frtqa",nocase; classtype:attempted-recon; sid:200006230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frx8b",nocase; classtype:attempted-recon; sid:200006231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frxsz",nocase; classtype:attempted-recon; sid:200006232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frxwh",nocase; classtype:attempted-recon; sid:200006233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frygn",nocase; classtype:attempted-recon; sid:200006234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frygp",nocase; classtype:attempted-recon; sid:200006235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frygr",nocase; classtype:attempted-recon; sid:200006236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/fryhj",nocase; classtype:attempted-recon; sid:200006237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/frzet",nocase; classtype:attempted-recon; sid:200006238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/sona994",nocase; classtype:attempted-recon; sid:200006239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.do",nocase; http_uri; content:"/tup994",nocase; classtype:attempted-recon; sid:200006240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly.",nocase; http_uri; content:"/3ijwsm2",nocase; classtype:attempted-recon; sid:200006241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2iz03nf",nocase; classtype:attempted-recon; sid:200006242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2kduy2u",nocase; classtype:attempted-recon; sid:200006243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2nog4ow?facebook_update",nocase; classtype:attempted-recon; sid:200006244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2nwrbgj",nocase; classtype:attempted-recon; sid:200006245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2oq6dhz",nocase; classtype:attempted-recon; sid:200006246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2p28z0h",nocase; classtype:attempted-recon; sid:200006247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2q7fcpg",nocase; classtype:attempted-recon; sid:200006248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2spto3d",nocase; classtype:attempted-recon; sid:200006249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2uwvcnh",nocase; classtype:attempted-recon; sid:200006250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2vuwbzk",nocase; classtype:attempted-recon; sid:200006251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2w0s7rv?confirmación",nocase; classtype:attempted-recon; sid:200006252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2w8ueyh",nocase; classtype:attempted-recon; sid:200006253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2wctuwh?/identityconfirmation",nocase; classtype:attempted-recon; sid:200006254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2we8ivg?facebook_update",nocase; classtype:attempted-recon; sid:200006255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2wqlrea",nocase; classtype:attempted-recon; sid:200006256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2x14cy1",nocase; classtype:attempted-recon; sid:200006257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2x531wu",nocase; classtype:attempted-recon; sid:200006258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2xaai2s",nocase; classtype:attempted-recon; sid:200006259; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2xai0zf",nocase; classtype:attempted-recon; sid:200006260; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2xnybd3?confirmación",nocase; classtype:attempted-recon; sid:200006261; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2xpsdtz?confirmation",nocase; classtype:attempted-recon; sid:200006262; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2xq7m0v?confirmation",nocase; classtype:attempted-recon; sid:200006263; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2xvvy8e?confirmation",nocase; classtype:attempted-recon; sid:200006264; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2xzvuon?confirmation",nocase; classtype:attempted-recon; sid:200006265; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2yxmsxe",nocase; classtype:attempted-recon; sid:200006266; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2zaee65",nocase; classtype:attempted-recon; sid:200006267; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2zejaht",nocase; classtype:attempted-recon; sid:200006268; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2zfk4ls?confirmación",nocase; classtype:attempted-recon; sid:200006269; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/2zlhdas?confirmación",nocase; classtype:attempted-recon; sid:200006270; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/31cwtqd?facebook_update",nocase; classtype:attempted-recon; sid:200006271; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/31d3mp6?facebook_service",nocase; classtype:attempted-recon; sid:200006272; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/33ipjf7",nocase; classtype:attempted-recon; sid:200006273; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/34mhgdg",nocase; classtype:attempted-recon; sid:200006274; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/35qrdnc",nocase; classtype:attempted-recon; sid:200006275; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/37r8zo3",nocase; classtype:attempted-recon; sid:200006276; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/38nxf58",nocase; classtype:attempted-recon; sid:200006277; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/38q2wtj?facebook_update",nocase; classtype:attempted-recon; sid:200006278; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/38rclcg",nocase; classtype:attempted-recon; sid:200006279; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/38xmo4d",nocase; classtype:attempted-recon; sid:200006280; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/392hszz",nocase; classtype:attempted-recon; sid:200006281; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/398jtig?confirmation",nocase; classtype:attempted-recon; sid:200006282; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/39j7mbh?confirmation",nocase; classtype:attempted-recon; sid:200006283; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/39u27x9?confirmation",nocase; classtype:attempted-recon; sid:200006284; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3ae7min?confirmación",nocase; classtype:attempted-recon; sid:200006285; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3aetm80",nocase; classtype:attempted-recon; sid:200006286; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3afo6kx",nocase; classtype:attempted-recon; sid:200006287; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3albz6d?confirmación",nocase; classtype:attempted-recon; sid:200006288; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3an4lcn",nocase; classtype:attempted-recon; sid:200006289; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3aqvwmn",nocase; classtype:attempted-recon; sid:200006290; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3ax4xgx?confirmación",nocase; classtype:attempted-recon; sid:200006291; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3bpmex0",nocase; classtype:attempted-recon; sid:200006292; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3bsgkin",nocase; classtype:attempted-recon; sid:200006293; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3cievup?confirmation",nocase; classtype:attempted-recon; sid:200006294; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3cmif4b?confirmación",nocase; classtype:attempted-recon; sid:200006295; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3cvl6ir",nocase; classtype:attempted-recon; sid:200006296; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3cwifq4",nocase; classtype:attempted-recon; sid:200006297; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3d7ezub?facebook_update",nocase; classtype:attempted-recon; sid:200006298; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3dj0r1p",nocase; classtype:attempted-recon; sid:200006299; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3dvbup4",nocase; classtype:attempted-recon; sid:200006300; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3ef7ukt?confirmación",nocase; classtype:attempted-recon; sid:200006301; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3egyfvw?confirmaci%c3%b3n",nocase; classtype:attempted-recon; sid:200006302; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3ejwrgv",nocase; classtype:attempted-recon; sid:200006303; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3ekdpzc",nocase; classtype:attempted-recon; sid:200006304; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3errulu?confirmation",nocase; classtype:attempted-recon; sid:200006305; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3fxffba",nocase; classtype:attempted-recon; sid:200006306; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3gornz8",nocase; classtype:attempted-recon; sid:200006307; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3gqja9w",nocase; classtype:attempted-recon; sid:200006308; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3ht1hrj?confirmación",nocase; classtype:attempted-recon; sid:200006309; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3hyp5kr?confirmación",nocase; classtype:attempted-recon; sid:200006310; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3i4eekh?confirmación",nocase; classtype:attempted-recon; sid:200006311; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3i8tjul",nocase; classtype:attempted-recon; sid:200006312; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3icv8om",nocase; classtype:attempted-recon; sid:200006313; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3jkyzak",nocase; classtype:attempted-recon; sid:200006314; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3jqenzp?facebook_update",nocase; classtype:attempted-recon; sid:200006315; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3k5tmzj?confirmation",nocase; classtype:attempted-recon; sid:200006316; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3ka6u52",nocase; classtype:attempted-recon; sid:200006317; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3kfzx1l?confirmation",nocase; classtype:attempted-recon; sid:200006318; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3kueruz",nocase; classtype:attempted-recon; sid:200006319; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3kv786c",nocase; classtype:attempted-recon; sid:200006320; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3kxfgbu",nocase; classtype:attempted-recon; sid:200006321; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3kyg53s?facebook_update",nocase; classtype:attempted-recon; sid:200006322; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3kyua9h?confirmación",nocase; classtype:attempted-recon; sid:200006323; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3kyxj2w?facebook_update",nocase; classtype:attempted-recon; sid:200006324; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3kztwgi?confirmación",nocase; classtype:attempted-recon; sid:200006325; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3l6t5od",nocase; classtype:attempted-recon; sid:200006326; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3ldovbh",nocase; classtype:attempted-recon; sid:200006327; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3lgmoqh",nocase; classtype:attempted-recon; sid:200006328; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3lmnuiy?confirmación",nocase; classtype:attempted-recon; sid:200006329; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3ltqm8c?confirmation",nocase; classtype:attempted-recon; sid:200006330; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3lxl5qf?confirmation",nocase; classtype:attempted-recon; sid:200006331; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3mgpwv2",nocase; classtype:attempted-recon; sid:200006332; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3mkihc9",nocase; classtype:attempted-recon; sid:200006333; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3mryk6q",nocase; classtype:attempted-recon; sid:200006334; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3mvat1h?confirmation",nocase; classtype:attempted-recon; sid:200006335; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3n7qnga",nocase; classtype:attempted-recon; sid:200006336; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3netxu3",nocase; classtype:attempted-recon; sid:200006337; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3nfg5nc?facebook_update",nocase; classtype:attempted-recon; sid:200006338; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3nuzof0?confirmación",nocase; classtype:attempted-recon; sid:200006339; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3nvr2mn",nocase; classtype:attempted-recon; sid:200006340; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3o0udu6?confirmación",nocase; classtype:attempted-recon; sid:200006341; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3o2oag3?confirmation",nocase; classtype:attempted-recon; sid:200006342; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3reovvv",nocase; classtype:attempted-recon; sid:200006343; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3swpxho",nocase; classtype:attempted-recon; sid:200006344; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3t7mybo?/identityconfirmation",nocase; classtype:attempted-recon; sid:200006345; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3thyw0m?confirmaci%c3%b3n",nocase; classtype:attempted-recon; sid:200006346; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3tks2um",nocase; classtype:attempted-recon; sid:200006347; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3tzc89x",nocase; classtype:attempted-recon; sid:200006348; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3ud55bx?confirmation",nocase; classtype:attempted-recon; sid:200006349; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3vtbyq5",nocase; classtype:attempted-recon; sid:200006350; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3wb6m3i",nocase; classtype:attempted-recon; sid:200006351; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3witpuj",nocase; classtype:attempted-recon; sid:200006352; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3yrfuty?facebook_update",nocase; classtype:attempted-recon; sid:200006353; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3yzj1hc",nocase; classtype:attempted-recon; sid:200006354; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3zbo8qj",nocase; classtype:attempted-recon; sid:200006355; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3zc21yf",nocase; classtype:attempted-recon; sid:200006356; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3zdxjzk?confirmación",nocase; classtype:attempted-recon; sid:200006357; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3zpmzsc",nocase; classtype:attempted-recon; sid:200006358; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3zuxalv?facebook_update",nocase; classtype:attempted-recon; sid:200006359; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3zvmnc2?confirmación",nocase; classtype:attempted-recon; sid:200006360; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/3zzcsqi?confirmación",nocase; classtype:attempted-recon; sid:200006361; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/coinspot-claim-bonus",nocase; classtype:attempted-recon; sid:200006362; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/conection923781",nocase; classtype:attempted-recon; sid:200006363; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/digitalbankingmps",nocase; classtype:attempted-recon; sid:200006364; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/disconosci-subito",nocase; classtype:attempted-recon; sid:200006365; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/edoardopolaccoufficiale",nocase; classtype:attempted-recon; sid:200006366; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/mr-pin",nocase; classtype:attempted-recon; sid:200006367; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/pandemicreliefpackage",nocase; classtype:attempted-recon; sid:200006368; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/portale-mps-attivazione",nocase; classtype:attempted-recon; sid:200006369; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/temp-disable",nocase; classtype:attempted-recon; sid:200006370; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/vbmghlyuo67cvbcmfglyuivbndf",nocase; classtype:attempted-recon; sid:200006371; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/verifica-modulo-mps",nocase; classtype:attempted-recon; sid:200006372; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/verifikasiakunfacebookanda2021",nocase; classtype:attempted-recon; sid:200006373; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/verifikasipemblokiran_id",nocase; classtype:attempted-recon; sid:200006374; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bit.ly",nocase; http_uri; content:"/vub-sk00",nocase; classtype:attempted-recon; sid:200006375; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/2ne0epo",nocase; classtype:attempted-recon; sid:200006376; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/2p3bbbs",nocase; classtype:attempted-recon; sid:200006377; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/2sfygwy",nocase; classtype:attempted-recon; sid:200006378; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/369t78f",nocase; classtype:attempted-recon; sid:200006379; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/3aolo2y",nocase; classtype:attempted-recon; sid:200006380; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/3g1epw3",nocase; classtype:attempted-recon; sid:200006381; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/3jrtmmu",nocase; classtype:attempted-recon; sid:200006382; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/3koilft",nocase; classtype:attempted-recon; sid:200006383; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/3prjhpk",nocase; classtype:attempted-recon; sid:200006384; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/3vufm8l",nocase; classtype:attempted-recon; sid:200006385; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bitly.com",nocase; http_uri; content:"/3xmjxs4",nocase; classtype:attempted-recon; sid:200006386; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bodegalatinacorp-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/012dsd_fiestamart_com/_layouts/15/wopiframe.aspx?guestaccesstoken=t3v5ldmmhrtlw5cyiohlp9z4yo7ufnrop9j1plyfdkm%3d&docid=1_1d89d259f7e704301aca26ac4dbabaa8d&wdformid=%7bfeb771e5%2d93ee%2d4015%2d8e87%2dd1c30d0f406a%7d&action=formsubmit&cid=f609fe16-56c4-4e2b-a964-75e250d31c99",nocase; classtype:attempted-recon; sid:200006387; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bofa.com-onlinebanking.com",nocase; http_uri; content:"/xvezwsfzwwkhhm3b6zezgdfzeahvksep0ulvwu1nvvldosfpvv20xc1phzdnkruzuzfrstfnxwxdhme01vm5gt1n6zexlwfzvuvc5b1kzsjnrv0ywvm10sljuqjrzetk2vfvwrlvtafpovkeyujaxwgjuqmhnrtvzvdfkyvpsrljzbtb3tlv4yvjvsm9wwepzyznvefmymhdubuphyudob1pwbhlkm0jpverkevdytlbiamhcvdbjmvlxehlxazqxzws5su1uzg1rblpavkhsdvf5ohdua1pytjnvcmfwvmpvwfpgufmwdfzwvjvusfzoym0xu1rsum9arxblvku1cmjxc3jkeja5ls1iodg4n2zmyjnmymfhntzlymi4ntqymjy4yjdlyzjjyjc1owmwy2yx",nocase; classtype:attempted-recon; sid:200006388; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bom.to",nocase; http_uri; content:"/nlozan9lgoapq",nocase; classtype:attempted-recon; sid:200006389; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bombogadget.com",nocase; http_uri; content:"/public/-/areaclient/",nocase; classtype:attempted-recon; sid:200006390; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bonomequedoencasa.blogspot.com",nocase; http_uri; content:"/?aplicar",nocase; classtype:attempted-recon; sid:200006391; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bowmanconsultinggroup-my.sharepoint.com",nocase; http_uri; content:"/personal/rbennett_bowmanconsulting_com/_layouts/15/onedrive.aspx?id=/personal/rbennett_bowmanconsulting_com/documents/attachments/3/parcel209_fundsrequisition(rev).pdf&amp\;parent=/personal/rbennett_bowmanconsulting_com/documents/attachments/3&amp\;cid=3cd8dcbb-0e98-40c4-803e-02e9139b0130",nocase; classtype:attempted-recon; sid:200006392; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bowmanconsultinggroup-my.sharepoint.com",nocase; http_uri; content:"/personal/rbennett_bowmanconsulting_com/_layouts/15/onedrive.aspx?id=/personal/rbennett_bowmanconsulting_com/documents/attachments/3/parcel209_fundsrequisition(rev).pdf&amp\;parent=/personal/rbennett_bowmanconsulting_com/documents/attachments/3&amp\;cid=821bbc7d-47b9-43c4-b158-eb4f8a6a6eb2",nocase; classtype:attempted-recon; sid:200006393; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bowmanconsultinggroup-my.sharepoint.com",nocase; http_uri; content:"/personal/rbennett_bowmanconsulting_com/_layouts/15/onedrive.aspx?id=/personal/rbennett_bowmanconsulting_com/documents/attachments/3/parcel209_fundsrequisition(rev).pdf&amp\;parent=/personal/rbennett_bowmanconsulting_com/documents/attachments/3&amp\;originalpath=ahr0chm6ly9ib3dtyw5jb25zdwx0aw5nz3jvdxatbxkuc2hhcmvwb2ludc5jb20vomi6l2cvcgvyc29uywwvcmjlbm5ldhrfym93bwfuy29uc3vsdgluz19jb20vrvzuzhrfsdfjvtfmb3l5qlpkdi0wbffcuxrowec5rgu3rkhnu01cmfv0bzv2dz9ydgltzt1qve9itvhevtewzw",nocase; classtype:attempted-recon; sid:200006394; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bowmanconsultinggroup-my.sharepoint.com",nocase; http_uri; content:"/personal/rbennett_bowmanconsulting_com/_layouts/15/onedrive.aspx?id=/personal/rbennett_bowmanconsulting_com/documents/attachments/3/parcel209_fundsrequisition(rev).pdf&amp\;parent=/personal/rbennett_bowmanconsulting_com/documents/attachments/3&amp\;originalpath=ahr0chm6ly9ib3dtyw5jb25zdwx0aw5nz3jvdxatbxkuc2hhcmvwb2ludc5jb20vomi6l2cvcgvyc29uywwvcmjlbm5ldhrfym93bwfuy29uc3vsdgluz19jb20vrvzuzhrfsdfjvtfmb3l5qlpkdi0wbffcuxrowec5rgu3rkhnu01cmfv0bzv2dz9ydgltzt1ub3u1mfuwtjjfzw",nocase; classtype:attempted-recon; sid:200006395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bravobeveiliging-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/r_bouman_bravobeveiliging_nl/eiafjbddqltcmdxxrdbajdsbhfr37kusmucacmgoxitraa?e=drnrdm",nocase; classtype:attempted-recon; sid:200006396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bravobeveiliging-my.sharepoint.com",nocase; http_uri; content:"/personal/r_bouman_bravobeveiliging_nl/_layouts/15/doc.aspx?sourcedoc={b08d0520-a8dd-42bb-9835-d7443040243b}&amp\;action=default&amp\;slrid=1bef3f9f-6078-2000-b22e-969d6b1087ac&amp\;originalpath=ahr0chm6ly9icmf2b2jldmvpbglnaw5nlw15lnnoyxjlcg9pbnquy29tlzpvoi9nl3blcnnvbmfsl3jfym91bwfux2jyyxzvymv2zwlsawdpbmdfbmwvrwlbrmpirgrxthrdburywfjeqkfkrhncagzsmzdlvxnnvunhy01nt3hjvfjhqt9ydgltzt02wvjzd2hitdewzw&amp\;cid=fa76d1ab-0178-4af6-9277-2f7cec72f87f",nocase; classtype:attempted-recon; sid:200006397; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bravobeveiliging-my.sharepoint.com",nocase; http_uri; content:"/personal/r_bouman_bravobeveiliging_nl/_layouts/15/doc.aspx?sourcedoc={b08d0520-a8dd-42bb-9835-d7443040243b}&amp\;action=default&amp\;slrid=8cda429f-002e-2000-286c-d631557a1a52&amp\;originalpath=ahr0chm6ly9icmf2b2jldmvpbglnaw5nlw15lnnoyxjlcg9pbnquy29tlzpvoi9nl3blcnnvbmfsl3jfym91bwfux2jyyxzvymv2zwlsawdpbmdfbmwvrwlbrmpirgrxthrdburywfjeqkfkrhncagzsmzdlvxnnvunhy01nt3hjvfjhqt9ydgltzt0tckpwa0rmuzewzw&amp\;cid=23ce5c18-dd3c-4739-8673-ca39efd1bbee",nocase; classtype:attempted-recon; sid:200006398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bridgewaterma-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/mkhunt_bridgewaterma_org/_layouts/15/wopiframe.aspx?guestaccesstoken=qhrrwxcv%2fa2j8c%2fukg2hcmebzjijcu25gjll3su0xl0%3d&amp\;docid=1_16e44d08a60144801bbfe65418a14c35f&amp\;wdformid=%7b40dfd724%2db9a0%2d4f06%2d934b%2d85e6c322e875%7d&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200006399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"bridgewaterma-my.sharepoint.com",nocase; http_uri; content:"/personal/mkhunt_bridgewaterma_org/_layouts/15/wopiframe.aspx?guestaccesstoken=/xnniui8cbcaalna0dt7bvzueqrakfgntkhwho5/z2k=&amp\;docid=1_16402b4f119204432b5a25eea9ef2a029&amp\;wdformid={154f97ef-3518-47f6-97a6-e96e783894e8}&amp\;action=formsubmit&amp\;cid=7e4a2819-73c1-4fca-9921-c9b62a19bd37",nocase; classtype:attempted-recon; sid:200006400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"britainwestmotorsport.com",nocase; http_uri; content:"/wp-content/plugins/login.globalsources.com/sso/generalmanager.php",nocase; classtype:attempted-recon; sid:200006401; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c11.kr",nocase; http_uri; content:"/q72e",nocase; classtype:attempted-recon; sid:200006402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"c11.kr",nocase; http_uri; content:"/qiq3",nocase; classtype:attempted-recon; sid:200006403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cabconnect.com.au",nocase; http_uri; content:"/images/wet/2020dhl_topscript/dhl_topscript/cmd-login=1594971c7415418b0ac0a21c58af3912",nocase; classtype:attempted-recon; sid:200006404; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cabconnect.com.au",nocase; http_uri; content:"/images/wet/2020dhl_topscript/dhl_topscript/cmd-login=1594971c7415418b0ac0a21c58af3912/?email=&amp\;loginpage=&amp\;reff=nwm2zgjjoge5ztziyzaznwzin2yynjnlmdjindljm2e=",nocase; classtype:attempted-recon; sid:200006405; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cabconnect.com.au",nocase; http_uri; content:"/images/wet/2020dhl_topscript/dhl_topscript/cmd-login=1594971c7415418b0ac0a21c58af3912?email=&amp\;loginpage=&amp\;reff=nwm2zgjjoge5ztziyzaznwzin2yynjnlmdjindljm2e=",nocase; classtype:attempted-recon; sid:200006406; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"caixa-app.comb1.sg-host.com",nocase; http_uri; content:"/sac/seguro/",nocase; classtype:attempted-recon; sid:200006407; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"caixa-app.comb1.sg-host.com",nocase; http_uri; content:"/sac/seguro/home.html",nocase; classtype:attempted-recon; sid:200006408; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"camaieufr.commander1.com",nocase; http_uri; content:"/c3/?tcs=3206&amp\;chn=email&amp\;src=fid&amp\;cmp=fr_fid_s21_20200518_relance%201_fashion_ticket_tropical_bonusp_actives&amp\;uid=7086818&amp\;user_num_personne=7086818&amp\;e5=24c4eb200e71b3eb38cd32a42a5f2cc5&amp\;s6=81f1690cc2f5589790304e5e3f98360bd48350cd09ff6e39cc8cd0a6e00d5ff2&amp\;med=email_fid&amp\;url=https%3a%2f%2feyheremendy.com%2fno",nocase; classtype:attempted-recon; sid:200006409; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"carnegieproperty-my.sharepoint.com",nocase; http_uri; content:"/personal/helen_carnegieproperty_com/_layouts/15/wopiframe.aspx?guestaccesstoken=i93ri6e azsglandv8xwijahnamcfopa87otqqw4lly=&amp\;docid=1_18f09536ac24d4b6c9bd785b3d27746bc&amp\;wdformid={59ac2fc4-0767-42b6-a127-cc529a92b57e}&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200006410; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"carnegieproperty-my.sharepoint.com",nocase; http_uri; content:"/personal/helen_carnegieproperty_com/_layouts/15/wopiframe.aspx?guestaccesstoken=i93ri6e+azsglandv8xwijahnamcfopa87otqqw4lly=&amp\;docid=1_18f09536ac24d4b6c9bd785b3d27746bc&amp\;wdformid={59ac2fc4-0767-42b6-a127-cc529a92b57e}&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200006411; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"casteels-my.sharepoint.com",nocase; http_uri; content:"/personal/c_flemal_casteels_fr/_layouts/15/doc.aspx?sourcedoc=%7bac01bb45-c705-4f5f-8e7b-f57fd9daf685%7d&amp\;action=default&amp\;slrid=5693e09f-10cf-c000-546d-77ec6ca5a846&amp\;originalpath=ahr0chm6ly9jyxn0zwvscy1tes5zagfyzxbvaw50lmnvbs86bzovzy9wzxjzb25hbc9jx2zszw1hbf9jyxn0zwvsc19mci9fa1c3qwf3rngxovbqbnyxzjluytlvvuiyakvlb0xnwgdyvudizvpqshvgvevrp3j0aw1lputpuup0mgrumlvn&amp\;cid=5a243ddd-6725-481f-a04f-2a70203b7ad9",nocase; classtype:attempted-recon; sid:200006412; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"castillohousing-my.sharepoint.com",nocase; http_uri; content:"/personal/acastillo_castillohousing_com/_layouts/15/wopiframe.aspx",nocase; classtype:attempted-recon; sid:200006413; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cbic.org.br",nocase; http_uri; content:"/wp-content/uploads/wpallimport/logs/7bbea5ce9b2c639903ba92174b2eb446/sfr/2.html",nocase; classtype:attempted-recon; sid:200006414; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cc.bingj.com",nocase; http_uri; content:"/cache.aspx?q=1and1%20webmail&d=4934591237720511&mkt=fr-fr&setlang=en-us&w=zwlbvlrpoedd_lvvki3ozinleekk_izq",nocase; classtype:attempted-recon; sid:200006415; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cc.bingj.com",nocase; http_uri; content:"/cache.aspx?q=1and1+webmail&d=4934591237720511&mkt=fr-fr&setlang=en-us&w=zwlbvlrpoedd_lvvki3ozinleekk_izq",nocase; classtype:attempted-recon; sid:200006416; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cc.bingj.com",nocase; http_uri; content:"/cache.aspx?q=https://navidmedshop.com/shop/page/1/?per_page=9&d=4934591237720511&mkt=en-us&setlang=en-us&w=cgljurrpoedd_lvvki3ozinleekk_izq",nocase; classtype:attempted-recon; sid:200006417; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cdn.shopify.com",nocase; http_uri; content:"/s/files/1/0533/5367/6992/t/3/assets/home.html",nocase; classtype:attempted-recon; sid:200006418; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"censor.be",nocase; http_uri; content:"/wordpress/ca%203.0/20b30acdc19312ac791ebadc9a6d1bd6",nocase; classtype:attempted-recon; sid:200006419; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"censor.be",nocase; http_uri; content:"/wordpress/ca%203.0/401a7dce791c5c5291f169f1bb453a68",nocase; classtype:attempted-recon; sid:200006420; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"censor.be",nocase; http_uri; content:"/wordpress/ca%203.0/495025e56d36c670195208df7878a768/",nocase; classtype:attempted-recon; sid:200006421; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"censor.be",nocase; http_uri; content:"/wordpress/ca%203.0/a9ee36cfa4fb04943423348ae99f6fad/?user-agent=mozilla/5.0",nocase; classtype:attempted-recon; sid:200006422; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"censor.be",nocase; http_uri; content:"/wordpress/ca%203.0/ee4938ed34119b3d2025a4a9b4028196/",nocase; classtype:attempted-recon; sid:200006423; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"centerstlending-my.sharepoint.com",nocase; http_uri; content:"/personal/rnewcomer_centerstreetlending_com/_layouts/15/wopiframe.aspx?guestaccesstoken=j%2f9wodhj7u8077urui6lxbx%2b9vwlzr11ry0pztfyrwq%3d&docid=1_1fabe326fc77a4441995d0cc407c8c49c&wdformid=%7b56d05c68%2d7055%2d4573%2db79b%2df286b64f5853%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200006424; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chaisalert.com",nocase; http_uri; content:"/basic.php?k=4fa9db0267dbfa61c8978ff8809f6b071f02c997&amp\;viewed=1",nocase; classtype:attempted-recon; sid:200006425; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chase.ictprosupport.com",nocase; http_uri; content:"/en/?63686173652e69637470726f737570706f72742e636f6d",nocase; classtype:attempted-recon; sid:200006426; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chase.ictprosupport.com",nocase; http_uri; content:"/en/?7777772e63686173652e69637470726f737570706f72742e636f6d",nocase; classtype:attempted-recon; sid:200006427; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"chronopostvalidation.blogspot.com",nocase; http_uri; content:"/2021/02/blog-post_12.html",nocase; classtype:attempted-recon; sid:200006428; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cimslp-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/eric_cimsltd_com/_layouts/15/wopiframe.aspx?guestaccesstoken=wnhqsp58ikn1qzzozpe2oiw%2fmizdr53wegdbyscml7y%3d&amp\;docid=1_1207bcf2f71094b5cb97dcb5bea3e1a3a&amp\;wdformid=%7bd98de46a%2d2777%2d417f%2dbbcf%2d5f08c8244727%7d&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200006429; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cingular-oac.qpass.com",nocase; http_uri; content:"/oac/html/signin.do",nocase; classtype:attempted-recon; sid:200006430; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cityschools2013-my.sharepoint.com",nocase; http_uri; content:"/personal/mkphenicie_bcps_k12_md_us/_layouts/15/wopiframe.aspx?guestaccesstoken=8mqz0pbaequkjg%2bwcpnqtgwrswdh4azr%2bsinor8cw8m%3d&docid=1_1058175d7d73f4b39bb114b0dd340d168&wdformid=%7b1fd2a3e2%2d7ce8%2d4700%2db944%2d171b6be0cea6%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200006431; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"click.email.office.com",nocase; http_uri; content:"/?qs=9cf30363dd29315c3e11be7b9f86e0023a565c20a2375038e17cde83e3918d351e9c862894eecd698e1a9bb86157937bcf1b994ad1bf797a",nocase; classtype:attempted-recon; sid:200006432; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"click.mail.onedrive.com",nocase; http_uri; content:"/?qs=db04a8b2d7b04d1f6b3c69c4c5805dfc93097e61c800b87bab9654d4ce1ee7f86c05b36196ea1c673c13d490edbadd368c6e8f39eb68b3bb",nocase; classtype:attempted-recon; sid:200006433; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"click.message.fruit.com",nocase; http_uri; content:"/?qs=6541641088c869552ced792d84ee93eabf075e23cd5eba83a7d07a40ad9cf2ce36c931984719b9df7de658999defbc87f999ec46970a0280",nocase; classtype:attempted-recon; sid:200006434; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"click.revue.email",nocase; http_uri; content:"/ss/c/tvitjqfghbuvlofgnpyl4uof67l7qnl-5p0vrfsh0250gkywtj3mompakku6ehhukbju8gdeiervr7rwjzt2joq6yhmrdtwslxva2dc9fc2o9bsdyfuiq8eafz4jnao5valcohfzjnpazif6buzxi-i56d-9blisqzd233ddtd6be5mianyfhumjyasf2frxpbrnpqkeollmd9ctw7ctyg/3ff/ko1fgkirrcgjlfoiwwitqa/h2/7sgijbo1m4syyzyx7rszrw2k6qym7v6mesywwqy_dum",nocase; classtype:attempted-recon; sid:200006435; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clickent.co.jp",nocase; http_uri; content:"/owa",nocase; classtype:attempted-recon; sid:200006436; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clickent.co.jp",nocase; http_uri; content:"/owa/",nocase; classtype:attempted-recon; sid:200006437; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...",nocase; classtype:attempted-recon; sid:200006438; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......",nocase; classtype:attempted-recon; sid:200006439; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.........",nocase; classtype:attempted-recon; sid:200006440; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/............",nocase; classtype:attempted-recon; sid:200006441; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.........x",nocase; classtype:attempted-recon; sid:200006442; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.........x...",nocase; classtype:attempted-recon; sid:200006443; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......x",nocase; classtype:attempted-recon; sid:200006444; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......x...",nocase; classtype:attempted-recon; sid:200006445; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx",nocase; classtype:attempted-recon; sid:200006446; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx...",nocase; classtype:attempted-recon; sid:200006447; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx....",nocase; classtype:attempted-recon; sid:200006448; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx......",nocase; classtype:attempted-recon; sid:200006449; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx.../",nocase; classtype:attempted-recon; sid:200006450; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx.../...",nocase; classtype:attempted-recon; sid:200006451; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx.../......",nocase; classtype:attempted-recon; sid:200006452; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx.../...x",nocase; classtype:attempted-recon; sid:200006453; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx.../...x...",nocase; classtype:attempted-recon; sid:200006454; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx.../...x...x",nocase; classtype:attempted-recon; sid:200006455; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx.../...xx",nocase; classtype:attempted-recon; sid:200006456; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx.../...xx...",nocase; classtype:attempted-recon; sid:200006457; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx.../x",nocase; classtype:attempted-recon; sid:200006458; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx.../x...",nocase; classtype:attempted-recon; sid:200006459; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx.../x......",nocase; classtype:attempted-recon; sid:200006460; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx.../xx",nocase; classtype:attempted-recon; sid:200006461; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx.../xx...",nocase; classtype:attempted-recon; sid:200006462; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx.../xxx",nocase; classtype:attempted-recon; sid:200006463; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx...x",nocase; classtype:attempted-recon; sid:200006464; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/......xx...xx",nocase; classtype:attempted-recon; sid:200006465; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...x",nocase; classtype:attempted-recon; sid:200006466; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...x...",nocase; classtype:attempted-recon; sid:200006467; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xx",nocase; classtype:attempted-recon; sid:200006468; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xxx",nocase; classtype:attempted-recon; sid:200006469; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xxx...",nocase; classtype:attempted-recon; sid:200006470; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xxx......",nocase; classtype:attempted-recon; sid:200006471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xxx.........",nocase; classtype:attempted-recon; sid:200006472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xxx............",nocase; classtype:attempted-recon; sid:200006473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xxx........./",nocase; classtype:attempted-recon; sid:200006474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xxx........./...",nocase; classtype:attempted-recon; sid:200006475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xxx........./......",nocase; classtype:attempted-recon; sid:200006476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xxx........./.........",nocase; classtype:attempted-recon; sid:200006477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xxx........./...x",nocase; classtype:attempted-recon; sid:200006478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xxx........./x",nocase; classtype:attempted-recon; sid:200006479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xxx........./x...",nocase; classtype:attempted-recon; sid:200006480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xxx...x",nocase; classtype:attempted-recon; sid:200006481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xxx...x...",nocase; classtype:attempted-recon; sid:200006482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/...xxxx",nocase; classtype:attempted-recon; sid:200006483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./.x",nocase; classtype:attempted-recon; sid:200006484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./.x...",nocase; classtype:attempted-recon; sid:200006485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./.xx",nocase; classtype:attempted-recon; sid:200006486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx",nocase; classtype:attempted-recon; sid:200006487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...",nocase; classtype:attempted-recon; sid:200006488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx......",nocase; classtype:attempted-recon; sid:200006489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x",nocase; classtype:attempted-recon; sid:200006490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x...",nocase; classtype:attempted-recon; sid:200006491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x......",nocase; classtype:attempted-recon; sid:200006492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x.........",nocase; classtype:attempted-recon; sid:200006493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x............",nocase; classtype:attempted-recon; sid:200006494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x.........x",nocase; classtype:attempted-recon; sid:200006495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x.........x/",nocase; classtype:attempted-recon; sid:200006496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x.........x/...",nocase; classtype:attempted-recon; sid:200006497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x.........x/......",nocase; classtype:attempted-recon; sid:200006498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x.........x/........",nocase; classtype:attempted-recon; sid:200006499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x.........x/...x",nocase; classtype:attempted-recon; sid:200006500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x.........x/x",nocase; classtype:attempted-recon; sid:200006501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x.........x/x...",nocase; classtype:attempted-recon; sid:200006502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x.........x/x......",nocase; classtype:attempted-recon; sid:200006503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x.........x/xx",nocase; classtype:attempted-recon; sid:200006504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x......x",nocase; classtype:attempted-recon; sid:200006505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x...x",nocase; classtype:attempted-recon; sid:200006506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x...x...",nocase; classtype:attempted-recon; sid:200006507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x...xx",nocase; classtype:attempted-recon; sid:200006508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...x...xxx",nocase; classtype:attempted-recon; sid:200006509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...xx",nocase; classtype:attempted-recon; sid:200006510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...xx...",nocase; classtype:attempted-recon; sid:200006511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...xx......",nocase; classtype:attempted-recon; sid:200006512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...xx...x",nocase; classtype:attempted-recon; sid:200006513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...xx...x...",nocase; classtype:attempted-recon; sid:200006514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...xx...xx",nocase; classtype:attempted-recon; sid:200006515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...xxx",nocase; classtype:attempted-recon; sid:200006516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...xxx...",nocase; classtype:attempted-recon; sid:200006517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...xxx......",nocase; classtype:attempted-recon; sid:200006518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...xxx.........",nocase; classtype:attempted-recon; sid:200006519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...xxx...x",nocase; classtype:attempted-recon; sid:200006520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx...xxxx",nocase; classtype:attempted-recon; sid:200006521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx.x.xxx",nocase; classtype:attempted-recon; sid:200006522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx.x.xxx...",nocase; classtype:attempted-recon; sid:200006523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx.xx.x",nocase; classtype:attempted-recon; sid:200006524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx.xx.x...",nocase; classtype:attempted-recon; sid:200006525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx.xx.xx",nocase; classtype:attempted-recon; sid:200006526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xx.xxx.x",nocase; classtype:attempted-recon; sid:200006527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xxx",nocase; classtype:attempted-recon; sid:200006528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xxxx",nocase; classtype:attempted-recon; sid:200006529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xxxx/x",nocase; classtype:attempted-recon; sid:200006530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xxxx/x.",nocase; classtype:attempted-recon; sid:200006531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xxxxx",nocase; classtype:attempted-recon; sid:200006532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xxxxx...",nocase; classtype:attempted-recon; sid:200006533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/.xx./xxxxxx",nocase; classtype:attempted-recon; sid:200006534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/common/oauth2/authorize",nocase; classtype:attempted-recon; sid:200006535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/common/oauth2/authorize-cli...",nocase; classtype:attempted-recon; sid:200006536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/common/oauth2/authorize-client_id-43435a7b9-9a363-49130-a426-35363201d503",nocase; classtype:attempted-recon; sid:200006537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/common/oauth2/authorize-client_id-43435a7b9-9a363-49130-a426-35363201d503&amp\;redirect_uri-www--com-response_type-code-id_token&amp\;scope-openid-profile&amp\;response_mode-form_post&amp\;nonce-637402967941920791-y2fknjezmmqtzte1nc00njbklwfiotytowexmdcwytjlm2q2n2zlmdiwnjctowiyys00mzzhlwi0njctyzi3nmm2ogixzme4&amp\;ui_locales=en-us&amp\;mkt=en-us&amp\;client-request-idaa28d8e1-058b-4002-a687-8a271de76ed6&amp\;state=7ynxu_43bb49obxk6fyelmfrs5zpa0bltgntumd69tf91ft_9m0bsx-gadmxhr-754mywj7sdaghfnzhznzawczy-zaiek46cgccir6gurmildmgtns7hrsmtd9is8tcex7qd5izrcnveq5hvapci7o5wfvlbb23skrup7ujynpdzal8rxv-h9vd_qceedxdc7zv6qacmliyzgfchx1sasnit35gvd1uvbrktdrptsx8a66jqlysfuo03gjhggaeyflaca-wxtin2fb3qljmhq&amp\;x",nocase; classtype:attempted-recon; sid:200006538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/common/oauth2/authorize-client_id-43435a7b9-9a363-49130-a426-35363201d503&amp\;redirect_uri-www-office-com-response_type-code-id_to",nocase; classtype:attempted-recon; sid:200006539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/common/oauth2/authorize-client_id-43435a7b9-9a363-49130-a426-35363201d503&amp\;redirect_uri-www-office-com-response_type-code-id_token&amp\;scope-openid-",nocase; classtype:attempted-recon; sid:200006540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/common/oauth2/authorize-client_id-43435a7b9-9a363-49130-a426-35363201d503&amp\;redirect_uri-www-office-com-response_type-code-id_token&amp\;scope-openid-profile&amp\;response_mode-form_post&amp\;nonce-637402967941920791-y2fknjezmmqtzte1nc00njbklwfiotytowexmdcwytjlm2q2n2zlmdiwnjctowiyys00mzzhlwi0njctyzi3nmm2ogixzme4&amp\;ui_locales=en-us&amp\;mkt=en-us&amp\;client-request-idaa28d8e1-058b-4002-a687-8a271de76ed6&amp\;state=7ynxu_43bb49obxk6fyelmfrs5zpa0bltgntumd69tf91ft_9m0bsx-gadmxhr-754mywj7sd",nocase; classtype:attempted-recon; sid:200006541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/js/chunk-vendors.2b75c796.j",nocase; classtype:attempted-recon; sid:200006542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/js/chunk-vendors.2b75c796.j...",nocase; classtype:attempted-recon; sid:200006543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/js/chunk-vendors.2b75c796.js(line",nocase; classtype:attempted-recon; sid:200006544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/js/chunk-vendors.2b75c796.js...",nocase; classtype:attempted-recon; sid:200006545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/x",nocase; classtype:attempted-recon; sid:200006546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/x...",nocase; classtype:attempted-recon; sid:200006547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/xx/xx",nocase; classtype:attempted-recon; sid:200006548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/xxx",nocase; classtype:attempted-recon; sid:200006549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/xxx/",nocase; classtype:attempted-recon; sid:200006550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"clouddoc-authorize.firebaseapp.com",nocase; http_uri; content:"/xxxx",nocase; classtype:attempted-recon; sid:200006551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloudflare-ipfs.com",nocase; http_uri; content:"/ipfs/qmdjapbwfsgua9vknmbswgfga4y5kj2vnnphvcsc8nc7ia/",nocase; classtype:attempted-recon; sid:200006552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloudzure.in",nocase; http_uri; content:"/sign-on",nocase; classtype:attempted-recon; sid:200006553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloudzure.in",nocase; http_uri; content:"/sign-on/",nocase; classtype:attempted-recon; sid:200006554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloudzure.in",nocase; http_uri; content:"/sign-on/secure/",nocase; classtype:attempted-recon; sid:200006555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloudzure.in",nocase; http_uri; content:"/sign-on/secure/index.php?secure-auth/=",nocase; classtype:attempted-recon; sid:200006556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloudzure.in",nocase; http_uri; content:"/sign-on/secure/t.goe/index.html?secure-auth/login?execution/cmd=login_submit&amp\;id=67f972281d8a7993f8df185e2529531367f972281d8a7993f8df185e25295313&amp\;session=67f972281d8a7993f8df185e2529531367f972281d8a7993f8df185e25295313",nocase; classtype:attempted-recon; sid:200006557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloudzure.in",nocase; http_uri; content:"/sign-on/secure/t.goe/index.html?secure-auth/login?execution/cmd=login_submit&id=11a55c9ec0bcf3eda3fb6177123132a211a55c9ec0bcf3eda3fb6177123132a2&session=11a55c9ec0bcf3eda3fb6177123132a211a55c9ec0bcf3eda3fb6177123132a2",nocase; classtype:attempted-recon; sid:200006558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloudzure.in",nocase; http_uri; content:"/sign-on/secure/t.goe/index.html?secure-auth/login?execution/cmd=login_submit&id=68d295345c4d31058cea949d1729e87c68d295345c4d31058cea949d1729e87c&session=68d295345c4d31058cea949d1729e87c68d295345c4d31058cea949d1729e87c",nocase; classtype:attempted-recon; sid:200006559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloudzure.in",nocase; http_uri; content:"/sign-on/secure/t.goe/index.html?secure-auth/login?execution/cmd=login_submit&id=a590018b00a5d070db779d92023733c1a590018b00a5d070db779d92023733c1&session=a590018b00a5d070db779d92023733c1a590018b00a5d070db779d92023733c1",nocase; classtype:attempted-recon; sid:200006560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cloudzure.in",nocase; http_uri; content:"/sign-on/secure/t.goe/profile-setting.html?7777772e636c6f75647a7572652e696e-7777772e636c6f75647a7572652e696e-7777772e636c6f75647a7572652e696e7777772e636c6f75647a7572652e696e7777772e636c6f75647a7572652e696e7777772e636c6f75647a7572652e696e7777772e636c6f75647a7572652e696e7777772e636c6f75647a7572652e696e7777772e636c6f75647a7572652e696e7777772e636c6f75647a7572652e696e7777772e636c6f75647a7572652e696e",nocase; classtype:attempted-recon; sid:200006561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cnam.md",nocase; http_uri; content:"/object/html_elements/laxx/en.php",nocase; classtype:attempted-recon; sid:200006562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cnam.md",nocase; http_uri; content:"/object/html_elements/laxx/en.php?rand=13inboxlightaspxn.1774256418&amp\;fid.4.1252899642&amp\;fid=1&amp\;fav.1&amp\;rand.13inboxlight.aspxn.1774256418&amp\;fid.1252899642&amp\;fid.1&amp\;fav.1&amp\;email=umf5lmlvenpvqhdlbgxzzmfyz29hzhzpc29ycy5jb20=&amp\;.rand=13inboxlight.aspx?n=1774256418&amp\;fid=4",nocase; classtype:attempted-recon; sid:200006563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"coastwholesaleappliances-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/mfiorini_coastappliances_com/ekgio42ixgvmrgruj7hsx1sbuji-eqg6t2m9bxmcb9latw?e=4smg",nocase; classtype:attempted-recon; sid:200006564; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"coda.io",nocase; http_uri; content:"/d/microsoft-office365_duu9pzwq-rk",nocase; classtype:attempted-recon; sid:200006565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cognitoforms.com",nocase; http_uri; content:"/governmentpandemicbonus/form3",nocase; classtype:attempted-recon; sid:200006566; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"collinsflg-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/kristin_collinsfamilylaw_com/euf0wztyhj9kqzxuzlzixyabi4yll8ikkpy9hzw5mqnk3w?e=l7oitq",nocase; classtype:attempted-recon; sid:200006567; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"columbiaps-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/agerzen_cpsk12_org/_layouts/15/wopiframe.aspx?guestaccesstoken=usnbe6ybjho9h25fk68jtyi54ok8%2b9ellr1aq%2fst9k8%3d&docid=1_1b3a9c7812c9d4683b1b5cc7fc8ae677d&wdformid=%7bf32b5748%2d8761%2d4d74%2db73e%2d295011a92875%7d&action=formsubmit&cid=84c7b00e-f",nocase; classtype:attempted-recon; sid:200006568; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"columbiaps-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/agerzen_cpsk12_org/_layouts/15/wopiframe.aspx?guestaccesstoken=usnbe6ybjho9h25fk68jtyi54ok8%2b9ellr1aq%2fst9k8%3d&docid=1_1b3a9c7812c9d4683b1b5cc7fc8ae677d&wdformid=%7bf32b5748%2d8761%2d4d74%2db73e%2d295011a92875%7d&action=formsubmit&cid=84c7b00e-fca9-46c9-b4f6-6c3148ca22a4",nocase; classtype:attempted-recon; sid:200006569; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"columbiaps-my.sharepoint.com",nocase; http_uri; content:"/personal/agerzen_cpsk12_org/_layouts/15/wopiframe.aspx?guestaccesstoken=usnbe6ybjho9h25fk68jtyi54ok8%2b9ellr1aq%2fst9k8%3d&docid=1_1b3a9c7812c9d4683b1b5cc7fc8ae677d&wdformid=%7bf32b5748%2d8761%2d4d74%2db73e%2d295011a92875%7d&action=formsubmit&cid=84c7b00e-f",nocase; classtype:attempted-recon; sid:200006570; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"columbiaps-my.sharepoint.com",nocase; http_uri; content:"/personal/agerzen_cpsk12_org/_layouts/15/wopiframe.aspx?guestaccesstoken=usnbe6ybjho9h25fk68jtyi54ok8%2b9ellr1aq%2fst9k8%3d&docid=1_1b3a9c7812c9d4683b1b5cc7fc8ae677d&wdformid=%7bf32b5748%2d8761%2d4d74%2db73e%2d295011a92875%7d&action=formsubmit&cid=84c7b00e-fca9-46c9-b4f6-6c3148ca22a4",nocase; classtype:attempted-recon; sid:200006571; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"communicourt-my.sharepoint.com",nocase; http_uri; content:"/personal/nicky_tolley_communicourt_co_uk/_layouts/15/wopiframe.aspx?guestaccesstoken=eamfa28gqrgeiwgts4k6r4jeaw5r3nlvgmrujrqweeg%3d&docid=1_102ac4f4a82ef483da9397726d75865ca&wdformid=%7b6fc04434%2d1bec%2d4c45%2dbfde%2d62f16b91c9eb%7d&action=formsubmit&cid=5964b08a-e45b-4bd6-a4e5-d13338c37e65",nocase; classtype:attempted-recon; sid:200006572; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"community.shrm.org",nocase; http_uri; content:"/network/members/profile?userkey=379fbe57-ed85-4d31-8527-ff29bee6fddb",nocase; classtype:attempted-recon; sid:200006573; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirmationpages.blogspot.com",nocase; http_uri; content:"/2021/03/facebooksecuritypages.html",nocase; classtype:attempted-recon; sid:200006574; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirmatlon-pages-fb.blogspot.com",nocase; http_uri; content:"/2021/04/facebook-security.html",nocase; classtype:attempted-recon; sid:200006575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"confirmnew-payment.com",nocase; http_uri; content:"/lloyds",nocase; classtype:attempted-recon; sid:200006576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"connecting-to-smtp-msonline-servers-tld.fra1.digitaloceanspaces.com",nocase; http_uri; content:"/index.html",nocase; classtype:attempted-recon; sid:200006577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"connectvk.com",nocase; http_uri; content:"/restore/84358929",nocase; classtype:attempted-recon; sid:200006578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"contactmonkey.com",nocase; http_uri; content:"/api/v1/tracker?cm_session=354917e2-ac99-45e1-96f9-8be4d200b522&cm_type=link&cm_link=e2ca05a6-2e96-43d5-b07a-cf1ef5e79b36&cm_destination=https://btbusinessbilling.wordpress.com/",nocase; classtype:attempted-recon; sid:200006579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"contactmonkey.com",nocase; http_uri; content:"/api/v1/tracker?cm_session=4e1943c3-7a68-47fb-93f5-16d2565a1cce&cm_type=link&cm_link=a4377bcd-c14a-4ace-8c62-a66fecd57e71&cm_destination=https://btbusinessbilling.wordpress.com/",nocase; classtype:attempted-recon; sid:200006580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"contactmonkey.com",nocase; http_uri; content:"/api/v1/tracker?cm_session=d5721ad4-aabf-4e4e-9a14-1b8e7738fbcf&cm_type=link&cm_link=f89aca33-6081-418d-89e6-c9efd6aa36cd&cm_destination=https://www.designbold.com/design/view/80zebbkpa2/presentation",nocase; classtype:attempted-recon; sid:200006581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"conxwallt.com",nocase; http_uri; content:"/verifyaccount/",nocase; classtype:attempted-recon; sid:200006582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"core.opentext.com",nocase; http_uri; content:"/pdfjs/web/viewer.html?shortlink=7a416692eb6dd0cb03c4df977ceccd4a8f6ae0e61c2602c2",nocase; classtype:attempted-recon; sid:200006583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"core.opentext.com",nocase; http_uri; content:"/pdfjs/web/viewer.html?shortlink=b9a0c647d82277e3d32057617df9ff5631b3ffef5ef6e44e",nocase; classtype:attempted-recon; sid:200006584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cornersmascout.com",nocase; http_uri; content:"/smartlistings/docusign/index.html",nocase; classtype:attempted-recon; sid:200006585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cortijolatapia.com",nocase; http_uri; content:"/wp-includes/js/euro2.safelinks.protection.btinternet.com/voicemail/",nocase; classtype:attempted-recon; sid:200006586; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"createchsoft.com",nocase; http_uri; content:"/wp-includes/js/crop/cm",nocase; classtype:attempted-recon; sid:200006587; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"createchsoft.com",nocase; http_uri; content:"/wp-includes/js/crop/cm/",nocase; classtype:attempted-recon; sid:200006588; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php",nocase; classtype:attempted-recon; sid:200006589; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php?.rand=13inboxlight.aspx?n=1774256418",nocase; classtype:attempted-recon; sid:200006590; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php?.rand=13inboxlight.aspx?n=1774256418&amp\;email=jackdavis@eureliosollutions.com&amp\;fid=1&amp\;fid=4&amp\;rand=13inboxlightaspxn.1774256418",nocase; classtype:attempted-recon; sid:200006591; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418",nocase; classtype:attempted-recon; sid:200006592; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;",nocase; classtype:attempted-recon; sid:200006593; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;amp",nocase; classtype:attempted-recon; sid:200006594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;amp\;ampopensource:observable-35835700-0d08-4c25-a188-b8312ba00a941067515",nocase; classtype:attempted-recon; sid:200006595; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;ampopensource:observable-35835700-0d08-4c25-a188-b8312ba00a941067515",nocase; classtype:attempted-recon; sid:200006596; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;fid.4.1252899642&amp\;fid=1&amp\;fav.1&amp\;rand.13inboxlight.aspxn.1774256418&amp\;fid.1252899642&amp\;fid.1&amp\;fav.1&amp\;email=&amp\;.rand=13inboxlight.aspx?n=1774256418&amp\;fid=4",nocase; classtype:attempted-recon; sid:200006597; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;fid.4.1252899642&amp\;fid=1&amp\;fav.1&amp\;rand.13inboxlight.aspxn.1774256418&amp\;fid.1252899642&amp\;fid.1&amp\;fav.1&amp\;email=jsmith@imaphost.com&amp\;.rand=13inboxlight.aspx?n=1774256418&amp\;fid=4",nocase; classtype:attempted-recon; sid:200006598; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&amp\;fid.4.1252899642&amp\;fid=4&amp\;fav.1&amp\;rand.13inboxlight.aspxn.1774256418&amp\;fid.1252899642&amp\;fid.1&amp\;email=jsmith@imaphost.com&amp\;.rand=13inboxlight.aspx?n=1774256418",nocase; classtype:attempted-recon; sid:200006599; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct/login.php?rand=13inboxlightaspxn.1774256418&fid.4.1252899642&fid=1&fav.1&rand.13inboxlight.aspxn.1774256418&fid.1252899642&fid.1&fav.1&email=jackdavis@eureliosollutions.com&.rand=13inboxlight.aspx?n=1774256418&fid=4",nocase; classtype:attempted-recon; sid:200006600; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativecombat.com",nocase; http_uri; content:"/wp-admin/network/acct?email=jackdavis@eureliosollutions.com",nocase; classtype:attempted-recon; sid:200006601; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creativeingredient.com",nocase; http_uri; content:"/wp-includes/images/verify/update/y.html",nocase; classtype:attempted-recon; sid:200006602; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"creditiperhabbogratissicuro100.blogspot.com",nocase; http_uri; content:"/2011/02/habbo-crediti-gratis-sicuro-100.html",nocase; classtype:attempted-recon; sid:200006603; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"crewscontrolmd-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/monica_crewscontrol_com/etsaeagbpbjbtwzh2tom1c4b-dgni3j2covr9b9jmky9na?e=7pz8vh",nocase; classtype:attempted-recon; sid:200006604; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cteam-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/michael_hammes_cteam_de/emvsa57h96dfn3pdorq6h9qbfjioxaqwsf3sn9gvu8tkzq?e=nvhbcy",nocase; classtype:attempted-recon; sid:200006605; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cusstomerservicee.blogspot.com",nocase; http_uri; content:"/?m=0",nocase; classtype:attempted-recon; sid:200006606; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/1w4vrk5",nocase; classtype:attempted-recon; sid:200006607; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/4wx1k9r",nocase; classtype:attempted-recon; sid:200006608; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/5wbvx0o",nocase; classtype:attempted-recon; sid:200006609; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/8cmps8d",nocase; classtype:attempted-recon; sid:200006610; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/aus_de",nocase; classtype:attempted-recon; sid:200006611; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/awhatnu",nocase; classtype:attempted-recon; sid:200006612; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/bwbxfbh",nocase; classtype:attempted-recon; sid:200006613; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/cwbxfq1",nocase; classtype:attempted-recon; sid:200006614; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/cwx1k2n",nocase; classtype:attempted-recon; sid:200006615; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/dkvkq49",nocase; classtype:attempted-recon; sid:200006616; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/dkvkq49/",nocase; classtype:attempted-recon; sid:200006617; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/ee-online-customer-reset",nocase; classtype:attempted-recon; sid:200006618; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/eebvhfw",nocase; classtype:attempted-recon; sid:200006619; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/eklixfr",nocase; classtype:attempted-recon; sid:200006620; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/gwxm4af",nocase; classtype:attempted-recon; sid:200006621; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/jwvpsqz",nocase; classtype:attempted-recon; sid:200006622; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/jwx1lzn",nocase; classtype:attempted-recon; sid:200006623; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/kkk8mtw",nocase; classtype:attempted-recon; sid:200006624; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/kw0aqc0",nocase; classtype:attempted-recon; sid:200006625; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/kwx1xnm",nocase; classtype:attempted-recon; sid:200006626; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/lwbp1b4",nocase; classtype:attempted-recon; sid:200006627; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/lwvpgpd",nocase; classtype:attempted-recon; sid:200006628; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/reactiva-viabcponline",nocase; classtype:attempted-recon; sid:200006629; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/rwzlorv",nocase; classtype:attempted-recon; sid:200006630; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/rxudyrb",nocase; classtype:attempted-recon; sid:200006631; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/tqvnbfg/",nocase; classtype:attempted-recon; sid:200006632; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/uwcrssk",nocase; classtype:attempted-recon; sid:200006633; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cutt.ly",nocase; http_uri; content:"/xmpc3nt",nocase; classtype:attempted-recon; sid:200006634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"cy.tc",nocase; http_uri; content:"/oglp",nocase; classtype:attempted-recon; sid:200006635; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"d.pr",nocase; http_uri; content:"/f/j8j50t",nocase; classtype:attempted-recon; sid:200006636; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"d.pr",nocase; http_uri; content:"/jiiayu?updateverify=",nocase; classtype:attempted-recon; sid:200006637; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dailynewsvermont.com",nocase; http_uri; content:"/wp-admin/network/www.t-online.de.html",nocase; classtype:attempted-recon; sid:200006638; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"danangxaydung.com",nocase; http_uri; content:"/remboursement/",nocase; classtype:attempted-recon; sid:200006639; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"danangxaydung.com",nocase; http_uri; content:"/remboursement/04983522f756e8bf019193a0910bffab/?security=1qbx7holnntabiwdoj40icoja4v5pmzqblmirl3e8wokdjmc2q&email=",nocase; classtype:attempted-recon; sid:200006640; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"declined-myaccount.com",nocase; http_uri; content:"/login.php",nocase; classtype:attempted-recon; sid:200006641; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"deeperlifezambia.org",nocase; http_uri; content:"/cic/wellsfargo/wellsfargo/wellsfargo/wellsfargo/home.html",nocase; classtype:attempted-recon; sid:200006642; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"designbold.com",nocase; http_uri; content:"/design/view/7wzzlpy6md/scrolling",nocase; classtype:attempted-recon; sid:200006643; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"designbold.com",nocase; http_uri; content:"/design/view/80zebbkpa2/presentation",nocase; classtype:attempted-recon; sid:200006644; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"designbold.com",nocase; http_uri; content:"/design/view/onmxgjmvam/scrolling",nocase; classtype:attempted-recon; sid:200006645; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"designbold.com",nocase; http_uri; content:"/design/view/ppzpgr8q91/presentation",nocase; classtype:attempted-recon; sid:200006646; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dichvuvinaphone.vn",nocase; http_uri; content:"/wp-includes/pomo/office365/office/voicemail/index2.php",nocase; classtype:attempted-recon; sid:200006647; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dichvuvinaphone.vn",nocase; http_uri; content:"/wp-includes/pomo/office365/office/voicemail/index2.php?h=ed29nkjpsa16bhrjq4na16owq-1mucgfycc664m7vmhpjgqse65-1l5rurej3h44qodo5rn0cdvyn-8om6v2ckrxsbnwf40t9ta8a7e-34tiets5jpj294jd59h8c4s0n-28w7d5j2k2jtil9ncckolke4m-9jzlwicvu376y9q4vjq77y5ks-1m0whdrwis44c1hoa9mrwhlt4-1uvutm1mpyov7rqhtcf8fksby-aac54ic1fmca5xz1yvc5t9nfe-1hn40w0bomeivihj9lopp4hp2-c0121povror81d0xao0yez4gy",nocase; classtype:attempted-recon; sid:200006648; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dichvuvnpt.com",nocase; http_uri; content:"/home/components/com_user/bbtonline.html",nocase; classtype:attempted-recon; sid:200006649; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"digital.flexcontact.com.br",nocase; http_uri; content:"/itaucap",nocase; classtype:attempted-recon; sid:200006650; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"disq.us",nocase; http_uri; content:"/?url=http%3a%2f%2fedd.huntershub.online%2fedd%2520prepaid%2fprepaid%2f&amp\;key=tqpetxlm09wtvlwulwkm1g",nocase; classtype:attempted-recon; sid:200006651; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"disq.us",nocase; http_uri; content:"/?url=http%3a%2f%2fv32vi.org%2fobj%2fx86%2fdebug%2fdebug.html&key=p5-unr13ef1nvpweoa4g6q",nocase; classtype:attempted-recon; sid:200006652; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"disq.us",nocase; http_uri; content:"/?url=http%3a%2f%2fwww.rmiembassyus.org%2fmedia%2fjui%2fjs%2f&key=i5eldkzvfyplzuuvh2xytg",nocase; classtype:attempted-recon; sid:200006653; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"disq.us",nocase; http_uri; content:"/?url=https%3a%2f%2fbom.to%2fne7tticangmii3&amp\;key=0beekpsfvusz9qc-9u-zwq",nocase; classtype:attempted-recon; sid:200006654; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"disq.us",nocase; http_uri; content:"/?url=https%3a%2f%2fbom.to%2fvpz1ac&amp\;key=yc94ig4npafy0sthcgmlig",nocase; classtype:attempted-recon; sid:200006655; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"disq.us",nocase; http_uri; content:"/?url=https%3a%2f%2fcompte-suspendu483.tk%2fcaptcha%2f&key=uouejqmfvkrmu_mnfmlqeg",nocase; classtype:attempted-recon; sid:200006656; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"disq.us",nocase; http_uri; content:"/?url=https%3a%2f%2fwww.adelaidetowingandcarremoval.com.au%2fwp-content%2f%2fuploads%2f2020%2fsocialsecurity%2f&amp\;key=yxyb8swn1zzjw8bcatgrjw######",nocase; classtype:attempted-recon; sid:200006657; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"disq.us",nocase; http_uri; content:"/?url=https%3a%2f%2fwww.gepard.ru%2flogin%2faccount%2f&key=jgdq7zs0ratd6src39cdig",nocase; classtype:attempted-recon; sid:200006658; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"distechforum.com",nocase; http_uri; content:"/chase/web",nocase; classtype:attempted-recon; sid:200006659; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"distechforum.com",nocase; http_uri; content:"/chase/web/",nocase; classtype:attempted-recon; sid:200006660; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"distinctfreight.co.zw",nocase; http_uri; content:"/fgjj/pdffile",nocase; classtype:attempted-recon; sid:200006661; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheit.com",nocase; http_uri; content:"/349/9044fbbc78660f4086d1b71f73dc80c7/de/identification/?cgi=031320190&token=186d7d1fb84c5293089938f3b30a472d",nocase; classtype:attempted-recon; sid:200006662; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/122/892c13568d99e1a0e762de73d704cc0a/de/identification/?cgi=031320190&token=7c0aefcbd5ad92411249c7c0477da123",nocase; classtype:attempted-recon; sid:200006663; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/123/074fa92c9fe031757d085f7f33face35/de/identification/?cgi=031320190&token=985bdb6166a1ed25f8c5a26e16cd8544",nocase; classtype:attempted-recon; sid:200006664; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/13/3096be9e9da35e8ad035cc060e461c21/de/identification/?cgi=031320190&token=4b71a083bfd0ec6c92d24e000019eceb",nocase; classtype:attempted-recon; sid:200006665; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/182/38fed72f4f1a7c663dd3a252f3146c32/de/identification/?cgi=031320190&token=20c63bb4a35d8a34b3c00ddecd40a4c5",nocase; classtype:attempted-recon; sid:200006666; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/183/d87f26ff44481c0492283b9e23b336cc/de/identification/?cgi=031320190&token=1f96eb6b2c869f9148f13494aeb36640",nocase; classtype:attempted-recon; sid:200006667; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/216/f0b33a777825dc338f8ed1686a986e2d/de/identification/?cgi=031320190&token=5bd999a852cc1133b23c9120174f6a0c",nocase; classtype:attempted-recon; sid:200006668; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/234/40f887fbce9698fbec957ea4148f2582/de/identification/?cgi=031320190&token=8d0c3c871a778c759de0b07882004964",nocase; classtype:attempted-recon; sid:200006669; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/238/2531f1e8a1c1b6314a57ba0cfc197760/de/identification/?cgi=031320190&token=073ad589654f3b3537c56145d6f6516f",nocase; classtype:attempted-recon; sid:200006670; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/245/2d90223d62e83f176f9e56392c3e0e18/de/identification/?cgi=031320190&token=c6998e4ec88a0bebadaa02081e8e30d9",nocase; classtype:attempted-recon; sid:200006671; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/248/433f6bc59ccdbc464f0263f468d3faa4/de/identification/?cgi=031320190&token=895bb9908c85f40f598b69e04c059f2a",nocase; classtype:attempted-recon; sid:200006672; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/272/2b7ba624178b323372c328e811285334/de/identification/?cgi=031320190&token=3d6faf08c46e6faf981febc7566ebecc",nocase; classtype:attempted-recon; sid:200006673; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/291/0c49019543bef5f1c860631480bb51fb/de/identification/?cgi=031320190&token=501533adb0216f490c2e676b047f3898",nocase; classtype:attempted-recon; sid:200006674; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/298/4c3d396d02e25ebac945983071643bc9/de/identification/?cgi=031320190&token=c7e48f603c5f3c3eb9ae086300c43ed5",nocase; classtype:attempted-recon; sid:200006675; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/349/8374e6e9b7abc90554ed51b6cea24788/de/identification/?cgi=031320190&token=08ceffc5b1dcbe39512dcb0dcb7385c8",nocase; classtype:attempted-recon; sid:200006676; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/399/65da581e01bf2476c4897ebf470a6fd4/de/identification/?cgi=031320190&token=59765732cbda98b53acadd1b6d2a7452",nocase; classtype:attempted-recon; sid:200006677; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/404/225c52a70f7b1a4dbebe3f77d4236f74/de/identification/?cgi=031320190&token=fb64bdfdb622a06fe87e38d7a64e34c7",nocase; classtype:attempted-recon; sid:200006678; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/428/50333432fc8b3b032b8d53df3820e8e0/de/identification/?cgi=031320190&token=1ff9a873510f175aa2a5777750837fe4",nocase; classtype:attempted-recon; sid:200006679; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/437/993d6e5b608e1d53c1a511a9b62a245d/de/identification/?cgi=031320190&token=2f45c5a87b54e8f2f380437bc683d2a0",nocase; classtype:attempted-recon; sid:200006680; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/465/8f36b5666c7169fd453e391bf78ab754/de/identification/?cgi=031320190&token=b8b213126c29ac90f05478ef60b9f089",nocase; classtype:attempted-recon; sid:200006681; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/491/d6572f16094588861f5f708f914c2d4c/de/identification/?cgi=031320190&token=bb60a3aae275dc166c612d547d6cb205",nocase; classtype:attempted-recon; sid:200006682; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/53/cbe8339f38fd535b58a7cfcde1d7c552/de/identification/?cgi=031320190&token=f3bcf1225acbff6e3a16f3c51682776e",nocase; classtype:attempted-recon; sid:200006683; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/542/e192a1a6f0a7d37d39b4bac0735a3baa/de/identification/?cgi=031320190&token=31852d9a28bab26871f058387dee0bb7",nocase; classtype:attempted-recon; sid:200006684; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/579/49bd6a799d75a702041b7a6ec1a6a17f/de/identification/?cgi=031320190&token=95f299c514dd8866f83aa04008ccf667",nocase; classtype:attempted-recon; sid:200006685; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/637/2461d5653737fcb1571a2f8d45638cbd/de/identification/?cgi=031320190&token=0eb6eaa8242adc27d94da8cc4a1db449",nocase; classtype:attempted-recon; sid:200006686; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/638/eb36478ba395cc9e95899383e293a96f/de/identification/?cgi=031320190&token=bbd45155ea1d7df7c833e31866e2bebd",nocase; classtype:attempted-recon; sid:200006687; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/666/be45be981826f55c235fb2ec4a0cffc4/de/identification/?cgi=031320190&token=adfc1317e8429db13a3f381215b7579e",nocase; classtype:attempted-recon; sid:200006688; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/705/2aaa771b25f2bd57fb7647dbe83eca58/de/identification/?cgi=031320190&token=3459f450e2a6057b9edc4224df96ea97",nocase; classtype:attempted-recon; sid:200006689; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/715/679c58d86b884fe5d9b9304eac62e726/de/identification/?cgi=031320190&token=9522dda85554d4c8961e25e3140b65a2",nocase; classtype:attempted-recon; sid:200006690; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/720/238c2f9bc586cf6583e1419104f17f24/de/identification/?cgi=031320190&token=b3f72ef50a54949a2c2e3c817caced46",nocase; classtype:attempted-recon; sid:200006691; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/735/9eb4c7f7e3274c79aeab0f86aa97529a/de/identification/?cgi=031320190&token=104ae1bb62e30fda8298321a5d649abe",nocase; classtype:attempted-recon; sid:200006692; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/737/06b8b26101c2ae3e1b802dd385f4ca45/de/identification/?cgi=031320190&token=cabf50188c436dcc08122f5eff59722b",nocase; classtype:attempted-recon; sid:200006693; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/749/20bcd02ed4c53f38e1a0d60667716145/de/identification/?cgi=031320190&token=345c948c6791dd217beeb4c4ddc067f5",nocase; classtype:attempted-recon; sid:200006694; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/77/91cdea7d632f828beb855b7bcf56fbc1/de/identification/?cgi=031320190&token=e99269f1b45659f14d4db470ad684f9a",nocase; classtype:attempted-recon; sid:200006695; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/799/9f20c6ba5afab5cebf9c9c2c3c81f627/de/identification/?cgi=031320190&token=a4f51a88105b42ffb45789004cd8a8f0",nocase; classtype:attempted-recon; sid:200006696; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/829/94d8dd92e0a233652c56df140f52614c/de/identification/?cgi=031320190&token=b0a6da2c2cc12533408fecc412b3d2d1",nocase; classtype:attempted-recon; sid:200006697; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/850/100fa8559eda7e435e4c7a44f5ddad7a/de/identification/?cgi=031320190&token=82781edbb7cfd4c457a0dfeaeae97641",nocase; classtype:attempted-recon; sid:200006698; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/912/f910caf43e395bba8a838a57780fe175/de/identification/?cgi=031320190&token=a779912593c131d9b34ec02022f0ed75",nocase; classtype:attempted-recon; sid:200006699; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/940/3c06bdd9fde4758a59f69976ae647539/de/identification/?cgi=031320190&token=31d863ceb5b92f5e49890c6dcd3d3eba",nocase; classtype:attempted-recon; sid:200006700; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dkbsicherheitsdienst.com.de",nocase; http_uri; content:"/989/495a199f2f39ee3a6b5b8088614a6211/de/identification/?cgi=031320190&token=e1d00283cc1017f0e8cff88bde4d34f7",nocase; classtype:attempted-recon; sid:200006701; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dlvr.it",nocase; http_uri; content:"/s8djwd",nocase; classtype:attempted-recon; sid:200006702; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dlvr.it",nocase; http_uri; content:"/s8dpsm",nocase; classtype:attempted-recon; sid:200006703; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doa.go.th",nocase; http_uri; content:"/leka/wp-content/nychhc",nocase; classtype:attempted-recon; sid:200006704; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doa.go.th",nocase; http_uri; content:"/leka/wp-content/nychhc/",nocase; classtype:attempted-recon; sid:200006705; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/document/d/e/2pacx-1vqg5zz0tcdbhy7wfp_7qji6toegexolsgvf_176vf5srqdch5yoc7vqg92mmiz7yvesvbgmzvlagowo/pub",nocase; classtype:attempted-recon; sid:200006706; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/document/d/e/2pacx-1vrsdmi8kqzhphmq1wq1it08vreztms3u-vsojet5ppl9zuo4ismcqxn4fwtissr-h0txmmzaohvs7ty/pub",nocase; classtype:attempted-recon; sid:200006707; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/document/d/e/2pacx-1vrww694tkdqcdswba6r6qvkl2j8ggccuxtq-1x4ocowjttilaenattbakijulc7qev-4hqllutzogev/pub",nocase; classtype:attempted-recon; sid:200006708; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/document/d/e/2pacx-1vrxv6bkbixggv2c_lzouzl6z9ovzqqswl5otameibkkds0jrgilyjy4cpv1lflvobrdumunkipgx6du/pub?embedded=true",nocase; classtype:attempted-recon; sid:200006709; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/document/d/e/2pacx-1vs36y8r0dzpmbkk0kzlhwl7qp56-1x6jrq34lzp4a2cukpsl9y0gfpcpmx8sjlwiw2db5lysyzisg8o/pub",nocase; classtype:attempted-recon; sid:200006710; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/document/d/e/2pacx-1vszcwxk6nifthkg32wjxfjgq9yc-jjujkbsumqeeau8uw7xkcutyp0tbgux2mvwu8iqfrxxlunajob8/pub",nocase; classtype:attempted-recon; sid:200006711; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/document/d/e/2pacx-1vt_xl-m0ff8yqqhzhgseahgwejo0znh9re6w0qvgbe0qfe084hrebjjg673htphdnvbcdnq6agehncq/pub?mobilelogin",nocase; classtype:attempted-recon; sid:200006712; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/document/d/e/2pacx-1vth3iya0ov7p49rk9ejozgqnueuk8fna2mky389hertlwx4mnoyhl1mlhnwbz8sxnsqtk8i5uysmq68/pub?embedded=true",nocase; classtype:attempted-recon; sid:200006713; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/document/d/e/2pacx-1vtj_-ldjfuxvxsbw2yivttmklhhwb0xalrxb_sxzub7mvm23nxxvor35_ppdltnvlm7bo8pc5oao0jn/pub",nocase; classtype:attempted-recon; sid:200006714; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/document/d/e/2pacx-1vts9czxqycsgi-quifs7m1mqjzmlcjlccnhw3dsahdss5ymnpy6y0vsgwvf3piu6js22ydjyew1oyo_/pub?embedded=true",nocase; classtype:attempted-recon; sid:200006715; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/document/u/6/d/e/2pacx-1vs1dvkfrujajsa7oo5lrr8jtgkptt5bkchxfesyemxh3tajbdgtb25uikmsqpb0kahma4jpgkbvhuw7/pub?embedded=true",nocase; classtype:attempted-recon; sid:200006716; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/12467akksjbdxtns1aefg-fo9hlxamtxynf5brvbz5tc/viewform?edit_requested=true",nocase; classtype:attempted-recon; sid:200006717; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/17rbx8y2bk8n4tzm0fbld5vi4ldsc0skyuqq0ocijhsu/viewform?edit_requested=true",nocase; classtype:attempted-recon; sid:200006718; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/1fpyjsolbptidxpf23lqom1jghfw7qrvbbbfxxi82pzg/viewform?edit_requested=true",nocase; classtype:attempted-recon; sid:200006719; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsc-xysogohjsbzmcnoded8ooar2gz1c5zxobgk8envh3jbpow/viewform",nocase; classtype:attempted-recon; sid:200006720; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsc_enqwhhv1jnvzy55mb4ghvjd4wcz9plnolh2eoitk7qgbra/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006721; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsc_f0pxmnwzrtbck6u06fdzocmhgzvjzlc8cu7c9b456fhccq/viewform",nocase; classtype:attempted-recon; sid:200006722; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsca1yg551kdvimwhccriwj2kttyqqfalnuaaxacbsdmdwgmwa/viewform",nocase; classtype:attempted-recon; sid:200006723; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscaoiohhbm7suyz9ol9o9ueunbxn6donxrfjge2cevdw_8jmw/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006724; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscclmqirehqtkm3vl4u9gm2zv6xfvrddbrgke9fmsfujqbboq/viewform",nocase; classtype:attempted-recon; sid:200006725; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscd8t8sjgxqrsa6dq5kjpmrpsxkvi4bl38sfdu7wa3sl32elg/viewform",nocase; classtype:attempted-recon; sid:200006726; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscda1to5ru4sjeeujg3ki2bimklprvsec6u43kpvhbfyhrldw/viewform",nocase; classtype:attempted-recon; sid:200006727; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscda1to5ru4sjeeujg3ki2bimklprvsec6u43kpvhbfyhrldw/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200006728; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsceoxsfawdsbd2r-jk2sppywnv1bchzjjcw2xkcj7oqkwqriw/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006729; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscf9u8nrld-zvu6clr4jcwnw0buqrykdldtzoullbxy8kc1ta/viewform",nocase; classtype:attempted-recon; sid:200006730; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscfh2njwrve6_rkxxy1yz83keoeekd4maqcnd-ivq7rkg0uca/viewform",nocase; classtype:attempted-recon; sid:200006731; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscg90j3pjk7wbx0vpznglfcyiq_a2ievm0ny05tehbuc2mr7g/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006732; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsch8_wrvwsg5klxptwjznnmghz9ny516msszkmzzjr6wqll4q/viewform",nocase; classtype:attempted-recon; sid:200006733; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscn6xxq_xvtivggy_4rkibou1i27e0kpiimikafpaavki1vsq/viewform?usp=send_form&usp=embed_facebook",nocase; classtype:attempted-recon; sid:200006734; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsco0gvjsnu6vwouw1cnby9hqmoveqoekq63vj95s1xq5gc01g/viewform?vc=0&c=0&w=1&flr=0&usp=mail_form_link",nocase; classtype:attempted-recon; sid:200006735; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscq8lwf5u5pxklisswjs79fcko1u76xaqw2cplb00uamj2epa/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006736; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscqbbsvkpxnasqgeazpzwxp1ln7qzdurt-nqn4azqa7q14euw/viewform",nocase; classtype:attempted-recon; sid:200006737; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscsp2ltu8y_5h-m0512ckji9i1rwabxoforr5hgbkwi-gx9mg/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006738; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsct1pxn0qq6ulzzs2kqgekpwoa-galaegxg5mzuxii-fvmwaq/viewform",nocase; classtype:attempted-recon; sid:200006739; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscuttypbph1iazuis8aa6xvrlmagwglmdcrrg8g2oymskvbva/viewform",nocase; classtype:attempted-recon; sid:200006740; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscwhydxbja0io9phvf8pmcgb11roz_ed85iyqfoliot05_ugq/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006741; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlscz4uf8dtvwhgxggkzsbbhjcgu9npgc6agxpy5o2fwpo6tv5q/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200006742; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsd29ecusrbnxs7zu-3rpk0vcfjoquhtkmicosbwx-q8vi0wiq/viewform",nocase; classtype:attempted-recon; sid:200006743; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsd29ecusrbnxs7zu-3rpk0vcfjoquhtkmicosbwx-q8vi0wiq/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006744; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsd3x6brnru3toiionptordwmc4zorxcky1ebpmeg6bb4jfuca/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006745; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsd6h5k1kajgpan-tfvs7w4k_b4wq3m6wjdfh_kfrpiq-3w-ag/viewform?fbzx=8876075289152692257",nocase; classtype:attempted-recon; sid:200006746; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsd7jgegqudsjg7blscqgfvdftyvlno6xreg6wjuxl0hnfbwtw/viewform?vc=0&amp\;c=0&amp\;w=1&amp\;flr=0&amp\;gxids=7628",nocase; classtype:attempted-recon; sid:200006747; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsd7shjgl-xzh0b--otxbgyaq02wjun61jituz_kgjvmoqhwrg/viewform?vc=0&amp\;c=0&amp\;w=1&amp\;flr=0&amp\;usp=mail_form_link",nocase; classtype:attempted-recon; sid:200006748; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsd8vkw5fxeroe_pxa7n5cdfpukhahbg_7k7sg0iuosh_xsyoa/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006749; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsd_c4wpt0zzouwt5lr9p5kn5cylz3ananv1hlix6u_h36w1rg/viewform",nocase; classtype:attempted-recon; sid:200006750; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsda4flfi-1_gvwqnbb1dcxz_mb5omo9t2oc-vslzfgh6avrag/viewform",nocase; classtype:attempted-recon; sid:200006751; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdbgprbyowwcugqslasnoo-sbqcrgi6ppycsytvsw2_dwfeug/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006752; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdce9c1bqexlzlu9rojtuwtaatyeeshywbkmuiobrw_a-_mga/viewform",nocase; classtype:attempted-recon; sid:200006753; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdce9c1bqexlzlu9rojtuwtaatyeeshywbkmuiobrw_a-_mga/viewform?usp=pp_url",nocase; classtype:attempted-recon; sid:200006754; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdfarxg-0eurkyimsg-ukgl4mbtgvwfhe1wzbdxmb7oaosnyg/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006755; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdfyxb1kjjvkaiwbbpbgr0dfaq1xx2ehhzbxnt3adndssy1yw/viewform",nocase; classtype:attempted-recon; sid:200006756; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdfyxb1kjjvkaiwbbpbgr0dfaq1xx2ehhzbxnt3adndssy1yw/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006757; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdh3fagetv5atvgouwvzn5l5t5w1liy7azndc77wr6wwyu94q/viewform",nocase; classtype:attempted-recon; sid:200006758; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdh3fagetv5atvgouwvzn5l5t5w1liy7azndc77wr6wwyu94q/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006759; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdhdloijpfz-djbc5k5nzwa_mbdym5kgjm1ssgrhwex3sj49g/viewform",nocase; classtype:attempted-recon; sid:200006760; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdhr2qehprrqzfimbwtlojynm_nvvsdovser7pmho5v5o4cxw/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200006761; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdhyezpletqihy8incmgssiwqjlbqwo03ulvjxipjmjjrrscg/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006762; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdmsww4edj2yofwdenmvl3uvyibigishgajtsfa7chvcan0wg/viewform",nocase; classtype:attempted-recon; sid:200006763; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdp-5roof4dzzivh9nvegldbqvrbi60inudyjxdj7qoevj9qw/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200006764; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdp6gmot9lhhgyqmwp6tavohtvtacptly7nzcuiynoir9cjbg/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200006765; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdpyvreq-ep0jbvs8gp2oehnu3bxiac9fskhtmy4gmyvq5ihw/viewform?vc=0&c=0&w=1&flr=0",nocase; classtype:attempted-recon; sid:200006766; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdpyvreq-ep0jbvs8gp2oehnu3bxiac9fskhtmy4gmyvq5ihw/viewform?vc=0&c=0&w=1&flr=0&usp=mail_form_link",nocase; classtype:attempted-recon; sid:200006767; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdvo-nueiprck-o5gw7-bnmsz9jvwlyspeqfhfr2g2osbsrba/viewform",nocase; classtype:attempted-recon; sid:200006768; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdvwkczn_rxvn1522z1mcojbs40ymrctyizpyuv72_0wbypgq/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006769; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdwbz5hapgqojwjyndeeyjxamg0wnaj3kolh3fb6xf4c-fxjw/viewform",nocase; classtype:attempted-recon; sid:200006770; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdwbz5hapgqojwjyndeeyjxamg0wnaj3kolh3fb6xf4c-fxjw/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006771; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdxkjopelrwprbruv5pypgeut5c971mdpwp9w1ndxosaui0oa/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006772; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdy1071rbhheyidjzo6fw5busqot5eunllw_thawo6udamfaq/viewform",nocase; classtype:attempted-recon; sid:200006773; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdzpz7mn6te18_1olbnvu14ez5j_lscj_pintnwldwht6wtaq/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006774; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsdzrubbm3nrqdzjs6q7phutjgmn-dm8zquphjg9ge31q7bdhg/viewform",nocase; classtype:attempted-recon; sid:200006775; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlse3-zgmg83lctfks0egmambwonybkscrvxix--n1azwngkphg/viewform",nocase; classtype:attempted-recon; sid:200006776; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlse3z7zfganhjkbmdgdzheyfulmoguxmywd9hdulew6swo20lw/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006777; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlse659tcdnppv704bqfgkhuwvmmlufcbpaicqx075d_gxnsqba/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006778; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlse8ds15kxxdcrhfspcfrbvy6sbdhp0e4540zzmhhvzouewvka/viewform?vc=0&c=0&w=1&flr=0&usp=mail_form_link",nocase; classtype:attempted-recon; sid:200006779; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlse_mo9pzgdahzdgz0wctr7lm0cqm_zwos8ljc4cqgtvnqfmfq/viewform",nocase; classtype:attempted-recon; sid:200006780; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsebyedalhc7exqq5fljf8x1akbwz0h8l8ojbx5nx3go7bh3sa/viewform",nocase; classtype:attempted-recon; sid:200006781; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseht4cdltkad8967jjarcb5nafonbaw3dtpynth9mdk94hf-q/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006782; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseiivk2oebvd57p1rg53giaiaia9tkswgmcqfisnjyqjdpwoa/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006783; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseirld9oyigwxmec2bc-ax4yd-m-rhezlne00aminsjf0uteq/viewform",nocase; classtype:attempted-recon; sid:200006784; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsejavlqdkikylynqlg6p7kyfu4qnlyy31opnfttucuhgmek4a/viewform",nocase; classtype:attempted-recon; sid:200006785; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsejg2xiowc36xpgb4yrzafossvuajgg7b3kyoyr91ahcajyhg/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200006786; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsejg2xiowc36xpgb4yrzafossvuajgg7b3kyoyr91ahcajyhg/viewform?usp=sf_link%3e",nocase; classtype:attempted-recon; sid:200006787; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsek2havgkyh0nefyqqhxvt5lu7hmj-weg4s9s_j07dnon30iw/viewform?vc=0&c=0&w=1&flr=0&usp=mail_form_link",nocase; classtype:attempted-recon; sid:200006788; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsel_ki8gcgzajteddl27pbkpo6w90de6hj6epzsurphsvekpg/viewform?embedded=true",nocase; classtype:attempted-recon; sid:200006789; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsemuphd9zpegybxx9gwrw-vsu9gbqjuufhz2wx34p7cj1cibq/viewform?vc=0&c=0&w=1&flr=0&usp=mail_form_link",nocase; classtype:attempted-recon; sid:200006790; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsemwyrvcln1ql8uxd0dsiswveuehikz5hwalfeni7jjfaefmg/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200006791; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseoz9zpmm0c0fjksklv-p1hsrwsuybmj6bvbd_fkewzzcv_ea/viewform",nocase; classtype:attempted-recon; sid:200006792; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseoz9zpmm0c0fjksklv-p1hsrwsuybmj6bvbd_fkewzzcv_ea/viewform?usp=pp_url",nocase; classtype:attempted-recon; sid:200006793; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseqdx2wgybdxlhascsuopq1xqsmwrxjf4erl_cpmvtt96dq_g/viewform",nocase; classtype:attempted-recon; sid:200006794; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlser-b6q--nvif2fj7nbn88dh8lj-s2yfbgjyuygwsacbhm6lw/viewform",nocase; classtype:attempted-recon; sid:200006795; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseszgantjzuxgteg0dsiizzmadcwjbjqcsri5nidod2rd2_lg/viewform",nocase; classtype:attempted-recon; sid:200006796; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlset42bzecl3yrdnnffv6f7kecxpd1sy4rbh3h3govwg1k1z1w/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006797; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseumxp-wga1x873upqxmi_hx8nbbllh12zzmxia1xuqp2mgbq/viewform",nocase; classtype:attempted-recon; sid:200006798; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsewr7-ksdpydhc1tv8tkcxrlad8zrf3q_uqt-rj9a_fmmzxya/viewform",nocase; classtype:attempted-recon; sid:200006799; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsewr7-ksdpydhc1tv8tkcxrlad8zrf3q_uqt-rj9a_fmmzxya/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006800; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsexrthgahyza746esrgvtj4hqnjlqgmef_k2l3usnolt1fjgg/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006801; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlseyedrifg-qlmvdq0o9il9kmr_p85q1giqync2uwgbbi5he1q/viewform?vc=0&c=0&w=1&flr=0&usp=mail_form_link",nocase; classtype:attempted-recon; sid:200006802; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsf32hx6ujsi_gqji38udpamxxxnhyrx8qhmqcqnteinj_0cmg/viewform",nocase; classtype:attempted-recon; sid:200006803; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsf43dgkrjoe0kbhyqzxvaswkmbstzlu6x-40xi-sxxgfevhww/viewform?vc=0&amp\;c=0&amp\;w=1&amp\;flr=0&amp\;usp=mail_form_link",nocase; classtype:attempted-recon; sid:200006804; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsf6z9onabfo6e0tdct4ajfm2jgmyyju_msfaofou8dca04yfa/viewform",nocase; classtype:attempted-recon; sid:200006805; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfacaqo8c7hsu7mr6zkbsfulv8m710ke2qna_7tyusomgmtjw/viewform",nocase; classtype:attempted-recon; sid:200006806; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfacaqo8c7hsu7mr6zkbsfulv8m710ke2qna_7tyusomgmtjw/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006807; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfaexmgpgntdkiayu-wg3vbkhus9frurejyqxukiiydkjc3ug/viewform?vc=0&c=0&w=1&flr=0&usp=mail_form_link",nocase; classtype:attempted-recon; sid:200006808; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfanborkr2ivrhpsjdnvnb-jktwkjbuub3wnsxb-md7haddsq/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006809; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfcadutx0elsh0wfimgfoedkee1p3gr2wf_qnv_ctizw8ztaa/viewform?vc=0&c=0&w=1&flr=0",nocase; classtype:attempted-recon; sid:200006810; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfcbbgof7lfcganiwuiubcqdhwl_ppaaxbwiuf7aqmljimizq/viewform?vc=0&c=0&w=1&flr=0",nocase; classtype:attempted-recon; sid:200006811; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfeoy_w3jwkkz8psgsw4nrja9tmg2lx0x0nvtmv38k0hjzzmq/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006812; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsffxdjsibp7kmfd28idwdkvupj3klesiwvpoiecz8xpgdh0cq/viewform",nocase; classtype:attempted-recon; sid:200006813; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfgomlcpbyhodks1bwjmx6f5jr0tqwhngun_juf2qk0jp8dbq/viewform?vc=0&amp\;c=0&amp\;w=1&amp\;flr=0&amp\;usp=mail_form_link",nocase; classtype:attempted-recon; sid:200006814; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfhzli805cycnlai887dfo6ra8bwbwjbc8uehmv5amiaqdbyq/viewform",nocase; classtype:attempted-recon; sid:200006815; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfjpx-sxpejnp_q2fmfu0jy8oqoesrx9wbrqplcychw9luupa/viewform",nocase; classtype:attempted-recon; sid:200006816; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfjsgjhbjke-mlmni8cfg1tacz-hdpvmy5j2br9upjr1f7nda/viewform",nocase; classtype:attempted-recon; sid:200006817; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfjsgjhbjke-mlmni8cfg1tacz-hdpvmy5j2br9upjr1f7nda/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006818; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfk9hpkld9-qwaxs8b0cpslaw2-oomu6bcwpxkmp-fo8kr3ew/viewform",nocase; classtype:attempted-recon; sid:200006819; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfnjyzbmw-pd1byw4b4opoksx2cealounsnhg5fjc3fk1qocq/viewform",nocase; classtype:attempted-recon; sid:200006820; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfnlsbejsiacubkj2geltmn7slefoweeczuagp3jfmfkijg4a/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006821; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsforgq2zksc0soenei1m7xcow9surjrynoh6ppsku6_kxvdpw/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200006822; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfp1eukgsktriyraz2csynqwfwtv6ehlnbszu69dbxz9lirtq/viewform",nocase; classtype:attempted-recon; sid:200006823; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfp1eukgsktriyraz2csynqwfwtv6ehlnbszu69dbxz9lirtq/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006824; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfrzt6zpkhgtvzqutkypqtjffxaucn3evqpf6ytbqug3t41yw/viewform?usp=pp_urlorganization",nocase; classtype:attempted-recon; sid:200006825; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfsia_g4fb5yg_cu8fjuxcndbgqz1setzfedm0cw0eaonb57g/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200006826; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfsr_hufaploql8ruxbcya-5su5xpkzee0qtzs6_ixatjrmcw/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006827; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsftriyys-rvphnbmh6v6lyimxjy3rpog8xvtb3v1agqhawiva/viewform?usp=sf_link",nocase; classtype:attempted-recon; sid:200006828; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfvgwgijgampx2qfseard_pb2bcyonllojnjhrv9qxb8vpeva/viewform?vc=0&amp\;c=0&amp\;w=1&amp\;flr=0&amp\;usp=mail_form_link",nocase; classtype:attempted-recon; sid:200006829; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfvgwgijgampx2qfseard_pb2bcyonllojnjhrv9qxb8vpeva/viewform?vc=0&c=0&w=1&flr=0&usp=mail_form_link",nocase; classtype:attempted-recon; sid:200006830; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfvvvnddwmy-3u-agx0bvar5wfmplx8bvgef_zdia7ra9llfg/viewform?usp=send_form",nocase; classtype:attempted-recon; sid:200006831; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfwbcfrxuktidm2ctjalngebxbx4k_dijxbekg2y-naausaqw/viewform?vc=0&amp\;c=0&amp\;w=1&amp\;flr=0&amp\;usp=mail_form_link",nocase; classtype:attempted-recon; sid:200006832; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfwdsuczwrih_wnciwh_qjpg1v5p-qk8zyjjoccpbhmyeygrq/viewform",nocase; classtype:attempted-recon; sid:200006833; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfxoc8vekgqzkhzna2nynvv4fpmbntvo6_rbnwinjte4at6ya/viewform?vc=0&c=0&w=1&flr=0",nocase; classtype:attempted-recon; sid:200006834; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/forms/d/e/1faipqlsfyxrzgheo7is9dyegsl1h9_4t7mcqz9msa0ttzh0sby6bmow/viewform",nocase; classtype:attempted-recon; sid:200006835; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/presentation/d/e/2pacx-1vqhu5f9qjt9duj5oq2is4bqxokuq2ebewhyxc9wz2mcdnhpiz8zkw8vcz6horujg2hbe8yrcjeump4e/pub?start=false&loop=false&delayms=3000",nocase; classtype:attempted-recon; sid:200006836; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/presentation/d/e/2pacx-1vqwerdrrgegf76lduaxtfwhfhia5se9-a_9wyl2zmxiiip6pwrfwo10odljd5d-0_8x-ebkat8t3uei/pub?start=false&amp\;amp\;loop=false&amp\;amp\;delayms=3000#slide=id.p",nocase; classtype:attempted-recon; sid:200006837; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/presentation/d/e/2pacx-1vrn2g1dgcoqbd_vlv01bwwwim-oqfddsmoyj7ias_0bnqd6kes65sy45dil8kk96x5tmjt6sllf0qhe/pub?start=false&loop=false&delayms=3000",nocase; classtype:attempted-recon; sid:200006838; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/presentation/d/e/2pacx-1vrp2k-b45tcwcadgwzkulyaqrs1f9vfjs3y19o6fs_7p34ymzwuascr7lkuijhc83-o6fmsbbvehcf2/pub?start=false&amp\;loop=false&amp\;delayms=3000&amp\;slide=id.p",nocase; classtype:attempted-recon; sid:200006839; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/presentation/d/e/2pacx-1vsgy7s11tyex2sq_xbzmjt2b8xz7vq3ae52hbkkzw_7v7dh4kodsweugirq8pogurynufixdub2mq6a/pub?start=false&loop=false&delayms=3000",nocase; classtype:attempted-recon; sid:200006840; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/presentation/d/e/2pacx-1vtyopjgdntenjfrpl7zkuojklty7ifc03cfu0uxxfmmnprn0hymzms85ybdnu3jujfftxmxrwezxea9/pub",nocase; classtype:attempted-recon; sid:200006841; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/viewerng/viewer?url=proxy.ge.tt/1/files/5d0k9lx2/0/blob?referrer%3duser-a6kjrvmdexz9favkffsdh44k4iybrxak3pn41u-%26pdf&amp\;ddrp=1=secured",nocase; classtype:attempted-recon; sid:200006842; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"docs.google.com",nocase; http_uri; content:"/viewerng/viewer?url=proxy.ge.tt/1/files/8tnpiby2/0/blob?referrer%3duser-ur6z6ngiuctfxjqxnhc2bxyonvsmvcncqdrvc-%26pdf",nocase; classtype:attempted-recon; sid:200006843; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dolcevitabymerit.com",nocase; http_uri; content:"/exchange328e91ec88ae4615bbc38ab6ce41104e/jspuser328e91ec88ae4615bbc38ab6ce41107e/?08a3ea=brian_casey@capgroup.com",nocase; classtype:attempted-recon; sid:200006844; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"doveadolescentservices-my.sharepoint.com:443",nocase; http_uri; content:"/:b:/g/personal/alice_dovecare_co_uk/eux9kze32kbkhhfsn9xq0neblkljq83z_9o1u8jpewiq2a?e=4%3ah1ax4s&amp\;at=9",nocase; classtype:attempted-recon; sid:200006845; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"downehouseschool-my.sharepoint.com",nocase; http_uri; content:"/:u:/g/personal/robson-hemmingsi_downehouse_net/evxeexzy66hjj9rkfmnus38bolc6coukehkxv--swrydfw?e=jvp1fk",nocase; classtype:attempted-recon; sid:200006846; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dowwr.com",nocase; http_uri; content:"/.sharepointdrvedrve/commmon/oauths/owa/enclosed_document/enclosed_document/jj.5drivezip/",nocase; classtype:attempted-recon; sid:200006847; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/19tpqpl-rcxwj-fqpk9yfzch19qtdx50y/view",nocase; classtype:attempted-recon; sid:200006848; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/19zpw90jgon3j5merxi1pauvkjdmx8nfq/edit",nocase; classtype:attempted-recon; sid:200006849; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1bcdyitw2vo5jp6yrbdmiy8cfrkcf4tby/view?usp=drive_web",nocase; classtype:attempted-recon; sid:200006850; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1c5o9_y8_octsepwyojfarn1k-kj4d9fe",nocase; classtype:attempted-recon; sid:200006851; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1cc4iizuwctob05muvpmydl-rruxdfimu/edit",nocase; classtype:attempted-recon; sid:200006852; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1cppgzjnodnftsks_w82um_b_ctgzn-ah/edit",nocase; classtype:attempted-recon; sid:200006853; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1cvc0ts0fkrsyx6vnnuypmotnh7jkcsln/edit",nocase; classtype:attempted-recon; sid:200006854; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1d47d5zh0cxucg1uupib1hyg9mhhe0ziq/view",nocase; classtype:attempted-recon; sid:200006855; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1fdgs5g6fqqkudcl2meym63ua3yu0o-tb/view?usp=drive_web",nocase; classtype:attempted-recon; sid:200006856; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1fsvmjkcq7ennrsfdufkcxshfhnda_fui/view",nocase; classtype:attempted-recon; sid:200006857; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1ginbnlpvt7kpfnog9a68fqmn7k3aivui",nocase; classtype:attempted-recon; sid:200006858; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1hdvx7j89h5l7yz39idgzhqji93jnkl_c/view",nocase; classtype:attempted-recon; sid:200006859; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1ik3uxh3rdigwar7d269wvkowp17cci1n/edit",nocase; classtype:attempted-recon; sid:200006860; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1jixb69t_nw9tmkhvfrejkfzof3d-ijet/view",nocase; classtype:attempted-recon; sid:200006861; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1jvfh6wq9ea9kxr1shhwbh3pecflqzppc/edit",nocase; classtype:attempted-recon; sid:200006862; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1knolz4xw7mgncsjysbomy_y4zxlk6zld/view?usp=sharing",nocase; classtype:attempted-recon; sid:200006863; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1mg5asnyoeet7qsg2n0d_2paxc3j7wx3k/edit",nocase; classtype:attempted-recon; sid:200006864; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1qf58h-1lunq1pubplwdhwd3uooj_vjxa/view",nocase; classtype:attempted-recon; sid:200006865; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1robiosanbh8doqa7yuiewn3akz4094ho/edit",nocase; classtype:attempted-recon; sid:200006866; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1ttaa6m96xsz9kxqa0zy3mzoirfmbspkd/view?usp=sharing",nocase; classtype:attempted-recon; sid:200006867; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1xpjy2kxsljvynrhgntllyzgvlzfxmvuc/view?usp=sharing",nocase; classtype:attempted-recon; sid:200006868; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"drive.google.com",nocase; http_uri; content:"/file/d/1zmjm3f6e-mgx8ev829md4mxxyd300nbb",nocase; classtype:attempted-recon; sid:200006869; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"dyr-qst.com",nocase; http_uri; content:"/mn.php",nocase; classtype:attempted-recon; sid:200006870; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"e-donusum.vbt.com.tr",nocase; http_uri; content:"/tmp/?0120amyuym91y2hhcmraywkyyi5jb20n552",nocase; classtype:attempted-recon; sid:200006871; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebayfraud.gremlins-in-it.com",nocase; http_uri; content:"/fraudulent.html",nocase; classtype:attempted-recon; sid:200006872; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ebhwt.com.cn",nocase; http_uri; content:"/yzms.html",nocase; classtype:attempted-recon; sid:200006873; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ecomcrew.staging.wpengine.com",nocase; http_uri; content:"/wp-content/plugins/alldomain/domain/dmain/index.php?i=i&amp\;0=abuse@optusnet.com.au",nocase; classtype:attempted-recon; sid:200006874; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ecusltd-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/angela_ure_ecusltd_co_uk/_layouts/15/wopiframe.aspx?guestaccesstoken=umwosbguhwaqic3hhtqfly7zjwf8oggrcn6d%2bggohoc%3d&docid=1_1956f6e254d71417a89981b2a1c8d0a99&wdformid=%7be61ca4f5-c461-425a-a52e-4598e7b699e5%7d&action=formsubmit&cid=4ab9a2a7-7cf4-43ae-8149-ffead8d66e7b",nocase; classtype:attempted-recon; sid:200006875; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"edje.com",nocase; http_uri; content:"/cmspagephotos/80-dj774h8dfy/valid",nocase; classtype:attempted-recon; sid:200006876; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"edulindberghschools-my.sharepoint.com",nocase; http_uri; content:"/personal/20jessicamiller_lindberghschools_ws/_layouts/15/wopiframe.aspx?guestaccesstoken=jv9wbvf6jfqmu%2bpjy3c%2bj7gd%2bvswnc1xz8o9bkulrkm%3d&docid=1_124e7318433ca471780ebffb8ed3119fb&wdformid=%7bfbf01b7f%2dc381%2d45e7%2daa1a%2d86eb8e279071%7d%2f&action=formsubmit",nocase; classtype:attempted-recon; sid:200006877; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eeverywhere-my.sharepoint.com",nocase; http_uri; content:"/personal/marco_eeverywhere_com/_layouts/15/onedrive.aspx?id=/personal/marco_eeverywhere_com/documents/documents&amp\;originalpath=ahr0chm6ly9lzxzlcnl3agvyzs1tes5zagfyzxbvaw50lmnvbs86zjovcc9tyxjjby9fcwhvbeq1x3hltknorzbdmdvvmgjvvujoy1z3b25futjvejhtlwxqrg9svwvrp3j0aw1lpvduaunytfu4mlvn",nocase; classtype:attempted-recon; sid:200006878; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"electricmind.us",nocase; http_uri; content:"/3977-95-1883-62261799/wir/tindex7.html",nocase; classtype:attempted-recon; sid:200006879; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"elgozon8589.eshost.com.ar",nocase; http_uri; content:"/iniciar%20sesi%c3%b3n.html",nocase; classtype:attempted-recon; sid:200006880; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"emailmeform.com",nocase; http_uri; content:"/builder/form/rn6bf7v0znavp58",nocase; classtype:attempted-recon; sid:200006881; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"encrypted-tbn0.gstatic.com",nocase; http_uri; content:"/images?q=tbn:and9gctpssw1eco05z7yyt9h5de gpvythapzl23nhw&amp\;usqp=cau",nocase; classtype:attempted-recon; sid:200006882; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ersfilter-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/nradonich_ersfilter_com/_layouts/15/wopiframe.aspx?guestaccesstoken=t6t%2fhn1dkbyhlyx%2beimbazufa43rrgz6%2faaaewnocdi%3d&docid=1_18168db23429e45f29fdf2e7be120efc4&wdformid=%7bb9970f62%2d44c3%2d4d09%2d9929%2d6e1eb652da57%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200006883; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ersfilter-my.sharepoint.com",nocase; http_uri; content:"/personal/nradonich_ersfilter_com/_layouts/15/wopiframe.aspx?guestaccesstoken=6ywmlbqi9 sjfgzhadhvte2gyowjf83iqbjrjehik4s=&amp\;docid=1_135f7008dfbfa44e6b09dab0eb165b997&amp\;wdformid={e037f2d9-5daa-4916-ba03-eb11d0aa6dea}&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200006884; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ersfilter-my.sharepoint.com",nocase; http_uri; content:"/personal/nradonich_ersfilter_com/_layouts/15/wopiframe.aspx?guestaccesstoken=6ywmlbqi9%20sjfgzhadhvte2gyowjf83iqbjrjehik4s=&amp\;docid=1_135f7008dfbfa44e6b09dab0eb165b997&amp\;wdformid={e037f2d9-5daa-4916-ba03-eb11d0aa6dea}&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200006885; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eswissch.blogspot.com",nocase; http_uri; content:"/?m=0",nocase; classtype:attempted-recon; sid:200006886; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eternityflooringcom-my.sharepoint.com",nocase; http_uri; content:"/personal/selena_eternityflooring_com/_layouts/15/doc.aspx?sourcedoc={29a0efff-8f51-40d9-bcd9-4bcf8ae74f33}&amp\;action=default&amp\;slrid=6b27489f-b027-a000-cb27-3003139f9096&amp\;originalpath=ahr0chm6ly9ldgvybml0ewzsb29yaw5ny29tlw15lnnoyxjlcg9pbnquy29tlzpvoi9nl3blcnnvbmfsl3nlbgvuyv9ldgvybml0ewzsb29yaw5nx2nvbs9fdl92b0nsumo5bef2tmxmejryblr6tujpogm4v1nqd3pvbetjlw41q3u3ukrbp3j0aw1lpv91atzqq2pmmtbn&amp\;cid=1ad0104b-547c-477b-be5a-854c21f3580b",nocase; classtype:attempted-recon; sid:200006887; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eternityflooringcom-my.sharepoint.com",nocase; http_uri; content:"/personal/selena_eternityflooring_com/_layouts/15/doc.aspx?sourcedoc={29a0efff-8f51-40d9-bcd9-4bcf8ae74f33}&amp\;action=default&amp\;slrid=9e004d9f-c028-a000-7c23-0d326de333e6&amp\;originalpath=ahr0chm6ly9ldgvybml0ewzsb29yaw5ny29tlw15lnnoyxjlcg9pbnquy29tlzpvoi9nl3blcnnvbmfsl3nlbgvuyv9ldgvybml0ewzsb29yaw5nx2nvbs9fdl92b0nsumo5bef2tmxmejryblr6tujpogm4v1nqd3pvbetjlw41q3u3ukrbp3j0aw1lpxozoufndjdxmtbn&amp\;cid=502ded77-e010-4694-a1c8-3e651bc6ea9e",nocase; classtype:attempted-recon; sid:200006888; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"eurobankovnikredit.com",nocase; http_uri; content:"/?fbclid=iwar3cu_8pblosqw-rwa7evcrs5jpl6zvzkou0qrf7vl9oqge4h2ctmcxrdyk",nocase; classtype:attempted-recon; sid:200006889; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s321/client/snv?noteguid=777735b6-7206-0be1-628f-b095ff26a485&amp\;notekey=803670c5e267fe76b14b5c7466cb9dd8&amp\;sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs321%2fsh%2f777735b6-7206-0be1-628f-b095ff26a485%2f803670c5e267fe76b14b5c7466cb9dd8&amp\;title=you%2bhave%2ba%2bfax%2521%2bcopy%2bcopy",nocase; classtype:attempted-recon; sid:200006890; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s321/client/snv?noteguid=777735b6-7206-0be1-628f-b095ff26a485&notekey=803670c5e267fe76b14b5c7466cb9dd8&sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs321%2fsh%2f777735b6-7206-0be1-628f-b095ff26a485%2f803670c5e267fe76b14b5c7466cb9dd8&title=you%2bhave%2ba%2bfax%2521%2bcopy%2bcopy",nocase; classtype:attempted-recon; sid:200006891; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s321/sh/9b9c2e56-0df3-1e03-5a66-617cf5ca0041/1153b91b874b7a19b82fe1a3955ecad2",nocase; classtype:attempted-recon; sid:200006892; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s339/client/snv?noteguid=f48e12fd-48da-e57f-8e76-cdf6e4054e1d&amp\;notekey=02a9fa6bd051dc6b4581ee3b617b3f88&amp\;sn=https://www.evernote.com/shard/s339/sh/f48e12fd-48da-e57f-8e76-cdf6e4054e1d/02a9fa6bd051dc6b4581ee3b617b3f88&amp\;title=optus%20webmail",nocase; classtype:attempted-recon; sid:200006893; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s339/client/snv?noteguid=f48e12fd-48da-e57f-8e76-cdf6e4054e1d&notekey=02a9fa6bd051dc6b4581ee3b617b3f88&sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs339%2fsh%2ff48e12fd-48da-e57f-8e76-cdf6e4054e1d%2f02a9fa6bd051dc6b4581ee3b617b3f88&title=optus%2bwebmail",nocase; classtype:attempted-recon; sid:200006894; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s339/sh/f48e12fd-48da-e57f-8e76-cdf6e4054e1d/02a9fa6bd051dc6b4581ee3b617b3f88",nocase; classtype:attempted-recon; sid:200006895; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s349/client/snv?noteguid=febdfb3a-d3dc-4087-8cc9-5f87708ee16b&notekey=8ca96608bc2196024b9081f6dcfcfb14&sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs349%2fsh%2ffebdfb3a-d3dc-4087-8cc9-5f87708ee16b%2f8ca96608bc2196024b9081f6dcfcfb14&title=new%2bfax%2bmessage%2breceived%2bcopy",nocase; classtype:attempted-recon; sid:200006896; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s417/client/snv?noteguid=df310074-30f9-9003-58c2-15885df371d2&notekey=3f0a7060a363b0def315a6d1c98f0a9c&sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs417%2fsh%2fdf310074-30f9-9003-58c2-15885df371d2%2f3f0a7060a363b0def315a6d1c98f0a9c&title=payment%2badvice%252fremittance",nocase; classtype:attempted-recon; sid:200006897; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s430/client/snv?noteguid=1e315989-372f-4f18-9094-04b8976afbff&amp\;notekey=9f2538feedc6675daabd34267b45ad36&amp\;sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs430%2fsh%2f1e315989-372f-4f18-9094-04b8976afbff%2f9f2538feedc6675daabd34267b45ad36&amp\;title=secured%2bmicrosoft%2bazure%2bfor%2bone%2bdrive%2bcloud%2bcopy",nocase; classtype:attempted-recon; sid:200006898; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s430/client/snv?noteguid=1e315989-372f-4f18-9094-04b8976afbff&notekey=9f2538feedc6675daabd34267b45ad36&sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs430%2fsh%2f1e315989-372f-4f18-9094-04b8976afbff%2f9f2538feedc6675daabd34267b45ad36&title=secured%2bmicrosoft%2bazure%2bfor%2bone%2bdrive%2bcloud%2bcopy",nocase; classtype:attempted-recon; sid:200006899; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s446/client/snv?noteguid=483c5f32-f1b7-7c70-925c-47f2705bab52&notekey=911c810bd15ccbd1f19fba1c3e4cc4d5&sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs446%2fsh%2f483c5f32-f1b7-7c70-925c-47f2705bab52%2f911c810bd15ccbd1f19fba1c3e4cc4d5&title=you%2bhave%2breceived%2ban%2binvoice",nocase; classtype:attempted-recon; sid:200006900; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s446/client/snv?noteguid=4dc119ab-57d6-b8e0-4fcb-c11c0a637b94&notekey=9ddb3753cb700b0c86a78176be71f4f5&sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs446%2fsh%2f4dc119ab-57d6-b8e0-4fcb-c11c0a637b94%2f9ddb3753cb700b0c86a78176be71f4f5&title=you%2bhave%2breceived%2ban%2binvoice.",nocase; classtype:attempted-recon; sid:200006901; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s446/sh/483c5f32-f1b7-7c70-925c-47f2705bab52/911c810bd15ccbd1f19fba1c3e4cc4d5",nocase; classtype:attempted-recon; sid:200006902; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s446/sh/4dc119ab-57d6-b8e0-4fcb-c11c0a637b94/9ddb3753cb700b0c86a78176be71f4f5",nocase; classtype:attempted-recon; sid:200006903; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s661/client/snv?noteguid=bb8d3313-c8e9-0ead-34c7-0a149c4fd42d&notekey=f25f8be6665ac7e37aff532080567fab&sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs661%2fsh%2fbb8d3313-c8e9-0ead-34c7-0a149c4fd42d%2ff25f8be6665ac7e37aff532080567fab&title=you%2bhave%2breceived%2ba%2bsecure%2bdocument%2bvia%2bonedrive.",nocase; classtype:attempted-recon; sid:200006904; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s672/client/snv?noteguid=b30b4b36-5bf9-846c-0577-bbb0c4439efc&notekey=2f0f6f89194031fabbc3b4a455071a64&sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs672%2fsh%2fb30b4b36-5bf9-846c-0577-bbb0c4439efc%2f2f0f6f89194031fabbc3b4a455071a64&title=microsoft%2boffice365",nocase; classtype:attempted-recon; sid:200006905; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"evernote.com",nocase; http_uri; content:"/shard/s740/client/snv?noteguid=6dd4c982-2f3f-7d83-4e18-5e028127e7d1&notekey=399d3f6c5e422fb90527fefea85cfc44&sn=https%3a%2f%2fwww.evernote.com%2fshard%2fs740%2fsh%2f6dd4c982-2f3f-7d83-4e18-5e028127e7d1%2f399d3f6c5e422fb90527fefea85cfc44&title=initial%2bpage",nocase; classtype:attempted-recon; sid:200006906; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"everythingmobilelimited-my.sharepoint.com",nocase; http_uri; content:"/personal/jameswaterston_everythingmobilelimited_onmicrosoft_com/_layouts/15/onedrive.aspx",nocase; classtype:attempted-recon; sid:200006907; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"everythingmobilelimited-my.sharepoint.com",nocase; http_uri; content:"/personal/jameswaterston_everythingmobilelimited_onmicrosoft_com/_layouts/15/onedrive.aspx?id=/personal/jameswaterston_everythingmobilelimited_onmicrosoft_com/documents/new%20project.pdf&amp\;parent=/personal/jameswaterston_everythingmobilelimited_onmicrosoft_com/documents&amp\;originalpath=ahr0chm6ly9ldmvyexroaw5nbw9iawxlbgltaxrlzc1tes5zagfyzxbvaw50lmnvbs86yjovzy9wzxjzb25hbc9qyw1lc3dhdgvyc3rvbl9ldmvyexroaw5nbw9iawxlbgltaxrlzf9vbm1py3jvc29mdf9jb20vrvdlwwrbqvrqvzlqz0nvvjhmlwvavdrcc3lhv3rndhpvvfbla01pdfdkqnnzut9ydgltzt1ouuvztxjrudjvzw",nocase; classtype:attempted-recon; sid:200006908; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"excelelectrical0-my.sharepoint.com",nocase; http_uri; content:"/personal/tim_hansen_excelelectrical_com/_layouts/15/onedrive.aspx?id=/personal/tim_hansen_excelelectrical_com/documents/open%20to%20view%20shared%20document%20in%20hitech%20sharepoint&amp\;originalpath=ahr0chm6ly9legnlbgvszwn0cmljywwwlw15lnnoyxjlcg9pbnquy29tlzpmoi9nl3blcnnvbmfsl3rpbv9oyw5zzw5fzxhjzwxlbgvjdhjpy2fsx2nvbs9fa2zoazdydndfaettvl9pwulkctdzmejlveeyr3awzwjnsdfkrgdjrfdfttznp3j0aw1lpunrvevzrwxcmlvn",nocase; classtype:attempted-recon; sid:200006909; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exclusivegearsbd.com",nocase; http_uri; content:"/https/181.58.39.1984341/sucursalpersonas.transaccionesbancolombia.com/mua/index.html",nocase; classtype:attempted-recon; sid:200006910; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exclusivegearsbd.com",nocase; http_uri; content:"/https/186.155.92.1235811/sucursalpersonas.transaccionesbancolombia.com/mua/index.html",nocase; classtype:attempted-recon; sid:200006911; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"explorebathurst.com.au",nocase; http_uri; content:"/rrefeeieoj.html?erectrcsq@*cthiytvcdx$zsxycuikjmkjivee$terdtygjyvtrre",nocase; classtype:attempted-recon; sid:200006912; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"exproofpoint.com",nocase; http_uri; content:"/imct.nerb/inac.php",nocase; classtype:attempted-recon; sid:200006913; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fabiasurgical.com",nocase; http_uri; content:"/cot/home/myaccount/access.php?websrc=e17ea285ad581008aac6b89b49ab879e&amp\;dispatched=93&amp\;id=5780985401",nocase; classtype:attempted-recon; sid:200006914; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fabiasurgical.com",nocase; http_uri; content:"/cot/home/myaccount/billing.php?websrc=e17ea285ad581008aac6b89b49ab879e&amp\;dispatched=68&amp\;id=4976600593",nocase; classtype:attempted-recon; sid:200006915; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fabiasurgical.com",nocase; http_uri; content:"/cot/home/myaccount/vbv.php?websrc=e17ea285ad581008aac6b89b49ab879e&amp\;dispatched=75&amp\;id=3180227014",nocase; classtype:attempted-recon; sid:200006916; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fastupload.ybjcsoft.com",nocase; http_uri; content:"/login.paypal/wnjblmdk=/index.php",nocase; classtype:attempted-recon; sid:200006917; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fastupload.ybjcsoft.com",nocase; http_uri; content:"/login.paypal/wnjblmdk=/index.php...",nocase; classtype:attempted-recon; sid:200006918; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"favour-europe.com",nocase; http_uri; content:"/usps",nocase; classtype:attempted-recon; sid:200006919; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"favour-europe.com",nocase; http_uri; content:"/usps/",nocase; classtype:attempted-recon; sid:200006920; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"feedlot.com.ar",nocase; http_uri; content:"/to/authorize_client_id:hl2je3nc-o128-ifbd-t1kn-yakh3ls509pf_p1wi6no4rzlmsg29c30ftyjbdxhk78v5ueaqj2z0bpownumratv59xs6e713dg8h4lckfqiy4fzwtgs8x12dqjrc6aoik73hvpeum05blyn9?data=&amp\;email=info@tamarackpipeline.com",nocase; classtype:attempted-recon; sid:200006921; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"feedproxy.google.com",nocase; http_uri; content:"/~r/lnqsfxqwsed/~3/yywjpi-42i4/analog.php",nocase; classtype:attempted-recon; sid:200006922; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"feedproxy.google.com",nocase; http_uri; content:"/~r/spqgxlzjlss/~3/byf895vf6tk/nutrition.php",nocase; classtype:attempted-recon; sid:200006923; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"feeds.feedburner.com",nocase; http_uri; content:"/investorway",nocase; classtype:attempted-recon; sid:200006924; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fifohbibou.blogspot.com",nocase; http_uri; content:"/?m=1",nocase; classtype:attempted-recon; sid:200006925; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/achproject509353-i353-3ih5f-10.appspot.com/o/achbf-vye-ur-g8%252fbv-ebry-8g%252fbf-vye-ur-g8%252fbv-ebry-8g%25%40fabf-vye-ur-g8%252fbv-ebry-8g10.html?alt=media&amp\;token=cf886132-ee55-43e8-9d0f-a6dbb7ba590a#",nocase; classtype:attempted-recon; sid:200006926; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/armaoffices.appspot.com/o/fdsklxrsqgdkqrwszsprjmbwtftqgpthwjwqjvvzscstgnmcvbblfcbcgwzjjbt.htm?alt=media&token=e3feec53-9d57-4eff-9b7a-d58e91e54d4c#user@domain.com",nocase; classtype:attempted-recon; sid:200006927; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/asno-ec966.appspot.com/o/dhl-new-hash.html?alt=media&amp\;token=fba9bf90-b41c-48e5-9f47-eee71a69b049",nocase; classtype:attempted-recon; sid:200006928; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/bet2604ver.appspot.com/o/bet2604ver%2findex2bat904rff27dcf22a2ea9163406004.html?alt=media&token=e70fe211-f84a-4ae7-a4d0-c9376ee4cf57#",nocase; classtype:attempted-recon; sid:200006929; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/biyugbhiuhgy7o900-h9oh98h9-987.appspot.com/o/vnmbvuyt8-8y98yh0%3d890y8iuh9yyh%2f5rtyfghtfyu67-9876trfc%3d9ygv.htm?alt=media&amp\;token=dce6f041-19ff-4e8a-8012-1cfdac4cf369#bv@pplsi.com",nocase; classtype:attempted-recon; sid:200006930; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/bmvfhjewter358bsvgtst.appspot.com/o/!%40%25%24%23ohow2%26%25%26%24%23!%23%24!.html?alt=media&amp\;token=a7216a8f-9691-45b2-9775-693dd99503e8#randyharp@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200006931; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/bnnnnnn-2133f.appspot.com/o/sboy.htm?alt=media&token=4b58a3ec-3a18-4152-a41f-55a89a34d017&login",nocase; classtype:attempted-recon; sid:200006932; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/bus0607clougensatem.appspot.com/o/bus0607clougen%2findex2bus0607447d066cb774.html?alt=media&amp\;token=5baac3e2-5da8-4153-86b4-8971a2ac5892#banko@10acrewood.com",nocase; classtype:attempted-recon; sid:200006933; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/car2-2004crgpng.appspot.com/o/index2ibicar.html?alt=media&amp\;token=9c9647f6-f132-4e13-8ad4-c44765b9133e#abuse@google.com",nocase; classtype:attempted-recon; sid:200006934; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/ceoagogo-76923.appspot.com/o/owa20934856%2findex.html?alt=media&token=7a9d6756-93f2-499f-9f94-a9aaa3c5dd51#reima.helminen@utu.fi",nocase; classtype:attempted-recon; sid:200006935; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/ceoagogo-76923.appspot.com/o/owa20934856%2findex.html?alt=media&token=7a9d6756-93f2-499f-9f94-a9aaa3c5dd51#service.itz@zhdk.ch",nocase; classtype:attempted-recon; sid:200006936; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/cjrnpslmbkmsnnffjnjjxzdf7.appspot.com/o/zgcgqzdmsmjflxmbbphppxtfvdcg%20(7).html?alt=media&amp\;token=420eab1e-153e-406c-a171-b7ab2ba04864",nocase; classtype:attempted-recon; sid:200006937; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/cphost-c0a1c.appspot.com/o/cig%2fc0a1c.appspot.com%2fv0%2fcpanel%2fumd-popper.min%2finbox%2fsha384-kj3o2dktikv%2fo%2findex2.html?alt=media&amp\;token=7ecda91c-77a0-4374-89b1-8b2a96e022fc#@yorku.ca",nocase; classtype:attempted-recon; sid:200006938; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/dam3005genwtbgfam.appspot.com/o/reddam0806%2flag0806famegen-040447d066cb774f1.html?alt=media&amp\;token=f1dd8ee6-33f2-4149-93f7-3db577373528#dickfleming@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200006939; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/dfhdskfkgkrgr8zrhrthrdrdh.appspot.com/o/!%23%24%26%25%24%23bn3%23%24!%26%25%24.html?alt=media&amp\;token=311bb9c7-ae6f-40e9-96e3-a06e7bccfa0e#viestinta@utu.fi",nocase; classtype:attempted-recon; sid:200006940; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/dr-clin-c4f68.appspot.com/o/drweb.html?alt=media&amp\;token=09293ba9-0738-41ea-9cf3-67cb43af2b88&amp\;x=famacas-cfa0appspotappspotmacas-macas-vfwefsaxsppspotcfa0ps&amp\;prox=p2000isolation@aaa.kr",nocase; classtype:attempted-recon; sid:200006941; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/dr-clin-c4f68.appspot.com/o/drweb.html?alt=media&amp\;token=09293ba9-0738-41ea-9cf3-67cb43af2b88&amp\;x=famacas-cfa0appspotappspotmacas-macas-vfwefsaxsppspotcfa0ps&amp\;prox=yourname@yourcompany.com",nocase; classtype:attempted-recon; sid:200006942; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/elprofessor0fficerd85.appspot.com/o/thankyou.html?alt=media&amp\;token=97df93ad-fb68-4c09-b6c1-90ed6dfdf02e",nocase; classtype:attempted-recon; sid:200006943; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/emailserver-6b445.appspot.com/o/shared%2fassignments%2fwebsite%2fg63%2fg63%20all%2findex.html?alt=media&amp\;token=077a9af1-5fc3-4ab8-974a-a2274660d199#absa.kenya@absa.africa",nocase; classtype:attempted-recon; sid:200006944; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/emailserver-6b445.appspot.com/o/shared%2fassignments%2fwebsite%2fg63%2fg63%20all%2findex.html?alt=media&token=077a9af1-5fc3-4ab8-974a-a2274660d199#abc@abc?email=abc@abc",nocase; classtype:attempted-recon; sid:200006945; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/goo2-ac630.appspot.com/o/goo (2).html?alt=media&amp\;token=2d1281a2-3364-420f-a3b5-c693b7bda1f2#a@b.com",nocase; classtype:attempted-recon; sid:200006946; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/gsdffdwatdfwdadddadsgd.appspot.com/o/!%23%24%40%26buli%24!%40%26!%40%23%24!%26.html?alt=media&amp\;token=110228a1-3566-41ef-b241-427ad3b25a9f#aaronfredricks@legalshield.com",nocase; classtype:attempted-recon; sid:200006947; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/hing9-f9bc0.appspot.com/o/hi1 (9).html?alt=media&amp\;token=0d56c7d7-2e03-41f5-b764-4473f0ad4d51#a@b.com",nocase; classtype:attempted-recon; sid:200006948; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/hutobonmu7g.appspot.com/o/butokilopo.html?alt=media&token=6b98d9bd-5513-45d3-ab8a-e46571a70ee4#user@example.org",nocase; classtype:attempted-recon; sid:200006949; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/lines-c8ae9.appspot.com/o/webmail_login.html?alt=media&amp\;token=8d06efff-8a8b-406d-bf41-edff2e36b932",nocase; classtype:attempted-recon; sid:200006950; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/lines-c8ae9.appspot.com/o/webmail_login.html?alt=media&amp\;token=8d06efff-8a8b-406d-bf41-edff2e36b932#raymondtripp@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200006951; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/macryti-109.appspot.com/o/kp-oe0%2fbtt-hash.html?alt=media&amp\;token=02abe8bd-5141-4b5a-a7d4-08120e5f43dd#choiteng@motenghaiplc.com",nocase; classtype:attempted-recon; sid:200006952; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/mail9-e6376.appspot.com/o/index.html?alt=media&amp\;token=f619a1f5-b1a4-4b63-9d00-6df1874c4b1b#memberservices@legalshield.com",nocase; classtype:attempted-recon; sid:200006953; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/master-a7f25.appspot.com/o/cerkcfroek.html?alt=media&amp\;token=420caa32-915f-40c5-86a6-28ada5625a7a&amp\;prox=eimaste@stinpriza.org",nocase; classtype:attempted-recon; sid:200006954; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/master-a7f25.appspot.com/o/cerkcfroek.html?alt=media&token=420caa32-915f-40c5-86a6-28ada5625a7a&prox=eimaste@stinpriza.org",nocase; classtype:attempted-recon; sid:200006955; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/mic-apps03629.appspot.com/o/index.html?alt=media&token=d9f4f11c-e123-4b2b-8cba-b4f3f3541786#peterawl@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200006956; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/mon-office.appspot.com/o/mscsq1-t-check-packet.htm?alt=media&token=72ab1aeb-a7a9-4a84-9852-099a56ca500e#dxnlckblegftcgxllm9yzw",nocase; classtype:attempted-recon; sid:200006957; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/ntachi-e1dbe.appspot.com/o/hgigieiciejceinhviejrie95489349%20(19).html?alt=media&amp\;token=5901e369-e71e-416b-9688-b21c62e31587#m.couvee@colasit.nl",nocase; classtype:attempted-recon; sid:200006958; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/on1rt-44071.appspot.com/o/index.html?alt=media&token=0d469e93-836b-4af8-b206-16a5d882d556#abuse@fasthosts.com",nocase; classtype:attempted-recon; sid:200006959; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/sm123%2findex.htm?alt=media&amp\;token=158cbd55-4c67-4ef6-b13f-d69aba854f3a",nocase; classtype:attempted-recon; sid:200006960; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/sm123%2findex.htm?alt=media&amp\;token=158cbd55-4c67-4ef6-b13f-d69aba854f3a#aaaa@example.jp",nocase; classtype:attempted-recon; sid:200006961; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/sm123%2findex.htm?alt=media&amp\;token=158cbd55-4c67-4ef6-b13f-d69aba854f3a#fgsnews@yorku.ca",nocase; classtype:attempted-recon; sid:200006962; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/sm123%2findex.htm?alt=media&amp\;token=158cbd55-4c67-4ef6-b13f-d69aba854f3a#test@test.de",nocase; classtype:attempted-recon; sid:200006963; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/sm123%2findex.htm?alt=media&amp\;token=158cbd55-4c67-4ef6-b13f-d69aba854f3a#test@test.test",nocase; classtype:attempted-recon; sid:200006964; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/sm123%2findex.htm?alt=media&amp\;token=158cbd55-4c67-4ef6-b13f-d69aba854f3a#vid@yorku.ca",nocase; classtype:attempted-recon; sid:200006965; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/sm123%2findex.htm?alt=media&token=158cbd55-4c67-4ef6-b13f-d69aba854f3a",nocase; classtype:attempted-recon; sid:200006966; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/sm123%2findex.htm?alt=media&token=158cbd55-4c67-4ef6-b13f-d69aba854f3a#kbaesler@bellsouth.net",nocase; classtype:attempted-recon; sid:200006967; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/sm123%2findex.htm?alt=media&token=158cbd55-4c67-4ef6-b13f-d69aba854f3a#landman56@att.net",nocase; classtype:attempted-recon; sid:200006968; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/sm123%2findex.htm?alt=media&token=158cbd55-4c67-4ef6-b13f-d69aba854f3a#sdeco@prodigy.net",nocase; classtype:attempted-recon; sid:200006969; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/tb%2findex.htm?alt=media&amp\;token=8176e96d-c102-4018-9888-17d4dec8d489#",nocase; classtype:attempted-recon; sid:200006970; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/onlineupdatebase3456.appspot.com/o/web123%2findex.htm?alt=media&amp\;token=442069a5-b026-42a7-bcea-e6d92963d1d3",nocase; classtype:attempted-recon; sid:200006971; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/ord0907clogensatm.appspot.com/o/index2ord0907447d066cb774.html?alt=media&amp\;token=2ce10760-9073-4421-8b15-4de88b7b3fdb#bb@bb.com.br",nocase; classtype:attempted-recon; sid:200006972; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/ord0907clogensatm.appspot.com/o/index2ord0907447d066cb774.html?alt=media&amp\;token=2ce10760-9073-4421-8b15-4de88b7b3fdb#eafaef@eafaef.com.br",nocase; classtype:attempted-recon; sid:200006973; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/ord0907clogensatm.appspot.com/o/index2ord0907447d066cb774.html?alt=media&amp\;token=2ce10760-9073-4421-8b15-4de88b7b3fdb#fdsfsdfsd@fdsfsdfsd.com.br",nocase; classtype:attempted-recon; sid:200006974; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/outlook-4c0f2.appspot.com/o/books%2fwebmail.htm?alt=media&amp\;token=216401d2-aba7-42f4-8fd5-9b672cade830#a@b.com",nocase; classtype:attempted-recon; sid:200006975; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/outlook-4c0f2.appspot.com/o/books%2fwebmail.htm?alt=media&amp\;token=216401d2-aba7-42f4-8fd5-9b672cade830#abuse@optusnet.com.au",nocase; classtype:attempted-recon; sid:200006976; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/outlook-4c0f2.appspot.com/o/books%2fwebmail.htm?alt=media&amp\;token=216401d2-aba7-42f4-8fd5-9b672cade830#tiekimas@tidlo.lt",nocase; classtype:attempted-recon; sid:200006977; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/q797k09738937033.appspot.com/o/kb9468478928903284782.html?alt=media&amp\;token=a19b3d7c-3450-40a6-81df-d5149266a912#fssf@fssf.com.br",nocase; classtype:attempted-recon; sid:200006978; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/qrwetryuiopoiouer.appspot.com/o/golibe%20first%20refud%20.html?alt=media&amp\;token=a8d86c77-73ee-4286-b3f5-70b77fda2646#aaaa@example.jp",nocase; classtype:attempted-recon; sid:200006979; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/recover-5622d.appspot.com/o/%23%26%26%23%40!%24%25smg%23%24%24%26%23.html?alt=media&token=e98506ab-1e03-43e1-b627-244173d11623#igorek@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200006980; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/rei-rezuio-rexire-565.appspot.com/o/%40%40%40indexv-vb-vau-ry-8%252fbv-yu-er-8f%25252525%2525252f%25252525%2525252f%25252525%2525252f%25252525%2525252f%25252525%20-%20copy.html?alt=media&amp\;token=da92acdd-870d-4049-b9ac-f0d373777f06#info@legalshield.com",nocase; classtype:attempted-recon; sid:200006981; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/rei-rezuio-rexire-565.appspot.com/o/%40%40%40indexv-vb-vau-ry-8%252fbv-yu-er-8f%25252525%2525252f%25252525%2525252f%25252525%2525252f%25252525%2525252f%25252525%20-%20copy.html?alt=media&amp\;token=da92acdd-870d-4049-b9ac-f0d373777f06#support@legalshieldcorp.com",nocase; classtype:attempted-recon; sid:200006982; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/rincekoza1234895.appspot.com/o/index.html?alt=media&token=887ed9fa-b401-4749-84cf-6359bda5ca8a",nocase; classtype:attempted-recon; sid:200006983; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/rned-a824v.appspot.com/o/gen%252findex2oli.html?alt=media&amp\;token=828c2259-c86f-442e-91a0-8d43a1fe7d8b#abuse@optusnet.com.au",nocase; classtype:attempted-recon; sid:200006984; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/serveradministratoryikjrpee1.appspot.com/o/second%20(1).html?alt=media&amp\;token=d92aaee3-61c4-4326-9384-d39d22513c26#info@cobos-fs.de",nocase; classtype:attempted-recon; sid:200006985; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/solomidey-57f22.appspot.com/o/%ec%8a%b5s832%eb%8b%a4%ed%95%a0j%ec%98%a4%eb%98%90%eb%8b%a4f-1dr2%ec%9d%80bo%2f-%ec%9e%88otr4s%eb%a1%9cuz9-tov%ec%9e%88-73l-os%eb%8b%88os9%ec%98%a4ck-z-rr%2f-5-lc:26ppdz3:a%ed%95%a0nb%ed%95%a08%eb%b0%9bw%ec%82%ac%2f487hhu74y.html?alt=media&amp\;token=2a2c8312-b0dd-4adf-8b8a-d5655ecb2174#",nocase; classtype:attempted-recon; sid:200006986; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/spo2706genclou97.appspot.com/o/rbtreplac1909%2findex2rbt1909.html?alt=media&amp\;token=11006eda-0bfe-430b-8ae9-113c3b453622#klima@mup.cz",nocase; classtype:attempted-recon; sid:200006987; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/start-e65e8.appspot.com/o/index.html?alt=media&amp\;token=238a55a4-cd6d-4df2-8cb8-eca24b670093",nocase; classtype:attempted-recon; sid:200006988; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/syundon-45969.appspot.com/o/vutoprwz.html?alt=media&token=d778956b-9882-4818-863e-5e6d5627d4ea",nocase; classtype:attempted-recon; sid:200006989; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/tei-neriou-reuix-678.appspot.com/o/%40%40%40indexv-vb-veu-ry-8%25433%2569.html?alt=media&amp\;token=6b0a9c43-8711-491b-9f40-50ad280ffb32#ggradnigo@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200006990; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/trows9098.appspot.com/o/25%255e%2524%2523%2540.html?alt=media&amp\;token=51dbb7d7-54ca-47bb-bbfc-f03691ac3d14&amp\;utm_medium=marketing&amp\;%24web_only=true&amp\;_branch_match_id=716254997194823397#samba@jubileegroup.co.uk",nocase; classtype:attempted-recon; sid:200006991; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/tu-03yg-3yhg-3yh4g-93h4g-h.appspot.com/o/wrjfgbho3429uy-03294y-gf93hgf-9y%2f30t49u30-tu-3hg3hg-39g-jug.html?alt=media&amp\;token=a35ff937-2752-4bdc-b4fe-da15853821c5#jtucker@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200006992; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/tunewhctkjvzxjfzfxwkhnfshpct4.appspot.com/o/tuntbf-vye-ur-g8%252fbv-ebry-8g%252fbf-vye-ur-g8%252fbv-ebry-8g%25%40fabf-vye-ur-g8%252fbv-ebry-8g%20-%20copy%20(7).html?alt=media&token=27479f48-3c7f-4e9b-89f3-71d3885085aa#info@asona.nl",nocase; classtype:attempted-recon; sid:200006993; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/user3987267105468.appspot.com/o/a1%2findex.htm?alt=media&amp\;token=0ea51307-7b68-4058-abb5-4d7006478527#test@example.com",nocase; classtype:attempted-recon; sid:200006994; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/user3987267105468.appspot.com/o/xt%2findex.htm?alt=media&token=673d3b79-aa9b-43eb-8526-d9e508f2035c#",nocase; classtype:attempted-recon; sid:200006995; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/wdrhghxlcnwtjkjltmrtztqlh.appspot.com/o/celibacy - copy (7).html?alt=media&amp\;token=30c670b1-9299-45c6-a16b-5bd1037c4499#@yorku.ca",nocase; classtype:attempted-recon; sid:200006996; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/work-project-333bf.appspot.com/o/updateloginnowss.htm?alt=media&token=d867adc6-ee5a-4c1d-b871-97640129a5dd#mail@example.com",nocase; classtype:attempted-recon; sid:200006997; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/xmailzytrsdemailkipt.appspot.com/o/dom1.html?alt=media&amp\;token=2c0996a9-d916-47f9-9d23-d876408acb88#aaaa@example.jp",nocase; classtype:attempted-recon; sid:200006998; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/xsxiz-77918.appspot.com/o/zx8six.html?alt=media&amp\;token=37023509-8607-4487-99de-22f2f5480716#reneesumpter@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200006999; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/ze-nerio-reoz-447.appspot.com/o/indexxxv3534.html?alt=media&amp\;token=147ed254-cb63-40a9-aca6-9e544f1929f1#abuse@uregina.ca",nocase; classtype:attempted-recon; sid:200007000; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/zhi3006clogenusd.appspot.com/o/zhi3006clogenusd%2findex2zhi3006i447d066cb774.html?alt=media&amp\;token=ac8398b1-6be0-4e85-b567-10779ffd66f3#chammond@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200007001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/zhi3006clogenusd.appspot.com/o/zhi3006clogenusd%2findex2zhi3006i447d066cb774.html?alt=media&amp\;token=ac8398b1-6be0-4e85-b567-10779ffd66f3#davidedavis@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200007002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/zhi3006clogenusd.appspot.com/o/zhi3006clogenusd%2findex2zhi3006i447d066cb774.html?alt=media&amp\;token=ac8398b1-6be0-4e85-b567-10779ffd66f3#dougbloomer@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200007003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/zhi3006clogenusd.appspot.com/o/zhi3006clogenusd%2findex2zhi3006i447d066cb774.html?alt=media&amp\;token=ac8398b1-6be0-4e85-b567-10779ffd66f3#dove@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200007004; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"firebasestorage.googleapis.com",nocase; http_uri; content:"/v0/b/zhi3006clogenusd.appspot.com/o/zhi3006clogenusd%2findex2zhi3006i447d066cb774.html?alt=media&amp\;token=ac8398b1-6be0-4e85-b567-10779ffd66f3#locy@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200007005; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"flavena.co.rs",nocase; http_uri; content:"/mc.html",nocase; classtype:attempted-recon; sid:200007006; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"flow.page",nocase; http_uri; content:"/btconnnect",nocase; classtype:attempted-recon; sid:200007007; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"flowcode.com",nocase; http_uri; content:"/p/dnitl0pla?",nocase; classtype:attempted-recon; sid:200007008; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"flowcode.com",nocase; http_uri; content:"/page/btconnnect",nocase; classtype:attempted-recon; sid:200007009; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fn.tc",nocase; http_uri; content:"/p9j2",nocase; classtype:attempted-recon; sid:200007010; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fn.tc",nocase; http_uri; content:"/p9jg",nocase; classtype:attempted-recon; sid:200007011; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"form.123formbuilder.com",nocase; http_uri; content:"/5884980",nocase; classtype:attempted-recon; sid:200007012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"form.asana.com",nocase; http_uri; content:"/?k=cdxmabdeiqp1ls8o45yzlw&amp\;d=1200547430279636",nocase; classtype:attempted-recon; sid:200007013; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"form.jotform.com",nocase; http_uri; content:"/elenabrown266/government-pandemic-extra-stimulus-",nocase; classtype:attempted-recon; sid:200007014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/19fzdjrlxxquwqpf7",nocase; classtype:attempted-recon; sid:200007015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/1tzv1hp4qhvnccoq8",nocase; classtype:attempted-recon; sid:200007016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/4j3mttszzsm3asqh9",nocase; classtype:attempted-recon; sid:200007017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/9bwawhpz5vi7ilpe6",nocase; classtype:attempted-recon; sid:200007018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/b7lqaal42juffiw1a",nocase; classtype:attempted-recon; sid:200007019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/bfz2l7i3wvrp5heb9",nocase; classtype:attempted-recon; sid:200007020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/dncj4btc56n1n71n8",nocase; classtype:attempted-recon; sid:200007021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/edtu6r7rqxqyegcf6",nocase; classtype:attempted-recon; sid:200007022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/egj66jkgwkcd3aat8",nocase; classtype:attempted-recon; sid:200007023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/eozlrnnf7jh84xdp8",nocase; classtype:attempted-recon; sid:200007024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/fz7y7tfq5utrgcry8",nocase; classtype:attempted-recon; sid:200007025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/fzlons3fgnjdqdd19?omgbfzrazhlppbtx",nocase; classtype:attempted-recon; sid:200007026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/gjcgpyjcmp4cdrmn8",nocase; classtype:attempted-recon; sid:200007027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/gkszreuf5x38hgfb7",nocase; classtype:attempted-recon; sid:200007028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/goerpntl5tfeumdz6",nocase; classtype:attempted-recon; sid:200007029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/gr4b9sxradtcj7or7",nocase; classtype:attempted-recon; sid:200007030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/guptjarp2xatzbvo8",nocase; classtype:attempted-recon; sid:200007031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/iai7pzm4pxyb145i9",nocase; classtype:attempted-recon; sid:200007032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/jnkkauxwwbfhtuqz9?hkgotygikyoujp",nocase; classtype:attempted-recon; sid:200007033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/jzxtb9auexgjcewfa",nocase; classtype:attempted-recon; sid:200007034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/kb2rdkamvphenokva",nocase; classtype:attempted-recon; sid:200007035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/kehch96avaku7oey7?akowgmooutpwa",nocase; classtype:attempted-recon; sid:200007036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/puadbxscibgw5ma79?xfccuwmmhgwrwztd",nocase; classtype:attempted-recon; sid:200007037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/pzduf4a8ms7p3mot7",nocase; classtype:attempted-recon; sid:200007038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/qrrg7m5mcasfuk6e9",nocase; classtype:attempted-recon; sid:200007039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/ruaxzqjjzghi8rar9",nocase; classtype:attempted-recon; sid:200007040; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/rwpcmhm8vtfa7f4m8",nocase; classtype:attempted-recon; sid:200007041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/sj21ehdebhkcpvfv6",nocase; classtype:attempted-recon; sid:200007042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/smufgmyhduckbq6ka?fjxhgyroek",nocase; classtype:attempted-recon; sid:200007043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/uqzzznxv4cfhu3yr9",nocase; classtype:attempted-recon; sid:200007044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/v5xtnywt5s6zvpp27",nocase; classtype:attempted-recon; sid:200007045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/w6uh9p66tdq6l1m66",nocase; classtype:attempted-recon; sid:200007046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/wqycsyy8jhuhvaex7",nocase; classtype:attempted-recon; sid:200007047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/x3aasffazsrl8pcr9",nocase; classtype:attempted-recon; sid:200007048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/x8hybjggubfftabw8",nocase; classtype:attempted-recon; sid:200007049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/xxjqmu6luzkpnalg6",nocase; classtype:attempted-recon; sid:200007050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.gle",nocase; http_uri; content:"/yfxkceytox2zuyvb6",nocase; classtype:attempted-recon; sid:200007051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/formspro/pages/responsepage.aspx?id=t3dj48rwk0sjoalzgnmn6bafynfdky5orhyq9zv62tpuqusztlhxmvviuupxskvlrvmyuldyuko5ny4u&amp\;vt=e36377b7-70c4-4493-a338-095918d327e9_1973aa6c-a10f-46bb-a912-07c43f73112e_hash7_gcdqoyksqmupfbm4pwloqi%2bnuyahsmp%2b8bemc6qhdqu%3d",nocase; classtype:attempted-recon; sid:200007052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=60hhzfbtoe-qdzpnyrluyo-ivxb0mexgqufvg5tcyifunzg5uknzne1irjzvt1y3slewrepwnflmvs4u",nocase; classtype:attempted-recon; sid:200007053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=79zc40bzquqwhsumk8wi7ifmk8wscglbvpsk75lcq2funzlxovuzrfm2vthps0jfuzg1qvrevtkzmc4u",nocase; classtype:attempted-recon; sid:200007054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=9mkl-ub4beksg-bmxxmbpmobeab-n85cvyzfhjasiu5urvdoqja3q1vrqlyyvehtqu9vntfhvelqtc4u",nocase; classtype:attempted-recon; sid:200007055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=bu78ampjjeewrm5mbe2yjju5rluqqzbmpxmzobiguotum05arfrrr1bmmfhnqlvumlphtlfnrlg2mc4u",nocase; classtype:attempted-recon; sid:200007056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=cuqqaa9ryuoh9axxczoijhhpjakus7bnnjfzgq5cylhum0rptlhfndbbwfnmu1k2uktsve9jszk0rc4u",nocase; classtype:attempted-recon; sid:200007057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=cuqqaa9ryuoh9axxczoijhhpjakus7bnnjfzgq5cylhumus3nklqsuuzoetaofldrdjtvu82muhxms4u",nocase; classtype:attempted-recon; sid:200007058; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=cuqqaa9ryuoh9axxczoijhhpjakus7bnnjfzgq5cylhunehvsvgywurrwvfxr1qwodliwepdtkpqmi4u",nocase; classtype:attempted-recon; sid:200007059; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaaa__qth0uruodzxsevzmvldsepnvkjotudjm1e0nk9evy4u",nocase; classtype:attempted-recon; sid:200007060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaaa__qtvbajunvzamtfcvlq4q0yxm05pmkvwtllimzdnwc4u",nocase; classtype:attempted-recon; sid:200007061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaamaabxpdkjumkljwjzsnvpduec1tutmuvpqqtnlufnwuc4u",nocase; classtype:attempted-recon; sid:200007062; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaamaaca_cgtumlpuvfc1veneu0zwvenyu01asljnn0vfqi4u",nocase; classtype:attempted-recon; sid:200007063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaamaaca_cgtunexjt1hfrfi1nzk0n1lutthsnzvjv0e2uy4u",nocase; classtype:attempted-recon; sid:200007064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaamaaca_cgtuq00xqlhsr1hiwelun0rwwe0ymtfjmdawns4u",nocase; classtype:attempted-recon; sid:200007065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaamaaca_cgtuq0fpvfbfrkpnn0kxv08wrtvmoekymenbus4u",nocase; classtype:attempted-recon; sid:200007066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaamaacuhhh9urjbfulzfvulpnthxnljgquy0tdrpmulfry4u",nocase; classtype:attempted-recon; sid:200007067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaamaadtgljzurew0nuc4szawvznimehywuu5wvmyvfczri4u",nocase; classtype:attempted-recon; sid:200007068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaamaanf70j5umkk5t0gwtthlnly2mffpnzdzr0hqt0tlvi4u",nocase; classtype:attempted-recon; sid:200007069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaamaanf70j5uqtc4sei3tkhyn1hgwlmxslbvnvddqzjptc4u",nocase; classtype:attempted-recon; sid:200007070; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaan__idhxlruofndulbkv1yxuva0mvpbsdjynk02vtq0ws4u",nocase; classtype:attempted-recon; sid:200007071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaan__idqx2luqkvdqzfcvfpiulhrvzbisfngwefqsznrmc4u",nocase; classtype:attempted-recon; sid:200007072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaan__iryfuzurvngmfbtvdzfmjfgufhvwkm3rzzar1jvns4u",nocase; classtype:attempted-recon; sid:200007073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaan__jdhomtumug3tk00ruhdt0vhsudysluwq0rbnencmi4u",nocase; classtype:attempted-recon; sid:200007074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaanaadkwe9jumllwstgxmtdhvetgnjbqn0dfvlfiuzjsms4u",nocase; classtype:attempted-recon; sid:200007075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaanaarzinhfurfkytlznnvq2r0fumfhiseptn0i2sjdcsi4u",nocase; classtype:attempted-recon; sid:200007076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaanaasedm8vum1zrrk9zv1jzsjlvqvrawfgyrtbxvtjboc4u",nocase; classtype:attempted-recon; sid:200007077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaanaash00u5um0jmrk5fvlzatfphnddjslhct0tqofzdvy4u",nocase; classtype:attempted-recon; sid:200007078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaanaatnvo6numk8xntbxqk1dodlwu1bbrjjstfvjufjymy4u",nocase; classtype:attempted-recon; sid:200007079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__r4jmpzuqu9qvtnynuq0rfrlvdzznlzxquhpsercmi4u",nocase; classtype:attempted-recon; sid:200007080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__seywchunehdtzm5vjayvjzkmlvrs0vwnvbnujhnmy4u",nocase; classtype:attempted-recon; sid:200007081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__sfhld5uqvrirlzgntk0u1zsqzyysfawwvbbvu85ni4u",nocase; classtype:attempted-recon; sid:200007082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__sfnbxluqlbctexonfc4oevgnefcufywm1fjtju5ss4u",nocase; classtype:attempted-recon; sid:200007083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__snrwtpuqjvenecwqkzbnfdfr1jku0nkqjlwrzdsrc4u",nocase; classtype:attempted-recon; sid:200007084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__spb8hhurdnondhfouw3ndlavjdyrfddwjlzsedsvs4u",nocase; classtype:attempted-recon; sid:200007085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__srwmhxuretyne5nrjdkq0dasjznujm2mdhmsflkvy4u",nocase; classtype:attempted-recon; sid:200007086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__svkz5xurjnlvug3netwszexnudqovdyuda2tdyxrc4u",nocase; classtype:attempted-recon; sid:200007087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__sweyulumuxnwlbytvhlnu5wstyzvkviredwskzcws4u",nocase; classtype:attempted-recon; sid:200007088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__tdasqlurfrqmjzxneyxn0g3vexutfvzq0mztu9fms4u",nocase; classtype:attempted-recon; sid:200007089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__thg5xvuodnbwtvytzhwwdnctknvovo4tldctexmvi4u",nocase; classtype:attempted-recon; sid:200007090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaao__tmcie5uode4ourdofzzwepgtkdzmzjlwk40tfbkui4u",nocase; classtype:attempted-recon; sid:200007091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaayaaa0-vkzunzrzmu1zrda1odrftlnlodhguzlssfbhrs4u",nocase; classtype:attempted-recon; sid:200007092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaayaaa2meqpurufbvjc1q1czuke4ulrvr1y2oernqlzkvy4u",nocase; classtype:attempted-recon; sid:200007093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaayaaalzmthuourlq0vqtvfdt0u3wlhfretfvkhir0pvws4u",nocase; classtype:attempted-recon; sid:200007094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaayaaao2yyrurffavkw1u1lwulbawlbqwevzqtjkmulity4u",nocase; classtype:attempted-recon; sid:200007095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaayaaas-la5urvmwqvqyvufjmvbomu5vsvbcudywvezwsi4u",nocase; classtype:attempted-recon; sid:200007096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaayaaaunxyrumtzmrlnnv1hwvfdwr1zinvzutfrtvke0ty4u",nocase; classtype:attempted-recon; sid:200007097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaayaaave1ljumkjardbxn0plmkrbn1nsn1ztuezcvjhros4u",nocase; classtype:attempted-recon; sid:200007098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaayaaavwmwlumdq4m1donkpasdzhwehkvurptzdmndi2vc4u",nocase; classtype:attempted-recon; sid:200007099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaayaaawff7humutduk85ruwzn0hcovk4n0e3nunyovizvy4u",nocase; classtype:attempted-recon; sid:200007100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaayaaawk7snun0qyneuwr0nyntg0r1nwq05cn08wwefery4u",nocase; classtype:attempted-recon; sid:200007101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaayaaaycqtvurjexwuxnsu4znuvctzrywly4qviwt1frsi4u",nocase; classtype:attempted-recon; sid:200007102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaaz__g2q2wzuq1zynjq1wfhjr1y3wtrsszlxwthywljxrs4u",nocase; classtype:attempted-recon; sid:200007103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaaz__gs1jibumzjhwkezsdzvwvzendnnwly0r0zkmjrmtc4u",nocase; classtype:attempted-recon; sid:200007104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaaz__guylchunfcxt0prvurnsezcrtm4vdeytklcwuiytc4u",nocase; classtype:attempted-recon; sid:200007105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaaz__gy-0ydurtg3mzc4wfixveq3wdnbqvfovdbhvkxmtc4u",nocase; classtype:attempted-recon; sid:200007106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaaz__gyeyavunjvrv1nonjvhs0c4qvkwmfa3qlhurk5zsc4u",nocase; classtype:attempted-recon; sid:200007107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaaz__gypjlduqvravvlqtepnwlnjn1iytuc0mfixs0tfrc4u",nocase; classtype:attempted-recon; sid:200007108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaazaaadym1fuotfisfdam1fjmk1kqju3rk82uvnhvfptvc4u",nocase; classtype:attempted-recon; sid:200007109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaazaaaei3rhuq0fnuu5rmznyuky1t1gxmjfru1uxv1viuy4u",nocase; classtype:attempted-recon; sid:200007110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaazaaaets9fun1nfntazovrqn1lbwtdzrzlwqumynze0my4u",nocase; classtype:attempted-recon; sid:200007111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaazaaafdyoxurehctzjdmjfrwjntndjem0xenkntmtdhmy4u",nocase; classtype:attempted-recon; sid:200007112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaazaaaflubtumfhem0vlnfjuszu4tktmnk9xovzmqthytc4u",nocase; classtype:attempted-recon; sid:200007113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=dqsikwdsw0yxejajblztrqaaaaaaaaaaaazaaaiprvrunlrbuewzmvlkqljnrdlqukfsmlu4wevmry4u",nocase; classtype:attempted-recon; sid:200007114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=fz-8elvwiu6kicn2zo2olhg81y6qaolpsppzfph-tm5un0iyr0hnn1vqtezonjewuvhpq0tju0fqsi4u",nocase; classtype:attempted-recon; sid:200007115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=ihle7-a1oei7afvzywhaws5xiqgz8mfkm8p-86mqnr9undhln1lqteyzqvc1tlk5mfozwvawtknkmy4u",nocase; classtype:attempted-recon; sid:200007116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=jrbxvx3x9keewcq72hm6fnkqekonandcsjd9av060h5urepumvvgmks2te41rfewmlletulvufnuqy4u",nocase; classtype:attempted-recon; sid:200007117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=lsipqxnvleck4xxhpkfav5ivtrnxmdhngicoeqskxorunlaws1ngrujswvnvnzfdrfjnvljdtehmwi4u",nocase; classtype:attempted-recon; sid:200007118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=ngregipt_k6tg1m4a_cm6emdexhpbtfao3l5c4fjinbunk9qu1uwstjys1jumfnytlfhmllwsjuzvc4u",nocase; classtype:attempted-recon; sid:200007119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=o1kpbby4gegron8dfasq2ijzeu7mzr9pqflgizarhujun0vvvkrumvvxuecyt1hqmuo1ttg3we02tc4u",nocase; classtype:attempted-recon; sid:200007120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=qjetd-pj6eer0hggxsw7en8q0eijx4rkhjeopersgj5unjvevdlktextr0vdujg0mlvqs09uwvq1ui4u",nocase; classtype:attempted-recon; sid:200007121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=tdtustnlhem59-pmb0_bsirohc__jc9lgcdfek0aqshumudjnfiynehuuvnoquuxsthnmehfmvu3vs4u",nocase; classtype:attempted-recon; sid:200007122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=ucuxcxtdou2goz1lrb39f18hvs8pokvjkugvzz4uwvxumflbrjaywe1hq0q3tlo3sdjcvjfqmddbrc4u",nocase; classtype:attempted-recon; sid:200007123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=zxaxwd0jf06p5cqmduzpgkuxo26r9wtjo7rvzofgckbuodbeqtlmtlzislpjmui5n01zq1but0ptni4u",nocase; classtype:attempted-recon; sid:200007124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.office.com",nocase; http_uri; content:"/pages/responsepage.aspx?id=zzzg0pjjwuckyuiehxswjrab8y4i7hbcnnkwxccpxl5um08xmlzrs05ruerlwuphnknwmlm2ovnwsy4u",nocase; classtype:attempted-recon; sid:200007125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"forms.plumsail.com",nocase; http_uri; content:"/64976d98-2ab0-40a5-ab9c-d7d113806cad",nocase; classtype:attempted-recon; sid:200007126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fr.surveymonkey.com",nocase; http_uri; content:"/tr/v1/te/3dibjshkbteopejcyveukzfgk5_2fbstd44yfkr7bqhp11zjvcpjw0surtuzpuf2qr9mzgwyy3i4qmksyomzd0pmvazfgiiivs3av2sbftgbw8swcbawti1peoy4beoi6cg_2b_2f6v36nl_2b0_2b_2bqduvxadaq_3d_3d",nocase; classtype:attempted-recon; sid:200007127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fra1.digitaloceanspaces.com",nocase; http_uri; content:"/round-cube/r.html?email=dkadwan@dnata.jo",nocase; classtype:attempted-recon; sid:200007128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"franchino0-my.sharepoint.com",nocase; http_uri; content:"/personal/nchurchill_franchino_com/_layouts/15/guestaccess.aspx?guestaccesstoken=gxvs24po1pqv483r%2bksfddmp4j%2f%2fam07r2jepythmh0%3d&amp\;docid=1_1e885f7a3dd044717ae4b7322836b1672&amp\;wdformid=%7bcb419e87%2d6da3%2d41e3%2d9ad5%2d4971852f5dd5%7d",nocase; classtype:attempted-recon; sid:200007129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"free-counters.co.uk",nocase; http_uri; content:"/cgi-bin/go.pl?go=bfranklin.info?8466714862",nocase; classtype:attempted-recon; sid:200007130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freedomtonight.com",nocase; http_uri; content:"/connexion/105f60268899aad/region.php?particulier",nocase; classtype:attempted-recon; sid:200007131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freedomtonight.com",nocase; http_uri; content:"/connexion/1c57cc490e9d5e5/region.php?particulier",nocase; classtype:attempted-recon; sid:200007132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freedomtonight.com",nocase; http_uri; content:"/connexion/48e3e31d6f469f5/region.php?particulier",nocase; classtype:attempted-recon; sid:200007133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freedomtonight.com",nocase; http_uri; content:"/connexion/684ee8f67724e20/region.php?particulier",nocase; classtype:attempted-recon; sid:200007134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freedomtonight.com",nocase; http_uri; content:"/connexion/874e7b70f340c1b/region.php?particulier",nocase; classtype:attempted-recon; sid:200007135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freedomtonight.com",nocase; http_uri; content:"/connexion/d83e97792d12108/region.php?particulier",nocase; classtype:attempted-recon; sid:200007136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"freshskinandbodyfairport.com",nocase; http_uri; content:"/contact/",nocase; classtype:attempted-recon; sid:200007137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fsstradingco-my.sharepoint.com",nocase; http_uri; content:"/:b:/g/personal/jeff_fsstrading_com/ec1yk-fkwzlkst3oymd07zsbczspqpfzu5xd2yuha-cdkq?e=4:u3zdsc&amp\;",nocase; classtype:attempted-recon; sid:200007138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fsstradingco-my.sharepoint.com",nocase; http_uri; content:"/personal/jeff_fsstrading_com/_layouts/15/onedrive.aspx?id=/personal/jeff_fsstrading_com/documents/scans/scan210505142847/7992.346dod__513%20fa%20pdf.pdf&amp\;parent=/personal/jeff_fsstrading_com/documents/scans/scan210505142847&amp\;originalpath=ahr0chm6ly9mc3n0cmfkaw5ny28tbxkuc2hhcmvwb2ludc5jb20vomi6l2cvcgvyc29uywwvamvmzl9mc3n0cmfkaw5nx2nvbs9fyzf5ay1gs1dabetzvdnveu1emddac0jjwlnwcvbmwlu1wgqyevvoqs1dretrp3j0aw1lptfsymt5qzfymlvn",nocase; classtype:attempted-recon; sid:200007139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fsstradingco-my.sharepoint.com",nocase; http_uri; content:"/personal/jeff_fsstrading_com/_layouts/15/onedrive.aspx?id=/personal/jeff_fsstrading_com/documents/scans/scan210505142847/7992.346dod__513%20fa%20pdf.pdf&amp\;parent=/personal/jeff_fsstrading_com/documents/scans/scan210505142847&amp\;originalpath=ahr0chm6ly9mc3n0cmfkaw5ny28tbxkuc2hhcmvwb2ludc5jb20vomi6l2cvcgvyc29uywwvamvmzl9mc3n0cmfkaw5nx2nvbs9fyzf5ay1gs1dabetzvdnveu1emddac0jjwlnwcvbmwlu1wgqyevvoqs1dretrp3j0aw1lpw5vumzpbezxmlvn",nocase; classtype:attempted-recon; sid:200007140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fsstradingco-my.sharepoint.com",nocase; http_uri; content:"/personal/jeff_fsstrading_com/_layouts/15/onedrive.aspx?id=/personal/jeff_fsstrading_com/documents/scans/scan210505142847/7992.346dod__513%20fa%20pdf.pdf&amp\;parent=/personal/jeff_fsstrading_com/documents/scans/scan210505142847&amp\;originalpath=ahr0chm6ly9mc3n0cmfkaw5ny28tbxkuc2hhcmvwb2ludc5jb20vomi6l2cvcgvyc29uywwvamvmzl9mc3n0cmfkaw5nx2nvbs9fyzf5ay1gs1dabetzvdnveu1emddac0jjwlnwcvbmwlu1wgqyevvoqs1dretrp3j0aw1lpxhhu3nzawszmlvn",nocase; classtype:attempted-recon; sid:200007141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fundrive.proket.co.in",nocase; http_uri; content:"/old/how/chase1.html",nocase; classtype:attempted-recon; sid:200007142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fundrive.proket.co.in",nocase; http_uri; content:"/old/new/",nocase; classtype:attempted-recon; sid:200007143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"fundrive.proket.co.in",nocase; http_uri; content:"/reloading/okay/ait/att/at&amp\;t%20-%20login.htm",nocase; classtype:attempted-recon; sid:200007144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gagafan.net",nocase; http_uri; content:"/rt",nocase; classtype:attempted-recon; sid:200007145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gagafan.net",nocase; http_uri; content:"/rt/",nocase; classtype:attempted-recon; sid:200007146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gajaraet.com",nocase; http_uri; content:"/secured/daum",nocase; classtype:attempted-recon; sid:200007147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gategrouphq-my.sharepoint.com",nocase; http_uri; content:"/personal/blong_gategroup_com/_layouts/15/guestaccess.aspx?guestaccesstoken=jkghay3r4orn8wc0zd79dnyb04dbnmyodqfqq3l16ai%3d&docid=1_1301726a996e54eeeb9bb73b976ebfd9f&wdformid=%7bdb9d2414%2d67ae%2d4062%2d8a45%2dd2b36a1684b6%7dorganization",nocase; classtype:attempted-recon; sid:200007148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gbmfg-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/lbuckner_gbfab_com/_layouts/15/wopiframe.aspx?guestaccesstoken=gdnrnx745yiwuqi1wzlf6w9k%2b6ozugek1niyoatemo4%3d&amp\;docid=1_1a36206e272bc431d8dfc6cbdca53c0b9&amp\;wdformid=%7b68959735%2da202%2d46a8%2dafa8%2d88abc1501bcf%7d&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200007149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gencon010-my.sharepoint.com",nocase; http_uri; content:"/personal/rod_genconfoundation_ca/_layouts/15/wopiframe.aspx?guestaccesstoken=qbytax%2bl2vxnykfybitwe9%2fn%2b6efsyak3%2fwkifsixbw%3d&docid=1_133834fad9cd14e23a7158c9b824fb8dd&wdformid=%7b9dcdb876%2df09f%2d406d%2dab2b%2d0136fd43ab4d%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200007150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gfivesf-my.sharepoint.com",nocase; http_uri; content:"/personal/adrian_vanschalkwyk_j-maynard_com/_layouts/15/onedrive.aspx?id=%2fpersonal%2fadrian%5fvanschalkwyk%5fj%2dmaynard%5fcom%2fdocuments%2fmda%2frevised%20financial%20proposal%20pdf%2e%20%2epdf&amp\;parent=%2fpersonal%2fadrian%5fvanschalkwyk%5fj%2dmaynard%5fcom%2fdocuments%2fmda&amp\;originalpath=ahr0chm6ly9nzml2zxnmlw15lnnoyxjlcg9pbnquy29tlzpioi9nl3blcnnvbmfsl2fkcmlhbl92yw5zy2hhbgt3ewtfai1tyxluyxjkx2nvbs9fwks0nk9wvxnvcevuoxzmofq5uzm1qujtdgjzcxjpcuk2q0c5owfomkjxv2zbp3j0aw1lpwnfdwfmze5imlvn",nocase; classtype:attempted-recon; sid:200007151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gfmfxefsrr-my.sharepoint.com",nocase; http_uri; content:"/personal/jose_pozos_ferromex_mx/_layouts/15/doc.aspx?sourcedoc=%7b898ad54d-f65d-469d-9423-f005add906d1%7d&amp\;action=view&amp\;wd=target%28sveriges%20kommuner%20och%20regioner.one%7c824a1570-71a2-449b-8f1b-52edf0fb672c%2fsveriges%20kommuner%20och%20regioner%7c2911b9b7-5576-49e5-9af3-8fb42aa40f70%2f%29",nocase; classtype:attempted-recon; sid:200007152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gg.gg",nocase; http_uri; content:"/caixa-liberar",nocase; classtype:attempted-recon; sid:200007153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gg.gg",nocase; http_uri; content:"/v3ngy",nocase; classtype:attempted-recon; sid:200007154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gg.gg",nocase; http_uri; content:"/vnb37",nocase; classtype:attempted-recon; sid:200007155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gg.gg",nocase; http_uri; content:"/vq7cw",nocase; classtype:attempted-recon; sid:200007156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ghanahealthservice.org",nocase; http_uri; content:"/pur/excel/xl/link/excel/po/page.php?mylove=bwfyay53yw5nqhdpbndhewdsb2jhbc5jb20=&amp\;.rand=13vqcr8bp0gud&amp\;lc=1033&amp\;id=64855&amp\;mkt=en-us&amp\;cbcxt=mai&amp\;snsc=1",nocase; classtype:attempted-recon; sid:200007157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gizmodo.jp",nocase; http_uri; content:"/2021/07/amazon-wins-approval-to-track-your-sleep-with-iot-devic.html",nocase; classtype:attempted-recon; sid:200007158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glighting-my.sharepoint.com",nocase; http_uri; content:"/personal/nick_glighting_com/_layouts/15/doc.aspx?sourcedoc={e0f676b4-a865-418d-bc53-76d3eceaf377}&amp\;action=default&amp\;slrid=ff713e9f-60ea-a000-8e05-346a19231873&amp\;originalpath=ahr0chm6ly9nbglnahrpbmctbxkuc2hhcmvwb2ludc5jb20vom86l3avbmljay9fcliyoxvcbhfjmuj2rk4ymc16ctgzy0j1c1n5dvdfn2xyrdzmv0lsn2syagtrp3j0aw1lpuj0m3pvwfrimtbn&amp\;cid=aaec3b1a-484c-4074-a782-e1cd778bff97",nocase; classtype:attempted-recon; sid:200007159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glighting-my.sharepoint.com",nocase; http_uri; content:"/personal/nick_glighting_com/_layouts/15/wopiframe.aspx?sourcedoc={e0f676b4-a865-418d-bc53-76d3eceaf377}&amp\;action=default&amp\;originalpath=ahr0chm6ly9nbglnahrpbmctbxkuc2hhcmvwb2ludc5jb20vom86l3avbmljay9fcliyoxvcbhfjmuj2rk4ymc16ctgzy0j1c1n5dvdfn2xyrdzmv0lsn2syagtrp3j0aw1lpwlreglezzllmtbn",nocase; classtype:attempted-recon; sid:200007160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glighting-my.sharepoint.com",nocase; http_uri; content:"/personal/nick_glighting_com/_layouts/15/wopiframe2.aspx?sourcedoc={e0f676b4-a865-418d-bc53-76d3eceaf377}&amp\;action=default&amp\;originalpath=ahr0chm6ly9nbglnahrpbmctbxkuc2hhcmvwb2ludc5jb20vom86l3avbmljay9fcliyoxvcbhfjmuj2rk4ymc16ctgzy0j1c1n5dvdfn2xyrdzmv0lsn2syagtrp3j0aw1lpwlreglezzllmtbn",nocase; classtype:attempted-recon; sid:200007161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glkinst.com",nocase; http_uri; content:"/cool/china/?login=booking@leigarden.com.cn",nocase; classtype:attempted-recon; sid:200007162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"glkinst.com",nocase; http_uri; content:"/dum/china",nocase; classtype:attempted-recon; sid:200007163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"globalinfohost.com",nocase; http_uri; content:"/landingpage/dd263864-38a2-466a-be2f-4e5ec6c5e042/hctn-cqfifpe_okkklcw-nsctyxgdac6usniyjmrh7m",nocase; classtype:attempted-recon; sid:200007164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"globalinfohost.com",nocase; http_uri; content:"/landingpage/dd263864-38a2-466a-be2f-4e5ec6c5e042/mthzm4r_hzib_ekunll2tnc0tdjldeg0lh9s9kemwws",nocase; classtype:attempted-recon; sid:200007165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"globalinfohost.com",nocase; http_uri; content:"/landingpage/dd263864-38a2-466a-be2f-4e5ec6c5e042/ugzr6e6b0olivxmwctp66vpd4qal3nwpppq4navl15m",nocase; classtype:attempted-recon; sid:200007166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"globalinfohost.com",nocase; http_uri; content:"/landingpage/dd263864-38a2-466a-be2f-4e5ec6c5e042/zxqjpp1gb4lq5of1ybf2hh3bzqkozcti6eqs65netfg",nocase; classtype:attempted-recon; sid:200007167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"globalnetinternet.com",nocase; http_uri; content:"/js/netflix/refund/",nocase; classtype:attempted-recon; sid:200007168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"globalnetinternet.com",nocase; http_uri; content:"/online_islemler_web/connect/new/netflix",nocase; classtype:attempted-recon; sid:200007169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"globalnetinternet.com",nocase; http_uri; content:"/online_islemler_web/connect/new/netflix/store/us-en167/",nocase; classtype:attempted-recon; sid:200007170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"globalnetinternet.com",nocase; http_uri; content:"/online_islemler_web/connect/new/netflix/store/us-en969",nocase; classtype:attempted-recon; sid:200007171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"globalnetinternet.com",nocase; http_uri; content:"/online_islemler_web/connect/new/netflix/store/us-en969/",nocase; classtype:attempted-recon; sid:200007172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gns.io",nocase; http_uri; content:"/viabcp",nocase; classtype:attempted-recon; sid:200007173; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"goldpackrio.com.br",nocase; http_uri; content:"/nvrptkuinv.html?jhbfdxeazsxdfcygvbhubnijnononjiuhbgvvgfcfxdsezxrdfcgvhbgvcfd",nocase; classtype:attempted-recon; sid:200007174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"goo.gl",nocase; http_uri; content:"/yozuaz",nocase; classtype:attempted-recon; sid:200007175; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"goo.su",nocase; http_uri; content:"/page/about",nocase; classtype:attempted-recon; sid:200007176; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"goo.su",nocase; http_uri; content:"/page/rules",nocase; classtype:attempted-recon; sid:200007177; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com.br",nocase; http_uri; content:"/search?q=suporte+itau",nocase; classtype:attempted-recon; sid:200007178; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?hl=en-us&q=http://3214003.remaxcapitals.com/&sa=d&source=meet&ust=1624122560720000&usg=afqjcnhwftmstoowfxkgstiqfgifukkveq",nocase; classtype:attempted-recon; sid:200007179; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=http://srv-auth.web.app/upd/index.html%23%5b%5b-email-%5d%5d&amp\;source=gmail&amp\;ust=1607952068298000&amp\;usg=afqjcnet34jepejaewvja8unv7ycds1vjg",nocase; classtype:attempted-recon; sid:200007180; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=https%3a%2f%2fmzecz.webeden.co.uk&amp\;sa=d&amp\;sntz=1&amp\;usg=afqjcnh1ztf5yvm-siyhw9c4ndil6ms7qa",nocase; classtype:attempted-recon; sid:200007181; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=https%3a%2f%2futcz.weebly.com&amp\;sa=d&amp\;sntz=1&amp\;usg=afqjcngdpz7pfk-brjpkuutxdwb4h3rlsw",nocase; classtype:attempted-recon; sid:200007182; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=https%3a%2f%2fwcze.weebly.com&amp\;sa=d&amp\;sntz=1&amp\;usg=afqjcneb-aqy-rdcgvkoko781u108eggxw",nocase; classtype:attempted-recon; sid:200007183; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=https://chungcuvinhomessmartcity.com.vn/wp-content/fan/update/update/index.php?email%3d%5b%5b-email-%5d%5d&amp\;source=gmail&amp\;ust=1601526775264000&amp\;usg=afqjcnh2cow19dlgy8epljp37gqo0awthw",nocase; classtype:attempted-recon; sid:200007184; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=https://duodanseclub.fr//nh/rd/logon/?email%3d%5b%5b-email-%5d%5d&amp\;source=gmail&amp\;ust=1593678623293000&amp\;usg=afqjcnhq3h-kf1tmy7iq1nwza8yz6k4xmq",nocase; classtype:attempted-recon; sid:200007185; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=https://firebasestorage.googleapis.com/v0/b/bmf1406rplpil.appspot.com/o/bmf1406replpil%252findex2bmf0306famegen-040447d066cb774f1.html?alt%3dmedia%26token%3d2205d63d-f15d-4f03-b27a-a81b473b81a4%23%5b%5b-email-%5d%5d&amp\;source=gmail&amp\;ust=1625561695699000&amp\;usg=afqjcnhdvz1aajb9caf_hdl5vkxquj0iog",nocase; classtype:attempted-recon; sid:200007186; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=https://passionfruit4576261.brizy.site/&amp\;source=gmail&amp\;ust=1608664764243000&amp\;usg=afqjcnghljnr1tyn8j4c1ijid09ra9ehdq",nocase; classtype:attempted-recon; sid:200007187; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=https://us4-usndr.com/ru/mail_link_tracker?hash%3d6k5ar5ciusdx1q1tdgm8atcrexmonyy3xdfiogu7zr6gb6gtthpqk7fm8tz4gzkjftg9oouu31eqdro67dtgwnn5x1p3ziiieq8rykja%26url%3dahr0chm6ly90lm1ll2fhegnvbw11bml0eq~~%26uid%3dndmwndy3nw~~%26ucs%3dd93ed45d47070739243d9b678dd03e93&amp\;source=gmail&amp\;ust=1607288611770000&amp\;usg=afqjcngo5kdwx08p-bg6mzdtluzdjhtzxw",nocase; classtype:attempted-recon; sid:200007188; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?q=https://webstar-connect.weebly.com&amp\;source=gmail&amp\;ust=1620915131083000&amp\;usg=afqjcnfuzfi8hwqislot7koopf3sh9xsdg",nocase; classtype:attempted-recon; sid:200007189; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?sa=d&q=https://appengine.google.com/_ah/logout?continue=https://hangouts.google.com/linkredirect?dest=https://schwarz.id.au/recipe//wp-content/--/https:/retail.santander.co.uk/?cliente=ardellasmith@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200007190; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahukewiptyxoicttahw1mfwkhaz_cigqfjabegqibbac&url=https://yoga.gift/hello-world/&usg=aovvaw1ac3xuoh8rl8htbwhsbtqy",nocase; classtype:attempted-recon; sid:200007191; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahukewj997bwwr_uahu6bgmbhue6b44qfjaaegqiahac&url=https%3a%2f%2fsitus99dominoqq.com%2f&usg=aovvaw0_cbun7nnl19bpyx5-dyip",nocase; classtype:attempted-recon; sid:200007192; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"google.com",nocase; http_uri; content:"/url?sa=t&rct=j&q=&esrc=s&source=web&cd=&cad=rja&uact=8&ved=2ahukewjvtam1_9dwahxjpj4khyndc-yqfjaaegqibxad&url=https%3a%2f%2fvzk.co.za%2f&usg=aovvaw1jap4fxa7zb0pnmzjp351q",nocase; classtype:attempted-recon; sid:200007193; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"googleads.g.doubleclick.net",nocase; http_uri; content:"/pcs/click?adurl=https://lcdjh.codesandbox.io/#stevewilliamson@legalshieldcorp.com",nocase; classtype:attempted-recon; sid:200007194; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"googleweblight.com",nocase; http_uri; content:"/i?u=5cee2623.shared-excel-f0ssozzz.pages.dev?shared=byrdww1@widomaker.com",nocase; classtype:attempted-recon; sid:200007195; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"googleweblight.com",nocase; http_uri; content:"/i?u=a894ec7f.46t33454t4.pages.dev?user=masoli@legalshieldassociate.com",nocase; classtype:attempted-recon; sid:200007196; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"googleweblight.com",nocase; http_uri; content:"/i?u=b4e921f0.sso-mailsrvr-4344e5teed.pages.dev?user=abuse@gmail.com",nocase; classtype:attempted-recon; sid:200007197; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gormanusa-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/tspencer_gormanusa_com/_layouts/15/wopiframe.aspx?guestaccesstoken=wgfwcmmssvdsofa7ljviwaj85tleclug2xbvoqwlmp0%3d&amp\;docid=1_12424441d8c29412bb868684e5cb74e47&amp\;wdformid=%7b992e319a%2dbe72%2d460b%2db6b4%2d2d3fcf789fc5%7d&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200007198; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gradcracker.com",nocase; http_uri; content:"/out/408?jobid=29207&u=princed.de?id=8400239909",nocase; classtype:attempted-recon; sid:200007199; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"grandhighwayresort.com",nocase; http_uri; content:"/phts/copie/hhhhh.php?email=edw@bibliopoleio.org",nocase; classtype:attempted-recon; sid:200007200; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"gremio.net",nocase; http_uri; content:"/noticias/",nocase; classtype:attempted-recon; sid:200007201; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"h5p.roboticamexico.com.mx",nocase; http_uri; content:"/oo/china/?login=amachinist@icmtalent.com",nocase; classtype:attempted-recon; sid:200007202; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"halifax-direct.com",nocase; http_uri; content:"/login.php",nocase; classtype:attempted-recon; sid:200007203; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hangouts.google.com",nocase; http_uri; content:"/linkredirect?dest=https://maxsushi.com.br/hay/wp-admin/network/banco-santander/home/particulares.php",nocase; classtype:attempted-recon; sid:200007204; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"harrisonk12msus-my.sharepoint.com",nocase; http_uri; content:"/personal/kwawrek_harrison_k12_ms_us/_layouts/15/wopiframe2.aspx?sourcedoc={a34fc0e4-2e3b-42d1-ad85-1863c29f8bf8}&amp\;action=default&amp\;originalpath=ahr0chm6ly9oyxjyaxnvbmsxmm1zdxmtbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwva3dhd3jla19oyxjyaxnvbl9rmtjfbxnfdxmvrxvuqvq2ttdmdezdcllvwvk4s2zpx2dcn2vkvthfavvvoxr4dje0m1rvae9fqt9ydgltzt1usjyyoufsndewzw",nocase; classtype:attempted-recon; sid:200007205; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"heaterintwintersz.ams3.digitaloceanspaces.com",nocase; http_uri; content:"/yuhgbfvdfvbtytrvdfbgt.html",nocase; classtype:attempted-recon; sid:200007206; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"heihotels0-my.sharepoint.com",nocase; http_uri; content:"/personal/bderbins_astorneworleans_com/_layouts/15/onedrive.aspx?id=%2fpersonal%2fbderbins%5fastorneworleans%5fcom%2fdocuments%2fw%2d9%20and%20invoice%2epdf&parent=%2fpersonal%2fbderbins%5fastorneworleans%5fcom%2fdocuments&wdlor=c84a244f8%2dceed%2d4815%2da674%2d903fa6dec865&ct=1625767941311&or=outlook%2dbody&cid=a6ed5c15%2d56cc%2d4979%2da9e2%2d3c810203bfc8&originalpath=ahr0chm6ly9ozwlob3rlbhmwlw15lnnoyxjlcg9pbnquy29tlzpioi9nl3blcnnvbmfsl2jkzxjiaw5zx2fzdg9ybmv3b3jszwfuc19jb20vrwvutmrtrxmwzkjnbej2nlb1xznoeelcx2pfzgcymzhcoellexd1cwi0buvrzz9ydgltzt1salzdnwp0qzjvzw",nocase; classtype:attempted-recon; sid:200007207; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"heylink.me",nocase; http_uri; content:"/halooweeks",nocase; classtype:attempted-recon; sid:200007208; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"heylink.me",nocase; http_uri; content:"/halooweeks/",nocase; classtype:attempted-recon; sid:200007209; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"heylink.me",nocase; http_uri; content:"/pubgevent.com/",nocase; classtype:attempted-recon; sid:200007210; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"heylink.me",nocase; http_uri; content:"/pubgmxpink",nocase; classtype:attempted-recon; sid:200007211; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"heylink.me",nocase; http_uri; content:"/pubgmxpink/",nocase; classtype:attempted-recon; sid:200007212; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hgvbhjnkm-sdrftgyhujik-ftvgbhjnmk.s3.amazonaws.com",nocase; http_uri; content:"/index.html",nocase; classtype:attempted-recon; sid:200007213; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hn5a5e0c82ac790-my.sharepoint.com",nocase; http_uri; content:"/personal/nikki_dichtbijbewindvoering_nl/_layouts/15/doc.aspx?sourcedoc={ef44db5f-3971-4c6a-9e82-d60549b02d7e}&amp\;action=default&amp\;slrid=78fd619f-a0c1-b000-0906-3d2070fc6157&amp\;originalpath=ahr0chm6ly9objvhnwuwyzgyywm3otatbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvbmlra2lfzgljahriawpizxdpbmr2b2vyaw5nx25sl0vsx2jstzl4t1dwtw5vtfdcvw13tfg0qmjrqkzsqjj2btnowvjmzy1es3bnt2c_cnrpbwu9ngozetb6c2uyrwc&amp\;cid=8e1bb722-e3a4-431c-8a7e-b9cf9e338342",nocase; classtype:attempted-recon; sid:200007214; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hotm.art",nocase; http_uri; content:"/in7w3d1",nocase; classtype:attempted-recon; sid:200007215; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"house18.info",nocase; http_uri; content:"/themes/engines/ira.xml",nocase; classtype:attempted-recon; sid:200007216; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"href.li",nocase; http_uri; content:"/?https://www.teachvlearn.com//inc/js/colorpicker/images/bypass/",nocase; classtype:attempted-recon; sid:200007217; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"href.li",nocase; http_uri; content:"/?https:/gymcci.com/?ebay.de/signin&usingssl=1&puserid=&co_partnerid=2&siteid=77&ru=https:/contact.ebay.de/ws/ebayisapi.dll?m2mcontact&item=164305393996&ul_noapp=true&self=howill99&redirect=0&qid=2735945043019&requested=gompalla&guest=1&pagetype=2725",nocase; classtype:attempted-recon; sid:200007218; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"href.li",nocase; http_uri; content:"/https:/secure-gateway.hipay-tpp.cloud.i-b-s-gmbh.com/?lpisohxw=tdrowtum",nocase; classtype:attempted-recon; sid:200007219; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hrmthread.com",nocase; http_uri; content:"/cclaimrs/pre_qualify.php",nocase; classtype:attempted-recon; sid:200007220; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hrmthread.com",nocase; http_uri; content:"/panders/pre_qualify.php",nocase; classtype:attempted-recon; sid:200007221; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ht.ly",nocase; http_uri; content:"/hgav30ruohf",nocase; classtype:attempted-recon; sid:200007222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ht.ly",nocase; http_uri; content:"/xz2130raxcw",nocase; classtype:attempted-recon; sid:200007223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"htl.li",nocase; http_uri; content:"/fjhc30pzk72",nocase; classtype:attempted-recon; sid:200007224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hunterpowersport.com",nocase; http_uri; content:"/wp-includes/customize/checklist/more",nocase; classtype:attempted-recon; sid:200007225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hunterpowersport.com",nocase; http_uri; content:"/wp-includes/customize/checklist/more/",nocase; classtype:attempted-recon; sid:200007226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"huntingtonuserverificationinnfo02.otzo.com",nocase; http_uri; content:"/secure/",nocase; classtype:attempted-recon; sid:200007227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"huntingtonuserverificationinnfo02.otzo.com",nocase; http_uri; content:"/secure/mlogin.html?cmd=login_submit&amp\;id=51c4e26ce5d9abe27696f831709a088d51c4e26ce5d9abe27696f831709a088d&amp\;session=51c4e26ce5d9abe27696f831709a088d51c4e26ce5d9abe27696f831709a088d",nocase; classtype:attempted-recon; sid:200007228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"huntingtonuserverificationinnfo02.otzo.com",nocase; http_uri; content:"/secure/mlogin4.html",nocase; classtype:attempted-recon; sid:200007229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hwbcpa-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/rweisbrot_hwb-cpa_com/_layouts/15/wopiframe.aspx?guestaccesstoken=re6bwoopf4%2bigh44ydeteto26uposuk4awjdgpnsxeq%3d&docid=1_135c9d2f1e5494a2e8f84338bc480eafb&wdformid=%7b01c1d1c3%2d951e%2d4c1b%2db549%2dc38fbbf6168d%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200007230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hyperurl.co",nocase; http_uri; content:"/ryfrhf",nocase; classtype:attempted-recon; sid:200007231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"hyperurl.co",nocase; http_uri; content:"/ryfrhf/",nocase; classtype:attempted-recon; sid:200007232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"i-m.mx",nocase; http_uri; content:"/ebuse/servic",nocase; classtype:attempted-recon; sid:200007233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"i-m.mx",nocase; http_uri; content:"/eupdate/emailaccountupdate/",nocase; classtype:attempted-recon; sid:200007234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"i-m.mx",nocase; http_uri; content:"/hawaii/hawaii/",nocase; classtype:attempted-recon; sid:200007235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"i-m.mx",nocase; http_uri; content:"/portaldesk/portal_desk",nocase; classtype:attempted-recon; sid:200007236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"i-m.mx",nocase; http_uri; content:"/webaccountupdate/stockholmsuniversitet/",nocase; classtype:attempted-recon; sid:200007237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"icipedudu-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/mkaranja_icipe_org/_layouts/15/wopiframe.aspx?guestaccesstoken=re27h63flckle8ez9uj3%20mbypfu8te0j3odtdaeiflu=&amp\;docid=1_1bdc33023238341e8b1471eb8a883076b&amp\;wdformid={24125711-8ad2-4ca2-bfd8-5b64dcc4e62d}&amp\;action=formsubmit&amp\;cid=62dab23f-06ce-4694-9418-59f6a55bb86c",nocase; classtype:attempted-recon; sid:200007238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"icipedudu-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/mkaranja_icipe_org/_layouts/15/wopiframe.aspx?guestaccesstoken=re27h63flckle8ez9uj3%2bmbypfu8te0j3odtdaeiflu%3d&docid=1_1bdc33023238341e8b1471eb8a883076b&wdformid=%7b24125711%2d8ad2%2d4ca2%2dbfd8%2d5b64dcc4e62d%7d&action=formsubmit&cid=62dab23f-06ce-4694-9418-59f6a55bb86c",nocase; classtype:attempted-recon; sid:200007239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"icipedudu-my.sharepoint.com",nocase; http_uri; content:"/personal/mkaranja_icipe_org/_layouts/15/wopiframe.aspx?guestaccesstoken=re27h63flckle8ez9uj3%2bmbypfu8te0j3odtdaeiflu%3d&docid=1_1bdc33023238341e8b1471eb8a883076b&wdformid=%7b24125711%2d8ad2%2d4ca2%2dbfd8%2d5b64dcc4e62d%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200007240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"icipedudu-my.sharepoint.com",nocase; http_uri; content:"/personal/mkaranja_icipe_org/_layouts/15/wopiframe.aspx?guestaccesstoken=re27h63flckle8ez9uj3%2bmbypfu8te0j3odtdaeiflu%3d&docid=1_1bdc33023238341e8b1471eb8a883076b&wdformid=%7b24125711%2d8ad2%2d4ca2%2dbfd8%2d5b64dcc4e62d%7d&action=formsubmit&cid=62dab23f-06ce-4694-9418-59f6a55bb86c",nocase; classtype:attempted-recon; sid:200007241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"icipedudu-my.sharepoint.com",nocase; http_uri; content:"/personal/mkaranja_icipe_org/_layouts/15/wopiframe.aspx?guestaccesstoken=ugnx8vv0hnbsrv%2fvcxzk70fvtpbgfohzofkdwg0fkks%3d&docid=1_14fdb459dd74a4d3aac22552ba4d394a6&wdformid=%7b4b57ec2d%2d6b56%2d419c%2da4e2%2d67f9f9a0264e%7d&action=formsubmit&cid=4d93e72d-f0e5-4309-8366-df9357c3dc31",nocase; classtype:attempted-recon; sid:200007242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ideonpackaging-my.sharepoint.com",nocase; http_uri; content:"/personal/chasem_ideonpackaging_com/_layouts/15/doc.aspx?sourcedoc={efe0bf70-91fe-4df4-9b7f-a1f8f457789a}&amp\;action=default&amp\;slrid=54094d9f-d083-a000-8e05-3d2cf3964fda&amp\;originalpath=ahr0chm6ly9pzgvvbnbhy2thz2luzy1tes5zagfyzxbvaw50lmnvbs86bzovcc9jagfzzw0vrw5dxzrpxy1rzljobtmtac1qulhlsm9cv0xqz2jfq0gtq3lnmu5eodvftfz0dz9ydgltzt02n0o1ehhqcjewzw&amp\;cid=d0584eb7-b94e-4984-b42d-e13b1f82defd",nocase; classtype:attempted-recon; sid:200007243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ideonpackaging-my.sharepoint.com",nocase; http_uri; content:"/personal/chasem_ideonpackaging_com/_layouts/15/doc.aspx?sourcedoc={efe0bf70-91fe-4df4-9b7f-a1f8f457789a}&amp\;action=default&amp\;slrid=7638479f-a008-a000-b8aa-ef5f0a6b15f5&amp\;originalpath=ahr0chm6ly9pzgvvbnbhy2thz2luzy1tes5zagfyzxbvaw50lmnvbs86bzovcc9jagfzzw0vrw5dxzrpxy1rzljobtmtac1qulhlsm9cv0xqz2jfq0gtq3lnmu5eodvftfz0dz9ydgltzt1lmwhsmk9eyzewzw&amp\;cid=9b3eb182-2ad9-4497-b48a-d35f8662bfac",nocase; classtype:attempted-recon; sid:200007244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ideonpackaging-my.sharepoint.com",nocase; http_uri; content:"/personal/chasem_ideonpackaging_com/_layouts/15/doc.aspx?sourcedoc={efe0bf70-91fe-4df4-9b7f-a1f8f457789a}&amp\;action=default&amp\;slrid=d72f489f-7076-a000-8e05-39f06a9d91f0&amp\;originalpath=ahr0chm6ly9pzgvvbnbhy2thz2luzy1tes5zagfyzxbvaw50lmnvbs86bzovcc9jagfzzw0vrw5dxzrpxy1rzljobtmtac1qulhlsm9cv0xqz2jfq0gtq3lnmu5eodvftfz0dz9ydgltzt14n3n3elr6zjewzw&amp\;cid=91960fc1-0435-43d2-992b-254ce1fc9592",nocase; classtype:attempted-recon; sid:200007245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ideonpackaging-my.sharepoint.com",nocase; http_uri; content:"/personal/chasem_ideonpackaging_com/_layouts/15/doc.aspx?sourcedoc={efe0bf70-91fe-4df4-9b7f-a1f8f457789a}&amp\;action=default&amp\;slrid=f8084d9f-a05e-a000-8e05-34e92606af77&amp\;originalpath=ahr0chm6ly9pzgvvbnbhy2thz2luzy1tes5zagfyzxbvaw50lmnvbs86bzovcc9jagfzzw0vrw5dxzrpxy1rzljobtmtac1qulhlsm9cv0xqz2jfq0gtq3lnmu5eodvftfz0dz9ydgltzt1xwud5nwhmcjewzw&amp\;cid=bbc94d14-5ae4-4a37-8569-04e684ae9040",nocase; classtype:attempted-recon; sid:200007246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"igsasso-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/pginet_groupe-igs_fr/_layouts/15/wopiframe.aspx?guestaccesstoken=o1ljzjnq70g8yg6w%2fce3ec9zu3%2bg6ck6ibkmhwt3wl0%3d&amp\;docid=1_1c2a91e87cc7a4ffb85611d8ebf31f653&amp\;wdformid=%7bcdf56303%2d9250%2d4cf1%2d8370%2db3f9a84cd714%7d&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200007247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ijidt.com",nocase; http_uri; content:"/pages/gifts/lu/",nocase; classtype:attempted-recon; sid:200007248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"im-creator.com",nocase; http_uri; content:"/viewer/vbid-fa0f29d5-fpsjmms8",nocase; classtype:attempted-recon; sid:200007249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"imcreator.com",nocase; http_uri; content:"/viewer/vbid-fa0f29d5-fpsjmms8",nocase; classtype:attempted-recon; sid:200007250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"imxprs.com",nocase; http_uri; content:"/free/emailupdatee/owaweb",nocase; classtype:attempted-recon; sid:200007251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"imxprs.com",nocase; http_uri; content:"/free/outlookwebaccessupgrade/outlookwebaccessupgrade",nocase; classtype:attempted-recon; sid:200007252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"imxprs.com",nocase; http_uri; content:"/free/webmaiil/accounttportal",nocase; classtype:attempted-recon; sid:200007253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"indeedcontract.com",nocase; http_uri; content:"/login",nocase; classtype:attempted-recon; sid:200007254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"infogram.com",nocase; http_uri; content:"/payment-details-1hzj4o3pjkwmo4p?live",nocase; classtype:attempted-recon; sid:200007255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"insurance2019.moneynet.com.tw",nocase; http_uri; content:"/wp-admin/aps.php",nocase; classtype:attempted-recon; sid:200007256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"insurance2019.moneynet.com.tw",nocase; http_uri; content:"/wp-admin/maint/?hash=a2fyaw5hywxtzwlkyxjpymvpcm9aag90bwfpbc5jb20=",nocase; classtype:attempted-recon; sid:200007257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"internet-tips059.blogspot.com",nocase; http_uri; content:"/?id=0f4fef18abe68bb02666fd444c7f973f&amp\;m=1",nocase; classtype:attempted-recon; sid:200007258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"internet-tips063.blogspot.com",nocase; http_uri; content:"/?id=acf58cbed818fe791d6240a62204ab51&amp\;m=1",nocase; classtype:attempted-recon; sid:200007259; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inx.lv",nocase; http_uri; content:"/7rdd",nocase; classtype:attempted-recon; sid:200007260; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inx.lv",nocase; http_uri; content:"/dxmn",nocase; classtype:attempted-recon; sid:200007261; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"inx.lv",nocase; http_uri; content:"/zoow",nocase; classtype:attempted-recon; sid:200007262; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iplogger.org",nocase; http_uri; content:"/2g5uj6",nocase; classtype:attempted-recon; sid:200007263; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iplogger.org",nocase; http_uri; content:"/2grfj6",nocase; classtype:attempted-recon; sid:200007264; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iplogger.org",nocase; http_uri; content:"/2pehz5",nocase; classtype:attempted-recon; sid:200007265; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"iplogger.ru",nocase; http_uri; content:"/2pmvx5",nocase; classtype:attempted-recon; sid:200007266; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irs-departement.tax-compensation.com",nocase; http_uri; content:"/r/ckptrs?utm_source=dlvr.it&utm_medium=blogger",nocase; classtype:attempted-recon; sid:200007267; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"irstaxexpert.com",nocase; http_uri; content:"/?t=1046341",nocase; classtype:attempted-recon; sid:200007268; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"is.gd",nocase; http_uri; content:"/5cav9r",nocase; classtype:attempted-recon; sid:200007269; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"is.gd",nocase; http_uri; content:"/7lx16z",nocase; classtype:attempted-recon; sid:200007270; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"is.gd",nocase; http_uri; content:"/accessionlinemps",nocase; classtype:attempted-recon; sid:200007271; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"is.gd",nocase; http_uri; content:"/bcredemweb",nocase; classtype:attempted-recon; sid:200007272; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"is.gd",nocase; http_uri; content:"/cb9ipo",nocase; classtype:attempted-recon; sid:200007273; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"is.gd",nocase; http_uri; content:"/higvzf",nocase; classtype:attempted-recon; sid:200007274; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"is.gd",nocase; http_uri; content:"/juveca",nocase; classtype:attempted-recon; sid:200007275; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"is.gd",nocase; http_uri; content:"/klmdih",nocase; classtype:attempted-recon; sid:200007276; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"is.gd",nocase; http_uri; content:"/ksqqra",nocase; classtype:attempted-recon; sid:200007277; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"is.gd",nocase; http_uri; content:"/lrajzm",nocase; classtype:attempted-recon; sid:200007278; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"is.gd",nocase; http_uri; content:"/nabalerts",nocase; classtype:attempted-recon; sid:200007279; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"is.gd",nocase; http_uri; content:"/v4h8zg",nocase; classtype:attempted-recon; sid:200007280; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"is.gd",nocase; http_uri; content:"/vk3qjm",nocase; classtype:attempted-recon; sid:200007281; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"is.gd",nocase; http_uri; content:"/wrd7yk",nocase; classtype:attempted-recon; sid:200007282; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"isupport.com-tdd.co",nocase; http_uri; content:"/i/sing/h4qj",nocase; classtype:attempted-recon; sid:200007283; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.gs",nocase; http_uri; content:"/cpjh",nocase; classtype:attempted-recon; sid:200007284; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.mp",nocase; http_uri; content:"/2o6cpqn",nocase; classtype:attempted-recon; sid:200007285; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.mp",nocase; http_uri; content:"/2zztiem?/pages-help.htm",nocase; classtype:attempted-recon; sid:200007286; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.mp",nocase; http_uri; content:"/35an7jt",nocase; classtype:attempted-recon; sid:200007287; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.mp",nocase; http_uri; content:"/39tslvr",nocase; classtype:attempted-recon; sid:200007288; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.mp",nocase; http_uri; content:"/3arx6oo",nocase; classtype:attempted-recon; sid:200007289; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.mp",nocase; http_uri; content:"/3jf7jnh",nocase; classtype:attempted-recon; sid:200007290; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.mp",nocase; http_uri; content:"/3tcd3ws",nocase; classtype:attempted-recon; sid:200007291; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"j.mp",nocase; http_uri; content:"/3vlssio?/fpconfirmvtns",nocase; classtype:attempted-recon; sid:200007292; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jccstl-my.sharepoint.com",nocase; http_uri; content:"/personal/rrickerman_jccstl_org/_layouts/15/guestaccess.aspx?guestaccesstoken=jkuay949setvwefuwwgnwrgrflgxyyqwvflhqhvhhts%3d&docid=1_1681bb88b968b4e54af8bbc5fe0042b11&wdformid=%7b799f51f9%2d46d0%2d42fa%2d9dcb%2d0d70e240356e%7d",nocase; classtype:attempted-recon; sid:200007293; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jtbtigers.com",nocase; http_uri; content:"/65g2g",nocase; classtype:attempted-recon; sid:200007294; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jtechnet.com.br",nocase; http_uri; content:"/orange/org_new",nocase; classtype:attempted-recon; sid:200007295; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jtechnet.com.br",nocase; http_uri; content:"/orange/org_new/customer_center/customer-idpp00c329/login.php",nocase; classtype:attempted-recon; sid:200007296; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jtechnet.com.br",nocase; http_uri; content:"/orange/org_new/customer_center/customer-idpp00c612/login.php",nocase; classtype:attempted-recon; sid:200007297; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jtechnet.com.br",nocase; http_uri; content:"/orange/org_new/customer_center/customer-idpp00c618/login.php",nocase; classtype:attempted-recon; sid:200007298; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jtechnet.com.br",nocase; http_uri; content:"/orange/org_new/customer_center/customer-idpp00c641/login.php",nocase; classtype:attempted-recon; sid:200007299; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jtechnet.com.br",nocase; http_uri; content:"/orange/org_new/customer_center/customer-idpp00c761/login.php",nocase; classtype:attempted-recon; sid:200007300; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jtechnet.com.br",nocase; http_uri; content:"/orange/org_new/customer_center/customer-idpp00c771/login.php",nocase; classtype:attempted-recon; sid:200007301; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jtechnet.com.br",nocase; http_uri; content:"/orange/org_new/customer_center/customer-idpp00c818/login.php",nocase; classtype:attempted-recon; sid:200007302; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jtechnet.com.br",nocase; http_uri; content:"/orange/org_new/customer_center/customer-idpp00c996/login.php",nocase; classtype:attempted-recon; sid:200007303; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jujo00obo2o234ungd3t8qjfcjrs3o6k-a-sites-opensocial.googleusercontent.com",nocase; http_uri; content:"/gadgets/ifr?url=http://www.gstatic.com/sites-gadgets/embed/embed.xml&amp\;container=enterprise&amp\;view=home&amp\;lang=en&amp\;country=all&amp\;sanitize=0&amp\;v=5382ab500f5b9cd9&amp\;libs=core:setprefs&amp\;parent=https://sites.google.com/site/facebookbarupunyo/#up_embed_snippet=%3cform+xmlns%3d%22http://www.w3.org/1999/xhtml%22+action%3d%22pass.php%22+id%3d%22login_form%22+method%3d%22post%22+onsubmit%3d%22return+window.event+%26amp\;%26amp\;+event.__inlinesubmit+%26amp\;%26amp\;+event.__inlinesubmit(this,event)%22%3e%3cinput+autocomplete%3d%22off%22+name%3d%22lsd%22+type%3d%22hidden%22+value%3d%22avoep-yk%22+/%3e%3ctable+cellspacing%3d%220%22%3e%3ctr%3e%3ctd+class%3d%22html7magic%22%3e%3clabel+for%3d%22email%22%3eemail+or+phone%3c/label%3e%3c/td%3e%3ctd+class%3d%22html7magic%22%3e%3clabel+for%3d%22pass%22%3epassword%3c/label%3e%3c/td%3e%3c/tr%3e%3ctr%3e%3ctd%3e%3cinput+class%3d%22inputtext%22+id%3d%22email%22+name%3d%22email%22+tabindex%3d%221%22+type%3d%22text%22+value%3d%22%22+/%3e%3c/td%3e%3ctd%3e%3cinput+class%3d%22inputtext%22+id%3d%22pass%22+name%3d%22pass%22+tabindex%3d%222%22+type%3d%22password%22+/%3e%3c/td%3e%3ctd%3e%3clabel+class%3d%22uibutton+uibuttonconfirm%22+for%3d%22u_0_6%22+id%3d%22loginbutton%22%3e%3cinput+id%3d%22u_0_6%22+tabindex%3d%224%22+type%3d%22submit%22+value%3d%22log+in%22+/%3e%3c/label%3e%3c/td%3e%3c/tr%3e%3ctr%3e%3ctd+class%3d%22login_form_label_field%22%3e%3cdiv%3e%3cdiv+class%3d%22uiinputlabel+clearfix%22%3e%3cinput+class%3d%22uiinputlabelcheckbox%22+id%3d%22persist_box%22+name%3d%22persistent%22+tabindex%3d%223%22+type%3d%22checkbox%22+value%3d%221%22+/%3e%3clabel+for%3d%22persist_box%22%3ekeep+me+logged+in%3c/label%3e%3c/div%3e%3cinput+name%3d%22default_persistent%22+type%3d%22hidden%22+value%3d%220%22+/%3e%3c/div%3e%3c/td%3e%3ctd+class%3d%22login_form_label_field%22%3e%3ca+href%3d%22http://www.facebook.com/recover/initiate%22+rel%3d%22nofollow%22%3eforgot+your+password?%3c/a%3e%3c/td%3e%3c/tr%3e%3c/table%3e%3cinput+autocomplete%3d%22off%22+id%3d%22u_0_5%22+name%3d%22timezone%22+type%3d%22hidden%22+value%3d%22%22+/%3e%3cinput+name%3d%22lgnrnd%22+type%3d%22hidden%22+value%3d%22072355_cc8g%22+/%3e%3cinput+id%3d%22lgnjs%22+name%3d%22lgnjs%22+type%3d%22hidden%22+value%3d%22n%22+/%3e%3cinput+autocomplete%3d%22off%22+id%3d%22locale%22+name%3d%22locale%22+type%3d%22hidden%22+value%3d%22en_us%22+/%3e%3c/form%3e&amp\;st=e%3daihe3cay2w0llexo7ghwkl%252f%252fkgnvxirziim%252bjy38posid%252bizh7%252fwodfiyqpx%252fjjzy6dfuunn1tc2skl3idsj%252ffxqssiaehp2ugrt%252fxppm7hpnmva0x0o0zmdnjm9ftfwsfng8fur75zr%26c%3denterprise&amp\;rpctoken=6540471481299497563",nocase; classtype:attempted-recon; sid:200007304; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jvfinancialgroup2601.sharepoint.com",nocase; http_uri; content:"/_layouts/15/guestaccess.aspx?guestaccesstoken=vprynrqjkogfudkf6lumbxbojbohooqc1ymiuthz7jm%3d&docid=1_1df1de3359fe34f26bbf1bce323c7c0ba&wdformid=%7bffc0ac49%2d9207%2d4ec3%2d8b31%2d1b525859bd01%7d",nocase; classtype:attempted-recon; sid:200007305; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"jvz7.com",nocase; http_uri; content:"/c/2057113/367593",nocase; classtype:attempted-recon; sid:200007306; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"k12inc-my.sharepoint.com",nocase; http_uri; content:"/personal/jdonahue_k12_com/_layouts/15/wopiframe.aspx?guestaccesstoken=jxndynkzmynao0nofzmhz4t%2fk%2br%2fg7qir2agrjo42ha%3d&docid=1_12252b23331654ef4bf8ef978a8eb83ee&wdformid=%7b2711d93c%2d7591%2d4baa%2db377%2dcf40ba8c7343%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200007307; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"keypointtraining-my.sharepoint.com",nocase; http_uri; content:"/personal/janeann_keypoint-training_com/_layouts/15/doc.aspx?sourcedoc={9af291d0-87c8-456b-8c74-dddd4a2e5852}&amp\;action=default&amp\;slrid=5e9d489f-500f-a000-704a-3a9b1d01a72a&amp\;originalpath=ahr0chm6ly9rzxlwb2ludhryywluaw5nlw15lnnoyxjlcg9pbnquy29tlzpvoi9nl3blcnnvbmfsl2phbmvhbm5fa2v5cg9pbnqtdhjhaw5pbmdfy29tl0v0q1i4chjjadj0rmpivgqzvw91v0zjqnh1czlqvg4xqnjnevrdagvmtzr2chc_cnrpbwu9mdhmru1ramcxmgc&amp\;cid=7363f9cd-6bf7-4ad7-bc74-c042e1b12064",nocase; classtype:attempted-recon; sid:200007308; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"keypointtraining-my.sharepoint.com",nocase; http_uri; content:"/personal/janeann_keypoint-training_com/_layouts/15/doc.aspx?sourcedoc={9af291d0-87c8-456b-8c74-dddd4a2e5852}&amp\;action=default&amp\;slrid=ee23589f-0089-b000-5d74-8aa7a03b8de3&amp\;originalpath=ahr0chm6ly9rzxlwb2ludhryywluaw5nlw15lnnoyxjlcg9pbnquy29tlzpvoi9nl3blcnnvbmfsl2phbmvhbm5fa2v5cg9pbnqtdhjhaw5pbmdfy29tl0v0q1i4chjjadj0rmpivgqzvw91v0zjqnh1czlqvg4xqnjnevrdagvmtzr2chc_cnrpbwu9wkvhqxvtoecyrwc&amp\;cid=dc28dcfb-7b22-4261-9a32-2d2b3ac51b0a",nocase; classtype:attempted-recon; sid:200007309; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"keypointtraining-my.sharepoint.com",nocase; http_uri; content:"/personal/janeann_keypoint-training_com/_layouts/15/doc.aspx?sourcedoc={9af291d0-87c8-456b-8c74-dddd4a2e5852}&amp\;action=default&amp\;slrid=fa96499f-005f-a000-ea0b-8ce2d0a60e1c&amp\;originalpath=ahr0chm6ly9rzxlwb2ludhryywluaw5nlw15lnnoyxjlcg9pbnquy29tlzpvoi9nl3blcnnvbmfsl2phbmvhbm5fa2v5cg9pbnqtdhjhaw5pbmdfy29tl0v0q1i4chjjadj0rmpivgqzvw91v0zjqnh1czlqvg4xqnjnevrdagvmtzr2chc_cnrpbwu9btfkdm1hbmkxmgc&amp\;cid=4ec8b760-2666-4b1a-bfca-6de872ca2796",nocase; classtype:attempted-recon; sid:200007310; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kisa.link",nocase; http_uri; content:"/p59j",nocase; classtype:attempted-recon; sid:200007311; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kisa.link",nocase; http_uri; content:"/url_redirector.php?url=ff56th",nocase; classtype:attempted-recon; sid:200007312; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kisa.link",nocase; http_uri; content:"/url_redirector.php?url=mqp9",nocase; classtype:attempted-recon; sid:200007313; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kisa.link",nocase; http_uri; content:"/url_redirector.php?url=p6kk",nocase; classtype:attempted-recon; sid:200007314; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kuadmission.com",nocase; http_uri; content:"/bedentrance21/uploads/c1/office/index.php?email=emidaniel@anz.com",nocase; classtype:attempted-recon; sid:200007315; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kurortnoye.com.ua",nocase; http_uri; content:"/admin/read-invoice/index.php?rec=no-responder@mailer.yunait.com",nocase; classtype:attempted-recon; sid:200007316; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kusama.weyoxzqrnfdsrnews.blog",nocase; http_uri; content:"/lesssecure.php?1satu",nocase; classtype:attempted-recon; sid:200007317; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kutt.it",nocase; http_uri; content:"/3mdfzz?service",nocase; classtype:attempted-recon; sid:200007318; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kutt.it",nocase; http_uri; content:"/ecnmqx",nocase; classtype:attempted-recon; sid:200007319; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"kutt.it",nocase; http_uri; content:"/v6aqx1",nocase; classtype:attempted-recon; sid:200007320; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=http://findyourdns.com/qo9pf6d",nocase; classtype:attempted-recon; sid:200007321; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://findyourdns.com/h0v6e0b",nocase; classtype:attempted-recon; sid:200007322; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://getpayment.irs.gov.account-cash.app/?imanhalal",nocase; classtype:attempted-recon; sid:200007323; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://ok.me/avur?userid=y8bi5gwe",nocase; classtype:attempted-recon; sid:200007324; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://ok.me/t8yq?userid=qdpsfluc",nocase; classtype:attempted-recon; sid:200007325; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://ok.me/vcwq?userid=doteiphj",nocase; classtype:attempted-recon; sid:200007326; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://ok.me/vcwq?userid=iykpku7b",nocase; classtype:attempted-recon; sid:200007327; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://ok.me/vcwq?userid=sbhiiqzp",nocase; classtype:attempted-recon; sid:200007328; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://qr.paps.jp/eduds?userid=ovvatazi",nocase; classtype:attempted-recon; sid:200007329; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://s.id/a4doq",nocase; classtype:attempted-recon; sid:200007330; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://s.id/a6rct",nocase; classtype:attempted-recon; sid:200007331; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://tracktheip.com/f9pt47k",nocase; classtype:attempted-recon; sid:200007332; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://verify.cqptxcl.com/ww2vjin",nocase; classtype:attempted-recon; sid:200007333; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://wanzane.com/o71ygxy",nocase; classtype:attempted-recon; sid:200007334; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://where-memeke.com/r/mcimqvj",nocase; classtype:attempted-recon; sid:200007335; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"l.wl.co",nocase; http_uri; content:"/l?u=https://where-memeke.com/r/uitlpmi",nocase; classtype:attempted-recon; sid:200007336; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"legalshieldcorp-my.sharepoint.com",nocase; http_uri; content:"/:x:/p/carsonthetford/errgookz7qvhvaghf-lvfywbmykkqgv1pteukutrddwcjw?e=tnuug2",nocase; classtype:attempted-recon; sid:200007337; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lichtetviet.com",nocase; http_uri; content:"/hakam%20new/tops.php",nocase; classtype:attempted-recon; sid:200007338; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lichtetviet.com",nocase; http_uri; content:"/it/index.php?i=i&0=anna.duncan@sc.com",nocase; classtype:attempted-recon; sid:200007339; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lichtetviet.com",nocase; http_uri; content:"/it/skvr51ogvi7itw1ftdbicyxfzt.php?0=qw5uys5edw5jyw5ac2muy29t&.verify??guce_referrer=ahr0chm6ly9sb2dpbi55ywhvby5jb20v&guce_referrer_sig=aqaaaba99nmgr9inqoyu5mi3asjqfyjcpatd_a8modgjxpnxynmo8n5zxdi8ezv7gfypzosc_rpmz0hyfdck0olmxnmb6tpfznd5encxtci3e56k0vz3psl6poiodvee6vv6vaibzqdjcyabahdiaf7gx2w9xrgmch4orbe2vczo9an_",nocase; classtype:attempted-recon; sid:200007340; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lifeiswhatyoumakeofit.com",nocase; http_uri; content:"/match_login/match.com/match/login1876.html",nocase; classtype:attempted-recon; sid:200007341; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lihi1.cc",nocase; http_uri; content:"/4pynu/vervanging",nocase; classtype:attempted-recon; sid:200007342; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lihi1.cc",nocase; http_uri; content:"/61uks",nocase; classtype:attempted-recon; sid:200007343; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lihi1.cc",nocase; http_uri; content:"/7au74?userid=rlmj8zoe",nocase; classtype:attempted-recon; sid:200007344; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lihi1.cc",nocase; http_uri; content:"/fqg9x",nocase; classtype:attempted-recon; sid:200007345; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lihi1.cc",nocase; http_uri; content:"/gukxe",nocase; classtype:attempted-recon; sid:200007346; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lihi1.cc",nocase; http_uri; content:"/jif9o",nocase; classtype:attempted-recon; sid:200007347; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lihi1.cc",nocase; http_uri; content:"/uh2xv",nocase; classtype:attempted-recon; sid:200007348; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"link.do",nocase; http_uri; content:"/redirect.php?to=https://prijava-siolnet4.firebaseapp.com",nocase; classtype:attempted-recon; sid:200007349; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"link.zixcentral.com",nocase; http_uri; content:"/u/28c878da/ycspgffb6hgbim_i5f7krg?u=https%3a%2f%2fuser23546576879809ip.dt.r.appspot.com%2f%23cfishkin%40careevolve.com",nocase; classtype:attempted-recon; sid:200007350; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/ablatt",nocase; classtype:attempted-recon; sid:200007351; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/actionrequired",nocase; classtype:attempted-recon; sid:200007352; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/ad77823",nocase; classtype:attempted-recon; sid:200007353; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/apple.supports",nocase; classtype:attempted-recon; sid:200007354; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/att4506att",nocase; classtype:attempted-recon; sid:200007355; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/attlogin",nocase; classtype:attempted-recon; sid:200007356; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/bbbbttttllloggs",nocase; classtype:attempted-recon; sid:200007357; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/bellsouthupgrade",nocase; classtype:attempted-recon; sid:200007358; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/bhhvvirggiin",nocase; classtype:attempted-recon; sid:200007359; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/bt.mail",nocase; classtype:attempted-recon; sid:200007360; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/bt_internet",nocase; classtype:attempted-recon; sid:200007361; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btcoesecurebt365e",nocase; classtype:attempted-recon; sid:200007362; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btcoesecurebt365r",nocase; classtype:attempted-recon; sid:200007363; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btcoesecurebt365w",nocase; classtype:attempted-recon; sid:200007364; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btconnecttt",nocase; classtype:attempted-recon; sid:200007365; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btesecurebl365pd",nocase; classtype:attempted-recon; sid:200007366; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btesecurebn365pd",nocase; classtype:attempted-recon; sid:200007367; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btesecurebtsa365",nocase; classtype:attempted-recon; sid:200007368; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/bthomes",nocase; classtype:attempted-recon; sid:200007369; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btinternetlee",nocase; classtype:attempted-recon; sid:200007370; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btinternets",nocase; classtype:attempted-recon; sid:200007371; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btmosh",nocase; classtype:attempted-recon; sid:200007372; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btrsecurebt365pdf",nocase; classtype:attempted-recon; sid:200007373; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btserviceinc",nocase; classtype:attempted-recon; sid:200007374; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btseuww",nocase; classtype:attempted-recon; sid:200007375; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/btseuwwww",nocase; classtype:attempted-recon; sid:200007376; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/bttlogin2021",nocase; classtype:attempted-recon; sid:200007377; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/currentlyyahoo",nocase; classtype:attempted-recon; sid:200007378; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/donasikeindonesiiianns.chase",nocase; classtype:attempted-recon; sid:200007379; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/eftremittance/",nocase; classtype:attempted-recon; sid:200007380; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/h00tlm1vq6bh",nocase; classtype:attempted-recon; sid:200007381; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/hairatwentworkpaid",nocase; classtype:attempted-recon; sid:200007382; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/hairatwentworkth",nocase; classtype:attempted-recon; sid:200007383; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/hermitagevillagehall",nocase; classtype:attempted-recon; sid:200007384; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/internet22222",nocase; classtype:attempted-recon; sid:200007385; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/invoicepay2",nocase; classtype:attempted-recon; sid:200007386; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/jackplayvoicewireless",nocase; classtype:attempted-recon; sid:200007387; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/jhgdfbdhddcddoutlook",nocase; classtype:attempted-recon; sid:200007388; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/jssdm",nocase; classtype:attempted-recon; sid:200007389; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/microsoffilesecurebt342/",nocase; classtype:attempted-recon; sid:200007390; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/microsoffilesecurebt360/",nocase; classtype:attempted-recon; sid:200007391; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/microsoffilesecurebthomead63/",nocase; classtype:attempted-recon; sid:200007392; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/microsoftvoicereceived0922",nocase; classtype:attempted-recon; sid:200007393; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/midasbuyucweb",nocase; classtype:attempted-recon; sid:200007394; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/nyxinc.com",nocase; classtype:attempted-recon; sid:200007395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/officialpubgonmobile",nocase; classtype:attempted-recon; sid:200007396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/p411710",nocase; classtype:attempted-recon; sid:200007397; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/paidadvice",nocase; classtype:attempted-recon; sid:200007398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/pathway90",nocase; classtype:attempted-recon; sid:200007399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/paypai.account",nocase; classtype:attempted-recon; sid:200007400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/promotitans19/",nocase; classtype:attempted-recon; sid:200007401; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/pubgxmetrodus",nocase; classtype:attempted-recon; sid:200007402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/reesults",nocase; classtype:attempted-recon; sid:200007403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/remittancefile",nocase; classtype:attempted-recon; sid:200007404; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/securemicrosoftonlinedata",nocase; classtype:attempted-recon; sid:200007405; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/supportincteam",nocase; classtype:attempted-recon; sid:200007406; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/susuaccount.chasesu",nocase; classtype:attempted-recon; sid:200007407; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/tacazesports",nocase; classtype:attempted-recon; sid:200007408; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/tacazoffcial",nocase; classtype:attempted-recon; sid:200007409; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/updatess365",nocase; classtype:attempted-recon; sid:200007410; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/verification01",nocase; classtype:attempted-recon; sid:200007411; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/vkjjhgfdfginternet",nocase; classtype:attempted-recon; sid:200007412; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"linktr.ee",nocase; http_uri; content:"/xaiomi.g1fts?fbclid=iwar0m4ptysyv4cf8adot5iwjitcil-ftx_m7anuv8_n1zjq7hg3g5cdqmeqq",nocase; classtype:attempted-recon; sid:200007413; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"livebyuh-my.sharepoint.com",nocase; http_uri; content:"/personal/bayar5_go_byuh_edu/_layouts/15/wopiframe.aspx?guestaccesstoken=6seywnzti73n2lfa4zk0ou3hquxhvetwh6roozeb7se%3d&docid=1_1d81a4a770f25458a867093dc6a078a83&wdformid=%7b832d7492%2d3c6e%2d4262%2d983f%2d79975cd8325b%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200007414; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"liveconcorde-my.sharepoint.com",nocase; http_uri; content:"/personal/sofia_segura_casbn_concorde_edu/_layouts/15/guestaccess.aspx?guestaccesstoken=cfpri5iyk8vfhjlweteqtjaelz%2bit8e80ogjwtvujlc%3d&amp\;docid=1_1f700b55b23874de19595c967b1ee1e75&amp\;wdformid=%7b5f9c1dbd%2d28e2%2d479e%2dbe4e%2d4ce54e21fe0d%7d",nocase; classtype:attempted-recon; sid:200007415; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"livenmitac-my.sharepoint.com",nocase; http_uri; content:"/personal/czarina-cabalza_live_nmit_ac_nz/_layouts/15/wopiframe.aspx?guestaccesstoken=bcxwl3a7ttskgw2polh3cucg2dfe77pbj2gkmixkizs%3d&docid=1_1b87bddf46e1144efadb39c587acdadae&wdformid=%7b5b4e96cf%2d1bcd%2d468f%2da845%2d09b4d8027bc2%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200007416; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"livenmitac-my.sharepoint.com",nocase; http_uri; content:"/personal/czarina-cabalza_live_nmit_ac_nz/_layouts/15/wopiframe.aspx?guestaccesstoken=fnyckzjagh3z%2bl1cadcdqxot6rfyhmeonulx7ksc7pq%3d&docid=1_15129478f60da40db8395b5675832ef56&wdformid=%7b000c8ab1%2dcbc8%2d44e3%2dac19%2d0015f01b771e%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200007417; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"livenmitac-my.sharepoint.com",nocase; http_uri; content:"/personal/hannah-daly_live_nmit_ac_nz/_layouts/15/wopiframe.aspx?guestaccesstoken=ia5uzzon3iviku4f3pxemyhhabfwkpdjirpftfear%2fk%3d&docid=1_169208e425ed84fea9fd294a6886d67e9&wdformid=%7b06255f86%2d4bf9%2d4ee8%2dbd7e%2dfef81913a79b%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200007418; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"livenmitac-my.sharepoint.com",nocase; http_uri; content:"/personal/hannah-daly_live_nmit_ac_nz/_layouts/15/wopiframe.aspx?guestaccesstoken=ia5uzzon3iviku4f3pxemyhhabfwkpdjirpftfear/k=&amp\;docid=1_169208e425ed84fea9fd294a6886d67e9&amp\;wdformid={06255f86-4bf9-4ee8-bd7e-fef81913a79b}&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200007419; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"livenmitac-my.sharepoint.com",nocase; http_uri; content:"/personal/hannah-daly_live_nmit_ac_nz/_layouts/15/wopiframe.aspx?guestaccesstoken=za7yvssjtzxen%2fcnb0hswkqniem%2fcumgrmfvnt4f8cy%3d&docid=1_128a2a62563b647c9b1b6806600fd8a09&wdformid=%7b20510126%2dfb1d%2d4e63%2d9e6a%2df86488e1d5c6%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200007420; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ljbarton-my.sharepoint.com",nocase; http_uri; content:"/:b:/p/jay_gilmour/exhqlax-ttzblxuozhpnm8ibzjzs2np0tpsknw-4kbeb5a?e=ewkjcb",nocase; classtype:attempted-recon; sid:200007421; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloyds.web-recipient.com",nocase; http_uri; content:"/show.php",nocase; classtype:attempted-recon; sid:200007422; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lloydsbank.protect-secure-prevent.com",nocase; http_uri; content:"/login.php",nocase; classtype:attempted-recon; sid:200007423; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/d7ayxcgd",nocase; classtype:attempted-recon; sid:200007424; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/d8qsmyxr",nocase; classtype:attempted-recon; sid:200007425; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/d_kutuer",nocase; classtype:attempted-recon; sid:200007426; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/dc_qgjgt",nocase; classtype:attempted-recon; sid:200007427; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/dd-pkti",nocase; classtype:attempted-recon; sid:200007428; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/ddivaqp",nocase; classtype:attempted-recon; sid:200007429; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/ddivaqp?userid=4pz15vnm",nocase; classtype:attempted-recon; sid:200007430; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/dnqy4qrw",nocase; classtype:attempted-recon; sid:200007431; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/dnqy4qrw?userid=9cknk2yb",nocase; classtype:attempted-recon; sid:200007432; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/dpneeiw",nocase; classtype:attempted-recon; sid:200007433; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/dpneeiw?trackingid=eo9hvc8w&signature=newsletter",nocase; classtype:attempted-recon; sid:200007434; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/dtu6uhs",nocase; classtype:attempted-recon; sid:200007435; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/dvewnpt",nocase; classtype:attempted-recon; sid:200007436; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/dycnfuz",nocase; classtype:attempted-recon; sid:200007437; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/e4thv3et",nocase; classtype:attempted-recon; sid:200007438; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/e53aerx",nocase; classtype:attempted-recon; sid:200007439; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/e_nfvj4n",nocase; classtype:attempted-recon; sid:200007440; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/ehtyhpiq",nocase; classtype:attempted-recon; sid:200007441; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/ej-ngqjk",nocase; classtype:attempted-recon; sid:200007442; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/emcgvfmg",nocase; classtype:attempted-recon; sid:200007443; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/erzsyig",nocase; classtype:attempted-recon; sid:200007444; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/espwchqf",nocase; classtype:attempted-recon; sid:200007445; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/g6fyfzwm",nocase; classtype:attempted-recon; sid:200007446; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/gc9jh9cu",nocase; classtype:attempted-recon; sid:200007447; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/gfiextht",nocase; classtype:attempted-recon; sid:200007448; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/gvnpdt-w",nocase; classtype:attempted-recon; sid:200007449; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkd.in",nocase; http_uri; content:"/gwaajkqi",nocase; classtype:attempted-recon; sid:200007450; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkmeup.com",nocase; http_uri; content:"/6z7w",nocase; classtype:attempted-recon; sid:200007451; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lnkmeup.com",nocase; http_uri; content:"/78q2",nocase; classtype:attempted-recon; sid:200007452; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"login.microsoftonline.us",nocase; http_uri; content:"/rtxusers.onmicrosoft.us/oauth2/authorize?client_id=5c8081f1-46af-4077-a0e2-b12ad052a0cb&amp\;resource=5c8081f1-46af-4077-a0e2-b12ad052a0cb&amp\;response_mode=form_post&amp\;response_type=code%20id_token&amp\;scope=openid%20profile&amp\;state=openidconnect.authenticationproperties=av8xafvlbjl8lveyf112dlrykz1za2fd6roj7a4wst794dn-f5sqocbr8ywev5f9zf62koqwtmgls1ki6kk2gufthuiwhh8dktfndjhnflk-phai2ham7lsuxwzw_betpc3owljmnp57neynhsvjqmifs4qzk-5-1psc4i5afw_ereflxuibhuxktqjkvv2n6u9chaak_no55v_iwarchknnphrsskxl9bdnv8_zdus7&amp\;nonce=637486060621877491.otrmm2m2owmtytnjny00ngvmlwixntctmmzinjzlnzq5ntllmzlkndk2zdktmjjmmy00yjg5lwjkodqtmtc2zdrjndfkytrk&amp\;redirect_uri=https://tasks.office365.us/landing&amp\;ui_locales=en-us&amp\;mkt=en-us&amp\;x-client-sku=id_net461&amp\;x-client-ver=6.5.0.0",nocase; classtype:attempted-recon; sid:200007453; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"londonfiestant.com",nocase; http_uri; content:"/espoi/loglns",nocase; classtype:attempted-recon; sid:200007454; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"londonfiestant.com",nocase; http_uri; content:"/espoi/loglns/",nocase; classtype:attempted-recon; sid:200007455; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"londonfiestant.com",nocase; http_uri; content:"/espoi/loglns/billing.php",nocase; classtype:attempted-recon; sid:200007456; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"londonfiestant.com",nocase; http_uri; content:"/espoi/loglns/payment.php",nocase; classtype:attempted-recon; sid:200007457; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"londonfiestant.com",nocase; http_uri; content:"/espoi/loglns/secure/cc.php",nocase; classtype:attempted-recon; sid:200007458; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lu9-my.sharepoint.com",nocase; http_uri; content:"/personal/anne46523_5tb_in/_layouts/15/acceptinvite.aspx?invitation=%7b9614113b%2dbe07%2d438b%2d963d%2d659c8690fbd2%7d",nocase; classtype:attempted-recon; sid:200007459; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lu9-my.sharepoint.com",nocase; http_uri; content:"/personal/margaret43636_5tb_in/_layouts/15/acceptinvite.aspx?invitation=%7b94ca64e1%2db293%2d4622%2d9504%2d695384f21579%7d",nocase; classtype:attempted-recon; sid:200007460; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lunaclothing-my.sharepoint.com",nocase; http_uri; content:"/personal/info_lunaclothing_nl/_layouts/15/wopiframe.aspx?sourcedoc={aace4e9a-412a-4eb0-b7b6-23c76317f081}&amp\;action=default&amp\;originalpath=ahr0chm6ly9sdw5hy2xvdghpbmctbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvaw5mb19sdw5hy2xvdghpbmdfbmwvrxbwt3pxb3frykjpdddzangytvg4suvcvtyznhnmlxnwr3bvytryuzdbaxzfdz9ydgltzt05uzqwnmvssjewzw",nocase; classtype:attempted-recon; sid:200007461; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lunaclothing-my.sharepoint.com",nocase; http_uri; content:"/personal/info_lunaclothing_nl/_layouts/15/wopiframe2.aspx?sourcedoc={aace4e9a-412a-4eb0-b7b6-23c76317f081}&amp\;action=default&amp\;originalpath=ahr0chm6ly9sdw5hy2xvdghpbmctbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvaw5mb19sdw5hy2xvdghpbmdfbmwvrxbwt3pxb3frykjpdddzangytvg4suvcvtyznhnmlxnwr3bvytryuzdbaxzfdz9ydgltzt05uzqwnmvssjewzw",nocase; classtype:attempted-recon; sid:200007462; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lunaclothing-my.sharepoint.com",nocase; http_uri; content:"/personal/info_lunaclothing_nl/_layouts/15/wopiframe2.aspx?sourcedoc={aace4e9a-412a-4eb0-b7b6-23c76317f081}&amp\;action=default&amp\;originalpath=ahr0chm6ly9sdw5hy2xvdghpbmctbxkuc2hhcmvwb2ludc5jb20vom86l2cvcgvyc29uywwvaw5mb19sdw5hy2xvdghpbmdfbmwvrxbwt3pxb3frykjpdddzangytvg4suvcvtyznhnmlxnwr3bvytryuzdbaxzfdz9ydgltzt1vvm5wuy1ssjewzw",nocase; classtype:attempted-recon; sid:200007463; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"lvnews.org.ua",nocase; http_uri; content:"/frontend/pagina/imagenes/comun2008/banca-en-linea-personas.html",nocase; classtype:attempted-recon; sid:200007464; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.me",nocase; http_uri; content:"/bobfrank2070",nocase; classtype:attempted-recon; sid:200007465; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"m.me",nocase; http_uri; content:"/govt.official.compensate.help.grant",nocase; classtype:attempted-recon; sid:200007466; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"madras.com.br",nocase; http_uri; content:"/mbl/",nocase; classtype:attempted-recon; sid:200007467; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"magyarpoosta.blogspot.com",nocase; http_uri; content:"/2021/02/blog-post.html",nocase; classtype:attempted-recon; sid:200007468; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.cabconnect.com.au",nocase; http_uri; content:"/images/wet/2020dhl_topscript/dhl_topscript/cmd-login=cd01efe09a3c34091edcbd69433f3bbc",nocase; classtype:attempted-recon; sid:200007469; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.cabconnect.com.au",nocase; http_uri; content:"/images/wet/2020dhl_topscript/dhl_topscript/cmd-login=cd01efe09a3c34091edcbd69433f3bbc/",nocase; classtype:attempted-recon; sid:200007470; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.cabconnect.com.au",nocase; http_uri; content:"/images/wet/2020dhl_topscript/dhl_topscript/cmd-login=cd01efe09a3c34091edcbd69433f3bbc/?reff=mdg1odi4mgi1nta4zwuxmdk1oge3nwvkntexoge3nzg=",nocase; classtype:attempted-recon; sid:200007471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.hfcfit.com",nocase; http_uri; content:"/forms/forms/form1.html",nocase; classtype:attempted-recon; sid:200007472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.securevpn.co.uk",nocase; http_uri; content:"/227b0c395c85d9d3d4e62b09b7de6a2e/qes.php?cmd=_account-details&session=a9aafa07cf18b10daa87b54d48220804&dispatch=fc1d2fc42778ec442e3db9a1c7022cfe0b9612fb",nocase; classtype:attempted-recon; sid:200007473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.securevpn.co.uk",nocase; http_uri; content:"/8cf6a9375133dca2922dc6b1f0b9c3f0/qes.php?cmd=_account-details&dispatch=5ea7cc81433c118fb34862467aada17ac42ecc52&entity=60865&session=a7dc4a8d485e28b801081cd2381300f2",nocase; classtype:attempted-recon; sid:200007474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.securevpn.co.uk",nocase; http_uri; content:"/92321c96732d47f7c88d973ce1a6e9f9/qes.php?cmd=_account-details&session=4cd8ae5a80f6cb832385cb0f1000f54e&dispatch=39cb2e23c9744732e4d5452171a1160e1540df09",nocase; classtype:attempted-recon; sid:200007475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.securevpn.co.uk",nocase; http_uri; content:"/92321c96732d47f7c88d973ce1a6e9f9/security.php?cmd=_account-details&session=eacd52fbb82ca63fe22a7ee8b68e6b84&dispatch=d81d847b9eae9feab577b84e4d5b863f0dcf5c4c",nocase; classtype:attempted-recon; sid:200007476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/186.154.25.1064023/sucursalpersonas.transaccionesbancolombia.com/mua",nocase; classtype:attempted-recon; sid:200007477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/186.154.25.1064023/sucursalpersonas.transaccionesbancolombia.com/mua/",nocase; classtype:attempted-recon; sid:200007478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/190.61.55.2105806/sucursalpersonas.transaccionesbancolombia.com/mua/index.html",nocase; classtype:attempted-recon; sid:200007479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/191.110.122.835718/sucursalpersonas.transaccionesbancolombia.com/mua",nocase; classtype:attempted-recon; sid:200007480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/191.110.122.835718/sucursalpersonas.transaccionesbancolombia.com/mua/",nocase; classtype:attempted-recon; sid:200007481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail.trendset.com.ar.ci3.toservers.com",nocase; http_uri; content:"/mua/201.233.42.1501206/sucursalpersonas.transaccionesbancolombia.com/mua/index.html",nocase; classtype:attempted-recon; sid:200007482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail01.tinyletterapp.com",nocase; http_uri; content:"/support--1/friends-romans-countrymen-lend-me-your-ears-2/13668329-service-account-3.000webhostapp.com/mafiiiiiiia/mafiiiiiiia/gs_gen/gs9bb68a92d020f84a0d8f34df0f4e035e/?redacted",nocase; classtype:attempted-recon; sid:200007483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail01.tinyletterapp.com",nocase; http_uri; content:"/support--1/important-confirm-your-account-1/13669205-service-account-5.000webhostapp.com/account/account/gs_gen/gs321c3043f9edf99647ed762add65f6dc/?redacted",nocase; classtype:attempted-recon; sid:200007484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mail01.tinyletterapp.com",nocase; http_uri; content:"/support--2/important-confirm-your-account-2/13672637-service-account-4.000webhostapp.com/account/account/gs_gen/gs8987183b45b1fe5ea8e32131b9fb5718/?redacted",nocase; classtype:attempted-recon; sid:200007485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"majbert.com",nocase; http_uri; content:"/irs/pre_qualify.php",nocase; classtype:attempted-recon; sid:200007486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"makingmoneyiscertainlyamusthereindiszones.s3.amazonaws.com",nocase; http_uri; content:"/index.html",nocase; classtype:attempted-recon; sid:200007487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"malukutenggarakab.go.id",nocase; http_uri; content:"/covid-19/ebay.de.singonacccountc53335b82cb093170657a560aa633ae793b1b483d10d47e1b06db4e/",nocase; classtype:attempted-recon; sid:200007488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mapeigroup-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/dejackson_mapei_com/eoimj1iifxtkuvej7paluwmb8rmln15hjfe2y09qaqtd6a?e=w9mk",nocase; classtype:attempted-recon; sid:200007489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"marketinghbt-my.sharepoint.com",nocase; http_uri; content:"/personal/helaine_marketinghbt_onmicrosoft_com/_layouts/15/doc.aspx?sourcedoc={399d080d-00f3-498e-ab31-d3871303131e}&amp\;action=view&amp\;wd=target%28payment.one%7cab348455-fd82-496a-a5fb-d3816a55a264%2frobin%20kallas%20has%20sent%20you%20a%20secure%20document%20%22payment%22%7cedaf5b03-0f86-4664-902e-2e69550aa890%2f%29",nocase; classtype:attempted-recon; sid:200007490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"me2.do",nocase; http_uri; content:"/xzcnvkju?userid=0pkfbzff",nocase; classtype:attempted-recon; sid:200007491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meet.google.com",nocase; http_uri; content:"/linkredirect?authuser=0&amp\;dest=https%3a%2f%2flinktr.ee%2fpaypai.serviceid?idtrack=kzsykctt",nocase; classtype:attempted-recon; sid:200007492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"meet.google.com",nocase; http_uri; content:"/linkredirect?dest=http://hunter.capitalfinaleu.com/?ahvudgvyqg1pzs51dg9yb250by5jyq==/username",nocase; classtype:attempted-recon; sid:200007493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"member-mailtech-support.com",nocase; http_uri; content:"/login/domain.com/office_365_authentication",nocase; classtype:attempted-recon; sid:200007494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"member-mailtech-support.com",nocase; http_uri; content:"/login/domain.com/office_365_authentication/",nocase; classtype:attempted-recon; sid:200007495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"member-mailtech-support.com",nocase; http_uri; content:"/login/domain.com/office_365_authentication/office.php?11kd051617588590ec69beb630c68a267a277590c3f709d1ec69beb630c68a267a277590c3f709d1ec69beb630c68a267a277590c3f709d1ec69beb630c68a267a277590c3f709d1ec69beb630c68a267a277590c3f709d1",nocase; classtype:attempted-recon; sid:200007496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"member-mailtech-support.com",nocase; http_uri; content:"/login/domain.com/office_365_authentication/office.php?bj886b16175953298d2e60f8a73bbd00f696eb436652ba648d2e60f8a73bbd00f696eb436652ba648d2e60f8a73bbd00f696eb436652ba648d2e60f8a73bbd00f696eb436652ba648d2e60f8a73bbd00f696eb436652ba64",nocase; classtype:attempted-recon; sid:200007497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mhughujij-sedfgyhujni-tfghujji.s3.amazonaws.com",nocase; http_uri; content:"/index.html",nocase; classtype:attempted-recon; sid:200007498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mi.homedepot.com",nocase; http_uri; content:"/p/cp/46595ecebf250010/c?mi_u=54632464&amp\;url=https%3a%2f%2fwww.google.com%2furl%3fsa%3dt%26rct%3dj%26q%3d%26esrc%3ds%26source%3dweb%26cd%3d%26cad%3drja%26uact%3d8%26ved%3d2ahukewiq5z7q2ehsahvt5uakhem0c-cqfjaaegqibrac%26url%3dhttp%253a%252f%252fwww.agtroma.it%252fesperienze.htm%26usg%3daovvaw0qjsiebpcbznvj3y5d6wvu",nocase; classtype:attempted-recon; sid:200007499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mi.jetblue.com",nocase; http_uri; content:"/p/cp/0ccc3066dc2bcd17/c?mi_u=87923176&mi_origin=&url=http://email.stickercanada.com/t?entity_type=2&entity_id=32534&email_pref_id=34785928&sent_id=1600423397&service_id=22668&redirect_url=https:/relievehotmailonly.cloudns.cl/imagineme/ionos.php",nocase; classtype:attempted-recon; sid:200007500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"milanno342.blogspot.com",nocase; http_uri; content:"/2020/11/fiyatlar.html",nocase; classtype:attempted-recon; sid:200007501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"millenniaco-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/vgibbs_mhmltd_com/epp3aeyaxrlkqypm5j3ps5ib0imi6otftjp4ijzlbe4pyq?e=5:r8hnxr&amp\;at=9",nocase; classtype:attempted-recon; sid:200007502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"millenniaco-my.sharepoint.com",nocase; http_uri; content:"/personal/vgibbs_mhmltd_com/_layouts/15/doc.aspx?sourcedoc={ec69f793-5e80-4ab9-ab2a-66e49de9b392}&amp\;action=default&amp\;slrid=dca0489f-f03b-b000-9fd0-1e171e182306&amp\;originalpath=ahr0chm6ly9tawxszw5uawfjby1tes5zagfyzxbvaw50lmnvbs86bzovzy9wzxjzb25hbc92z2liynnfbwhtbhrkx2nvbs9fcfazywv5qvhybetxexbtnuozchm1suiwaw1pnk90znrqcdrpsnpmqmu0uhlrp3j0aw1lpujzclb1vkrnmtbn&amp\;cid=0e1475ff-8901-48a8-aeae-660a9e5b5547",nocase; classtype:attempted-recon; sid:200007503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mitrasinergisukses.com",nocase; http_uri; content:"/to/authorize_client_id:0ar3ubx9-efko-7kel-dzvi-g1u9yep3xwi2_2iwdasp18v3y09z7oenhkjcxltg564umqrbfh6f184ynrv9cktxoj0e3w5qzabsdg27mulipge8a5yrthd91pq4scu7kvobn0xwifz63ljm2?data=&email=brickell1st@unitedpropertymgt.com",nocase; classtype:attempted-recon; sid:200007504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mitrasinergisukses.com",nocase; http_uri; content:"/to/authorize_client_id:fd34jogt-okyt-doxr-xsu7-miu4tra9zxoc_agus0hd8b6yj25miwzc31xtrpqevol794kfnizj96yq0hr8x3wfu5cb1ma72ngpolte4dvskjvsnwi0do5zfb687lexkh3mqa9c2p4utgy1r?data=&amp\;email=brickell1st@unitedpropertymgt.com",nocase; classtype:attempted-recon; sid:200007505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mixedgoat.com",nocase; http_uri; content:"/index.php",nocase; classtype:attempted-recon; sid:200007506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mnhjhjuuhn-vtvghyghji-ygfgyhuji.s3.amazonaws.com",nocase; http_uri; content:"/index.html",nocase; classtype:attempted-recon; sid:200007507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"modularmovements-my.sharepoint.com",nocase; http_uri; content:"/personal/khunsley_modularmovements_com/_layouts/15/onedrive.aspx?id=/personal/khunsley_modularmovements_com/documents/dbc%20sharepoint.pdf&amp\;parent=/personal/khunsley_modularmovements_com/documents&amp\;originalpath=ahr0chm6ly9tb2r1bgfybw92zw1lbnrzlw15lnnoyxjlcg9pbnquy29tlzpioi9wl2todw5zbgv5l0vhuupzyxbquvvkq25wtxjfexzgd2tbqm5bmly0s0tzu01kdu0tukvns1h6tle_cnrpbwu9dzhiulbwaguyrwc",nocase; classtype:attempted-recon; sid:200007508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monovative-my.sharepoint.com:443",nocase; http_uri; content:"/:o:/g/personal/user_monovative_onmicrosoft_com/emczkjnkzgxdtejtstz67qqblknarn4da620kjaje91ewq?e=5:weseg8&amp\;at=9",nocase; classtype:attempted-recon; sid:200007509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"monstercarp.rn86.ru",nocase; http_uri; content:"/dvtygtgvrv.html?ggcdraewqaszxfdxcgchjbjnhbgvfcdrxtcyvbuninhbygtfcrx",nocase; classtype:attempted-recon; sid:200007510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"most-afrikanist.co.za",nocase; http_uri; content:"/.system.info/chasetherednecktothesee.htm",nocase; classtype:attempted-recon; sid:200007511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mundovirtualhabbo.blogspot.com",nocase; http_uri; content:"/2009_01_01_archive.html",nocase; classtype:attempted-recon; sid:200007512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.forms.app",nocase; http_uri; content:"/citizens-2021-grant/extra-pandemic-stimulus-bonus-application-citizens",nocase; classtype:attempted-recon; sid:200007513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.forms.app",nocase; http_uri; content:"/form/60d8ccf87e6c303b0f11e680",nocase; classtype:attempted-recon; sid:200007514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.forms.app",nocase; http_uri; content:"/form/60deff002ca34f5aa4985ab3",nocase; classtype:attempted-recon; sid:200007515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.forms.app",nocase; http_uri; content:"/form/6113e307a3f6e60d5120c56c",nocase; classtype:attempted-recon; sid:200007516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.forms.app",nocase; http_uri; content:"/governmentstimulus1/stimulus",nocase; classtype:attempted-recon; sid:200007517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.forms.app",nocase; http_uri; content:"/robertnunn/pandemic-form",nocase; classtype:attempted-recon; sid:200007518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.forms.app",nocase; http_uri; content:"/uzhainedan/pandemicreliefprogramm",nocase; classtype:attempted-recon; sid:200007519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"my.forms.app",nocase; http_uri; content:"/verifikasi2/verifikasi-facebook",nocase; classtype:attempted-recon; sid:200007520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mymangowallet.com",nocase; http_uri; content:"/wp-content/themes/20/aeon.co.jp/",nocase; classtype:attempted-recon; sid:200007521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myparc.sharepoint.com",nocase; http_uri; content:"/:x:/r/_layouts/15/wopiframe.aspx?guestaccesstoken=xvdowzk%2bkm4wndrziofnpfcj8fb8rkrsqt%2bkybvollg%3d&docid=1_16fb1a2a3e2f9468aa7cebc35874c9da0&wdformid=%7b95111770-0103-492b-8c70-e9625f96b49a%7d&action=formsubmit&cid=4d02a372-8b83-4120-84b5-1d9a2a3492dd",nocase; classtype:attempted-recon; sid:200007522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"myparc.sharepoint.com",nocase; http_uri; content:"/_layouts/15/wopiframe.aspx?guestaccesstoken=xvdowzk%2bkm4wndrziofnpfcj8fb8rkrsqt%2bkybvollg%3d&docid=1_16fb1a2a3e2f9468aa7cebc35874c9da0&wdformid=%7b95111770-0103-492b-8c70-e9625f96b49a%7d&action=formsubmit&cid=4d02a372-8b83-4120-84b5-1d9a2a3492dd",nocase; classtype:attempted-recon; sid:200007523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mysait-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/ebenezer_ajayi_edu_sait_ca/_layouts/15/wopiframe.aspx?guestaccesstoken=y%2bhr1dv9mxgpih7r4y%2f%2fjkhvv1nxdh3imaz%2bmjeumni%3d&docid=1_1ff1eb35301564d1698455e7de780fe7f&wdformid=%7b2b1e75ff%2d4748%2d448a%2db5f7%2d7d4a5138e7f7%7d&action=formsubmit&cid=b8bab67a-6675-4883-8c86-32942813ffb3",nocase; classtype:attempted-recon; sid:200007524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"mysummercamps.com",nocase; http_uri; content:"/forum/for_camp_directors_c3/research_and_learn_f10/bridging_the_gap_at_summer_camp/gforum.cgi?url=http://server.bludomain82.com/~bree2/review/#_&amp\;?hannah.judge@discsystems.co.uk",nocase; classtype:attempted-recon; sid:200007525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"n9.cl",nocase; http_uri; content:"/fc8n7k94eavtmepu2w",nocase; classtype:attempted-recon; sid:200007526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"narinrayan.ir",nocase; http_uri; content:"/o+/",nocase; classtype:attempted-recon; sid:200007527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"narinrayan.ir",nocase; http_uri; content:"/o+/orange.php",nocase; classtype:attempted-recon; sid:200007528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netorg140587-my.sharepoint.com",nocase; http_uri; content:"/:b:/g/personal/david_siteproperty_com/eq8kw97vmw9jkutctnkcbxkbmdwlprnakta1bywrks5-hw?e=vmna6v",nocase; classtype:attempted-recon; sid:200007529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netorg4219258-my.sharepoint.com",nocase; http_uri; content:"/personal/peter_baumanglobal_com/_layouts/15/authenticate.aspx",nocase; classtype:attempted-recon; sid:200007530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netorg5539223-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/ddoris_airservicesco_com/_layouts/15/wopiframe.aspx?guestaccesstoken=%2b3y%2bcdfvdslxx0tgrivwrfjqapqcjfpi%2fnyhmijz6qa%3d&docid=1_1021e11db2d82413ebf54355221c28513&wdformid=%7b5bf1f9e2%2d5212%2d4414%2d8e87%2d9d18071fcce1%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200007531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netorg6600800-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/ginger_gingerfountain_com/_layouts/15/wopiframe.aspx",nocase; classtype:attempted-recon; sid:200007532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netorg6600800-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/ginger_gingerfountain_com/_layouts/15/wopiframe.aspx?guestaccesstoken=gpys8ex7ys1urrzbfeasvlexkodtrovmmcpn%2brsnebs%3d&amp\;docid=1_1882b07b5eb5643d2bdaa63426324ef0e&amp\;wdformid=%7b9bd54af1%2dee16%2d4e07%2d8d62%2d6e9b76e47512%7d&amp\;action=formsubmit&amp\;cid=9adf3e74-8cc1-4e36-b545-c9165fcafde7",nocase; classtype:attempted-recon; sid:200007533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netorg6600800-my.sharepoint.com",nocase; http_uri; content:"/personal/ginger_gingerfountain_com/_layouts/15/wopiframe.aspx?cid=09f38a51-5e01-4ed2-a663-a97e6a0de6bc",nocase; classtype:attempted-recon; sid:200007534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netorg6600800-my.sharepoint.com",nocase; http_uri; content:"/personal/ginger_gingerfountain_com/_layouts/15/wopiframe2.aspx?cid=09f38a51-5e01-4ed2-a663-a97e6a0de6bc",nocase; classtype:attempted-recon; sid:200007535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netorg791425-my.sharepoint.com",nocase; http_uri; content:"/:b:/g/personal/gscaglione_shulmanventures_com/esbu2b9nnzjagf5sh57gkkcbf8xzlqtnsdbogrc9uo_6-w?e=6kdxdd",nocase; classtype:attempted-recon; sid:200007536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netorgft1393773-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/alan_etkinpllc_com/emv9ti9prk1ioco67l0q4eybqcu9jbj--dz3wlksvzg3lg?e=8ainmj",nocase; classtype:attempted-recon; sid:200007537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netorgft2223515-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/leon_leongavartin_com/_layouts/15/wopiframe.aspx?guestaccesstoken=rpanwaz3gooz0d20j9wu7zzskog8p5egpbt4oc5j5bq%3d&docid=1_137b486a2059c4fc7b670d2ddb8f27254&wdformid=%7b07fe213f%2d4079%2d45b9%2db73f%2dfa9809248dd7%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200007538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netorgft2223515-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/leon_leongavartin_com/_layouts/15/wopiframe.aspx?guestaccesstoken=xamh1yie5ztbehymkwldcb6bkcf1kqp13dwjvauswg4%3d&docid=1_10f85e31d21194b00bc5c96bd48a6a4fc&wdformid=%7b702d2762%2df654%2d423b%2dba6b%2d850079f6ed46%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200007539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netorgft7625533-my.sharepoint.com",nocase; http_uri; content:"/personal/service_grandisleties_com/_layouts/15/wopiframe.aspx?guestaccesstoken=pmxhjtsepwbmxi%20afreenyvyn0jrccvcgbqrd0jtcq8=&amp\;docid=1_1e318a834149c47f884752e9315da88d5&amp\;wdformid={21f3b38e-e8d9-4097-be99-0cb952413aff}&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200007540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"netorgft7625533-my.sharepoint.com",nocase; http_uri; content:"/personal/service_grandisleties_com/_layouts/15/wopiframe.aspx?guestaccesstoken=pmxhjtsepwbmxi%2bafreenyvyn0jrccvcgbqrd0jtcq8%3d&docid=1_1e318a834149c47f884752e9315da88d5&wdformid=%7b21f3b38e%2de8d9%2d4097%2dbe99%2d0cb952413aff%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200007541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newsbrigade.com",nocase; http_uri; content:"/wp-admin/css/colors/ocean/js/theme.js/inc-style/grece.paypai-id.pro968/myaccount/identity/?cmd=_session=us&amp\;amp",nocase; classtype:attempted-recon; sid:200007542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newsbrigade.com",nocase; http_uri; content:"/wp-admin/css/colors/ocean/js/theme.js/inc-style/grece.paypai-id.pro968/myaccount/identity/?cmd=_session=us&amp\;d34320f63d56ede7fd814ae4fb903952&amp\;dispatch=28eb2b0dad222b43ece5890ac6c4995f14fbf092",nocase; classtype:attempted-recon; sid:200007543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newsbrigade.com",nocase; http_uri; content:"/wp-admin/css/colors/ocean/js/theme.js/inc-style/grece.paypai-id.pro968/myaccount/identity/?cmd=_session=us&amp\;dispatch=a747fec16e90d03372eec4b410a064f3315fc8ab",nocase; classtype:attempted-recon; sid:200007544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"newsbrigade.com",nocase; http_uri; content:"/wp-admin/css/colors/ocean/js/theme.js/inc-style/grece.paypai-id.pro968/myaccount/identity/?cmd=_session=us&amp\;e74cc56f728f08bf36fd1c917b4a5074&amp\;dispatch=a747fec16e90d03372eec4b410a064f3315fc8ab",nocase; classtype:attempted-recon; sid:200007545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nexoinmobiliario.pe",nocase; http_uri; content:"/bancos/interbank",nocase; classtype:attempted-recon; sid:200007546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nihmt.com",nocase; http_uri; content:"/examination/admitpanel/filemanager/5365678587",nocase; classtype:attempted-recon; sid:200007547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"norcaltc-my.sharepoint.com",nocase; http_uri; content:"/personal/acolon_norcaltc_org/_layouts/15/wopiframe.aspx?guestaccesstoken=yze2svus6et1yfbzbrrbp0zblkd6ftbulrue02wudhw=&amp\;docid=1_1f1c059892dd04acf92bca72fa2b86901&amp\;wdformid={22fa7e1d-2b31-41b8-a33f-0d3a531f6142}&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200007548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nortonknatchbull-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/19besoriob_nks_kent_sch_uk/eml51uxw3yblmb_cng_jobkbjiz5a9svhv-aa1dwwc9xqg?e=ufnvrz",nocase; classtype:attempted-recon; sid:200007549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"norwayposten.blogspot.com",nocase; http_uri; content:"/2021/02/blog-post.html",nocase; classtype:attempted-recon; sid:200007550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"notifications.google.com",nocase; http_uri; content:"/g/p/ad-fnewoykv7bxdxwcwindbnwiagaiska0ktc-amq4ved47kkafwimqdkuxsvsfwoypvkv3sqsjli-gxhi9hynifl7n0cjj1apb3zen_0p9c",nocase; classtype:attempted-recon; sid:200007551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"nullrefer.com",nocase; http_uri; content:"/?https://amazon.co.jp",nocase; classtype:attempted-recon; sid:200007552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"num63rsgroup.com",nocase; http_uri; content:"/?utm_source=10692-14482240068&utm_medium=gid-126116800509&utm_campaign=aid-542738816296&utm_content=&utm_term=youtube.com&pid=tlpgpp&gclid=cjwkcajw7fujbhbdeiwa2llmydhqv9hf_zfukd7-zegpkqbvmughkjkh6hfvxjrslquczgmsbwh1ibocftyqavd_bwe",nocase; classtype:attempted-recon; sid:200007553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oceetee-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/oceetee_oceetee_com_sa/_layouts/15/wopiframe.aspx?guestaccesstoken=5t/v57wosh/zuc+ubbpprapdh5daqzjepxbham/9wjy=&amp\;docid=1_129efcffef3324628b752d1139515937e&amp\;wdformid={0767107a-f265-4239-a58d-79524eada2a7}&amp\;action=formsubmit&amp\;cid=a79ba94e-e9be-4a5f-ba1d-20a889580d1b",nocase; classtype:attempted-recon; sid:200007554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/?authkey=!aiuszyywonlw6wq&amp\;cid=5a1faf0110c4a22c&amp\;id=5a1faf0110c4a22c!1550&amp\;parid=root&amp\;o=oneup",nocase; classtype:attempted-recon; sid:200007555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/?authkey=!aiwjcwhmidrycfe&amp\;cid=6ff30ec047bf7f90&amp\;id=6ff30ec047bf7f90!1118&amp\;parid=root&amp\;o=oneup",nocase; classtype:attempted-recon; sid:200007556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/?authkey=%21abdtnonrfuimmte&cid=8b06262ca3def289&id=8b06262ca3def289%21106&parid=root&o=oneup",nocase; classtype:attempted-recon; sid:200007557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/?authkey=%21aef%2dmh1m1dxpwfq&amp\;cid=62e43ed1e02faa46&amp\;id=62e43ed1e02faa46%2145901&amp\;parid=62e43ed1e02faa46%218744&amp\;o=oneup",nocase; classtype:attempted-recon; sid:200007558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/?authkey=%21ag7v3k%5fv%5fvmx0wu&amp\;cid=2022b4d58b052264&amp\;id=2022b4d58b052264%21709&amp\;parid=root&amp\;o=oneup",nocase; classtype:attempted-recon; sid:200007559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/?authkey=%21ahm9ud6tremilmy&amp\;cid=d3acf7db10258474&amp\;id=d3acf7db10258474%21118&amp\;parid=root&amp\;o=oneup",nocase; classtype:attempted-recon; sid:200007560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=14f03cc1e6238baf&amp\;resid=14f03cc1e6238baf%21109&amp\;authkey=ahztenuziu71bkw",nocase; classtype:attempted-recon; sid:200007561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/download?cid=d91517ba717d8f93&amp\;resid=d91517ba717d8f93%21106&amp\;authkey=aad0mocflqj2d7g",nocase; classtype:attempted-recon; sid:200007562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/embed?cid=8c6ac597cdb8f3ca&amp\;resid=8c6ac597cdb8f3ca%216662&amp\;authkey=abbvyhcqvxnyk7a&amp\;em=2",nocase; classtype:attempted-recon; sid:200007563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/redir?resid=15d888f2c88e7d68%21104&amp\;authkey=%21alapi82fus8uhw8&amp\;page=view&amp\;wd=target%28martco.one%7c248982a3-c6db-4608-9b3f-59d46f4a8f11%2fdan%20shared%20a%20file%20with%20you%7c85b5e37c-8918-4d14-b5a0-0742bfe487b0%2f%29",nocase; classtype:attempted-recon; sid:200007564; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/redir?resid=1b259cec1257165d%21143&authkey=%21apkdm5ellcpwz_w&page=view&wd=target%28quick%20notes.one%7c70d4ff33-5389-4385-b3e5-751c2cf1989e%2frau%20construction%7c961392e9-1ab5-4334-9d52-69d0f17f7c4c%2f%29",nocase; classtype:attempted-recon; sid:200007565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/redir?resid=7aa7bb4172c9678d%21104&authkey=%21ancnqdf2mi0o4bs&page=view&wd=target%28untitled%20section.one%7c78a1f9ff-7561-4169-a2f1-2b4bfce0e5d2%2fbusiness%20insurance%20services%2c%20inc.%7cb909bc92-cd18-491c-afbb-8e0537ffd3ed%2f%29",nocase; classtype:attempted-recon; sid:200007566; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/redir?resid=85c38ec07aa8c9eb%21104&amp\;authkey=%21akfbbhbpqjalrag&amp\;page=edit&amp\;wd=target%28king%20plastic%20corporation.one%7c74227ab3-5b67-4fed-aee8-c6ec5625e330%2fmichael%20fabbri%20has%20shared%20a%20file%20with%20you%7c5ea49da5-4656-4a44-a813-5b186327c32f%2f%29",nocase; classtype:attempted-recon; sid:200007567; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/redir?resid=a37258a5832f32b8%214551&authkey=%21ah-prmdnyc6z-he&page=view&wd=target%28quick%20notes.one%7c4617bc2b-8a69-4e83-9b28-fdc3f0e092a4%2freview%20document%20no.%20clt9071825%7ca63f7492-3a53-4740-8ff8-743d2bf58dd0%2f%29",nocase; classtype:attempted-recon; sid:200007568; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/redir?resid=cc542b30a231222a%21104&authkey=%21aagyx6eylxtvs0i&page=view&wd=target%28southwest%20funding.one%7cdb02ff26-a000-4a11-a770-a766574c7395%2feric%20barefoot%c2%a0has%20shared%20a%20file%20with%20you%7cbbd45792-c84c-4ac7-b2f5-1368247a21f4%2f%29",nocase; classtype:attempted-recon; sid:200007569; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/redir?resid=f224e40f244f69d%213603&authkey=%21aa0etofrovbzrds&page=view&wd=target%28quick%20notes.one%7cef3efdee-f2ab-465b-af63-7c751f8ee737%2feddie%20winfrey%20has%20shared%20a%20document%20with%20you%7c2c2aaad0-b64f-4424-9eed-b8e299fa1177%2f%29",nocase; classtype:attempted-recon; sid:200007570; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/redir?resid=f950f8718f3413f!139&authkey=!abm4jclf3vh4_ea&ithint=file%2cxlsx&page=survey&wdformid=8786a7d4-f24e-494d-a981-ec4d7be22b99",nocase; classtype:attempted-recon; sid:200007571; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/view.aspx?resid=165bfee39105d588!1450&amp\;wdo=2&amp\;authkey=!ahdxqiyo1wxtypa",nocase; classtype:attempted-recon; sid:200007572; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/view.aspx?resid=2ccda0f55e51c04d!1056&amp\;authkey=!ahvxdmahsk9xqic",nocase; classtype:attempted-recon; sid:200007573; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/view.aspx?resid=357cf596b048e521!68171&amp\;ithint=onenote%2c&amp\;authkey=!agrjg_pgegj6peq",nocase; classtype:attempted-recon; sid:200007574; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/view.aspx?resid=63d34a02fb9cbdc0!830&amp\;ithint=onenote%2c&amp\;wdo=2&amp\;authkey=!agdcipgpa9o5uw8",nocase; classtype:attempted-recon; sid:200007575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/view.aspx?resid=b116b3793040630b!5852&amp\;ithint=onenote%2c&amp\;authkey=!altmjf-4bzb1ygu",nocase; classtype:attempted-recon; sid:200007576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onedrive.live.com",nocase; http_uri; content:"/view.aspx?resid=b730f58852aff932!139&amp\;ithint=onenote%2c&amp\;wdo=2&amp\;authkey=!aul7udqhfptgafm",nocase; classtype:attempted-recon; sid:200007577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online.visual-paradigm.com",nocase; http_uri; content:"/app/forms/view/dssmibyk/789c19c6-58f7-4a39-8cf3-62e4f13c605a",nocase; classtype:attempted-recon; sid:200007578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online.visual-paradigm.com",nocase; http_uri; content:"/app/forms/view/dxhotnbj/aad0ff1e-c90d-487c-a28d-f07b0d303e5c",nocase; classtype:attempted-recon; sid:200007579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online.visual-paradigm.com",nocase; http_uri; content:"/app/forms/view/jqliidcl/29c78a95-ff7d-42a0-9cef-43118693b879",nocase; classtype:attempted-recon; sid:200007580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online.visual-paradigm.com",nocase; http_uri; content:"/app/forms/view/lvswydoz/f4123832-7b09-4ac6-bbfc-9fde28e728c4",nocase; classtype:attempted-recon; sid:200007581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"online.visual-paradigm.com",nocase; http_uri; content:"/app/forms/view/zalxyved/a9adea36-d163-4d46-a3de-0e990d86e78e",nocase; classtype:attempted-recon; sid:200007582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlinehalifax-account.com",nocase; http_uri; content:"/halifax",nocase; classtype:attempted-recon; sid:200007583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"onlinehalifax-account.com",nocase; http_uri; content:"/halifax/login.php",nocase; classtype:attempted-recon; sid:200007584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"optusnet-com.blogspot.com",nocase; http_uri; content:"/?m=1",nocase; classtype:attempted-recon; sid:200007585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"oraclemart.com",nocase; http_uri; content:"/ondedrive/onedrive/rolex/index.php",nocase; classtype:attempted-recon; sid:200007586; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"orsted-refund.blogspot.com",nocase; http_uri; content:"/2021/08/rsted.html",nocase; classtype:attempted-recon; sid:200007587; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"otvbhu.top",nocase; http_uri; content:"/py6x3b8n/dbs-wa/",nocase; classtype:attempted-recon; sid:200007588; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ouraring-my.sharepoint.com",nocase; http_uri; content:"/personal/tanja_kuusela_ouraring_com/_layouts/15/doc.aspx?sourcedoc",nocase; classtype:attempted-recon; sid:200007589; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ouraring-my.sharepoint.com",nocase; http_uri; content:"/personal/tanja_kuusela_ouraring_com/_layouts/15/doc.aspx?sourcedoc={6dfd36f7-86e9-46d3-b9cc-33ba7e8a7540}&amp\;action=default&amp\;slrid=4a49409f-2030-2000-55c3-0f6b60771e27&amp\;originalpath=ahr0chm6ly9vdxjhcmluzy1tes5zagfyzxbvaw50lmnvbs86bzovcc90yw5qyv9rdxvzzwxhl0v2yzjfvznwahror3vjd3p1bjzlzfvbqm9nd1yxegftx05ly3h6ekxkbvhruue_cnrpbwu9ylp0ujd2tewxmgc&amp\;cid=18ed1537-8fab-4a88-9a51-f62af2ba3e85",nocase; classtype:attempted-recon; sid:200007590; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ouraring-my.sharepoint.com",nocase; http_uri; content:"/personal/tanja_kuusela_ouraring_com/_layouts/15/doc.aspx?sourcedoc={6dfd36f7-86e9-46d3-b9cc-33ba7e8a7540}&amp\;action=default&amp\;slrid=7448409f-907f-2000-55b9-8b3856a492d0&amp\;originalpath=ahr0chm6ly9vdxjhcmluzy1tes5zagfyzxbvaw50lmnvbs86bzovcc90yw5qyv9rdxvzzwxhl0v2yzjfvznwahror3vjd3p1bjzlzfvbqm9nd1yxegftx05ly3h6ekxkbvhruue_cnrpbwu9bjdxazvqrewxmgc&amp\;cid=17aea50f-0cad-4a24-8ca6-2b3aba94e944",nocase; classtype:attempted-recon; sid:200007591; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ouraring-my.sharepoint.com",nocase; http_uri; content:"/personal/tanja_kuusela_ouraring_com/_layouts/15/doc.aspx?sourcedoc={6dfd36f7-86e9-46d3-b9cc-33ba7e8a7540}&amp\;action=default&amp\;slrid=e3083d9f-70d3-2000-e93a-b2a109d8122f&amp\;originalpath=ahr0chm6ly9vdxjhcmluzy1tes5zagfyzxbvaw50lmnvbs86bzovcc90yw5qyv9rdxvzzwxhl0v2yzjfvznwahror3vjd3p1bjzlzfvbqm9nd1yxegftx05ly3h6ekxkbvhruue_cnrpbwu9mnjsznrbteuxmgc&amp\;cid=ce3f6183-644d-4c2c-b9c5-e59d8ec48d03",nocase; classtype:attempted-recon; sid:200007592; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ouraring-my.sharepoint.com",nocase; http_uri; content:"/personal/tanja_kuusela_ouraring_com/_layouts/15/doc.aspx?sourcedoc={6dfd36f7-86e9-46d3-b9cc-33ba7e8a7540}&amp\;action=default&amp\;slrid=e5083d9f-a047-2000-523d-f23a7ab7042b&amp\;originalpath=ahr0chm6ly9vdxjhcmluzy1tes5zagfyzxbvaw50lmnvbs86bzovcc90yw5qyv9rdxvzzwxhl0v2yzjfvznwahror3vjd3p1bjzlzfvbqm9nd1yxegftx05ly3h6ekxkbvhruue_cnrpbwu9tvlqc3r3teuxmgc&amp\;cid=06a207b4-652a-4300-9385-5d89a890e4fe",nocase; classtype:attempted-recon; sid:200007593; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ow.ly",nocase; http_uri; content:"/lcqx30cdfcg",nocase; classtype:attempted-recon; sid:200007594; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"padlet-uploads.storage.googleapis.com",nocase; http_uri; content:"/610964646/d0a82b340ac6b4eb2fed334399fe2e84/palad.html",nocase; classtype:attempted-recon; sid:200007595; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"parmacityschooldistrict-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/rosee_parmacityschools_org/_layouts/15/wopiframe.aspx?guestaccesstoken=amgmrypee2b3%2fq5mcsf%2bmqat2vaamt9idaj1njxwdpe%3d&amp\;docid=1_1514e14043e894d289ec8998e5536118b&amp\;wdformid=%7beb853daf%2d5ba6%2d40dd%2dbf99%2d970f5cf41327%7d&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200007596; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"parnamg.info",nocase; http_uri; content:"/index.php",nocase; classtype:attempted-recon; sid:200007597; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/25qk2",nocase; classtype:attempted-recon; sid:200007598; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/26c30",nocase; classtype:attempted-recon; sid:200007599; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/26dcc",nocase; classtype:attempted-recon; sid:200007600; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/26e8w",nocase; classtype:attempted-recon; sid:200007601; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/278zi",nocase; classtype:attempted-recon; sid:200007602; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/27tk1",nocase; classtype:attempted-recon; sid:200007603; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/2884c",nocase; classtype:attempted-recon; sid:200007604; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/28eek",nocase; classtype:attempted-recon; sid:200007605; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/2980b",nocase; classtype:attempted-recon; sid:200007606; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/29igl",nocase; classtype:attempted-recon; sid:200007607; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/29jzn",nocase; classtype:attempted-recon; sid:200007608; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/29n5y",nocase; classtype:attempted-recon; sid:200007609; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/29vnj",nocase; classtype:attempted-recon; sid:200007610; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/2a9kr",nocase; classtype:attempted-recon; sid:200007611; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/2ae9m",nocase; classtype:attempted-recon; sid:200007612; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/2ae9x",nocase; classtype:attempted-recon; sid:200007613; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/2amyg",nocase; classtype:attempted-recon; sid:200007614; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/2btlc",nocase; classtype:attempted-recon; sid:200007615; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/2bxht",nocase; classtype:attempted-recon; sid:200007616; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/2c1g8",nocase; classtype:attempted-recon; sid:200007617; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pastelink.net",nocase; http_uri; content:"/2c396",nocase; classtype:attempted-recon; sid:200007618; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"patrickkestens-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/patrick_kestens_kepa_be/ek6ptmfi3rbpl0okvukyovobz5voxh1dgbqr66js29e06w?e=zytfn9",nocase; classtype:attempted-recon; sid:200007619; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"patrickkestens-my.sharepoint.com",nocase; http_uri; content:"/personal/patrick_kestens_kepa_be/_layouts/15/doc.aspx?sourcedoc={c74ca94e-dee2-4fb0-9743-a4bd4932395a}&amp\;action=default&amp\;slrid=53537f9f-8020-2000-6402-9094cd7180b6&amp\;originalpath=ahr0chm6ly9wyxryawnra2vzdgvucy1tes5zagfyzxbvaw50lmnvbs86bzovzy9wzxjzb25hbc9wyxryawnrx2tlc3rlbnnfa2vwyv9izs9fazzwve1matnyqlbsme9rdlvreu9wb0janvzvwggxredicvi2nkptmjllmdz3p3j0aw1lpun2vwfidhbsmkvn&amp\;cid=3dd22632-4961-431e-befd-a875d08cde81",nocase; classtype:attempted-recon; sid:200007620; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-inc-userupdatenuber7925570844.blogspot.com",nocase; http_uri; content:"/2021/02/blog-post.html",nocase; classtype:attempted-recon; sid:200007621; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypal-my.sharepoint.com",nocase; http_uri; content:"/personal/keyu_paypal_com/documents/delivering%20certainty%20presentation/delivering%20certainty%20roadmap%20presentation%204.18.19%20v11%20(shared).pptx",nocase; classtype:attempted-recon; sid:200007622; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypalvsgooglecheckout.com",nocase; http_uri; content:"/countries",nocase; classtype:attempted-recon; sid:200007623; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"paypalvsgooglecheckout.com",nocase; http_uri; content:"/countries/",nocase; classtype:attempted-recon; sid:200007624; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pbox.photobox.co.uk",nocase; http_uri; content:"/dynclick/photobox-uk/?eml-publisher=photobox-uk&amp\;eml-name=phx_t_uk_new_crn_e2_bau_all&amp\;uid=67912768&amp\;eurl=http://photobox-mkt-prod1-t.campaign.adobe.com/r/?id=h4e5ec0b9,69a17086,5eb6e68f&amp\;utm_source=photobox&amp\;utm_medium=email&amp\;utm_campaign=t_all_w26_20200623_uk_crn_tips-and-trading-plan_2_bau_ac1982206_web_1772187782&amp\;_c1v=crm&amp\;_c2v=trigger&amp\;_c3v=creation&amp\;_c4id=1982206&amp\;_c5id=1772187782&amp\;_c6id=all&amp\;_c7id=acc&amp\;_cdt=2020-06-23&amp\;_ceh=b79bed2958568ab17f18979440690c16a1c6f09f5afc870aacd7ecb1e408488c&amp\;_cleh=b79bed2958568ab17f18979440690c16a1c6f09f5afc870aacd7ecb1e408488c&amp\;p1=ak-x.shop/?e=zg91z2xhc0btewnvbxbhbnltywdhemluzs5jb20=%23/my/creations",nocase; classtype:attempted-recon; sid:200007625; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pepsicola1-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/rmutyaba_pepsi-cola_co_ug/_layouts/15/wopiframe.aspx?guestaccesstoken=q1xrx9cq6omueu0gw5ech36jcmrq7yl45zuzcxjws54%3d&amp\;docid=1_182d7ec9b7ef240e7b33e879a44314f92&amp\;wdformid=%7b0692719f%2d1981%2d4f26%2db7cd%2da0e252746cb1%7d&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200007626; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"permajacktulsa.com",nocase; http_uri; content:"/ahogan@zookfarmequipment.com_invoice104603_open_onedriveportal/updated_drive_shared_securely_online%20-%20copy",nocase; classtype:attempted-recon; sid:200007627; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"permajacktulsa.com",nocase; http_uri; content:"/ahogan@zookfarmequipment.com_invoice104603_open_onedriveportal/updated_drive_shared_securely_online%20-%20copy/",nocase; classtype:attempted-recon; sid:200007628; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pesc.pw",nocase; http_uri; content:"/amazon-jp",nocase; classtype:attempted-recon; sid:200007629; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"phynxzit.com",nocase; http_uri; content:"/covidapprove/attachment%20name%2020210312_2049.pdf.html",nocase; classtype:attempted-recon; sid:200007630; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pinkoliveentertainment.com",nocase; http_uri; content:"/wp-messages/css/login.htm?email=&amp\;email&amp\;",nocase; classtype:attempted-recon; sid:200007631; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pinkoliveentertainment.com",nocase; http_uri; content:"/wp-messages/passport%20alibaba/index.html",nocase; classtype:attempted-recon; sid:200007632; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pinkoliveentertainment.com",nocase; http_uri; content:"/wp-messages/passport%20alibaba/index.html?email=&amp\;email&amp\;flag=isle&amp\;tracelog=edmfooter&amp\;biz_type=&amp\;crm_mtn_tracelog_template=200412047&amp\;crm_mtn_tracelog_task_id=a72ad2ca-ce11-4a70-b2e8-76fb3ff77ddc&amp\;crm_mtn_tracelog_from_sys=service_feedback&amp\;crm_mtn_tracelog_log_id=15532788161",nocase; classtype:attempted-recon; sid:200007633; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pinkoliveentertainment.com",nocase; http_uri; content:"/wp-messages/passport%20alibaba/index.html?email=&amp\;email&amp\;tracelog=notification20160310&amp\;biz_type=&amp\;crm_mtn_tracelog_template=200412047&amp\;crm_mtn_tracelog_task_id=a72ad2ca-ce11-4a70-b2e8-76fb3ff77ddc&amp\;crm_mtn_tracelog_from_sys=service_feedback&amp\;crm_mtn_tracelog_log_id=15532788161",nocase; classtype:attempted-recon; sid:200007634; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pinkoliveentertainment.com",nocase; http_uri; content:"/wp-messages/passport%20alibaba/index.html?email=&amp\;email&amp\;tracelog=notificationtips2016310&amp\;biz_type=&amp\;crm_mtn_tracelog_template=200412047&amp\;crm_mtn_tracelog_task_id=a72ad2ca-ce11-4a70-b2e8-76fb3ff77ddc&amp\;crm_mtn_tracelog_from_sys=service_feedback&amp\;crm_mtn_tracelog_log_id=15532788161",nocase; classtype:attempted-recon; sid:200007635; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pinkoliveentertainment.com",nocase; http_uri; content:"/wp-messages/passport%20alibaba/index.html?email=&amp\;email&amp\;url_type=footer_privacy&amp\;biz_type=&amp\;crm_mtn_tracelog_template=200412047&amp\;crm_mtn_tracelog_task_id=a72ad2ca-ce11-4a70-b2e8-76fb3ff77ddc&amp\;crm_mtn_tracelog_from_sys=service_feedback&amp\;crm_mtn_tracelog_log_id=15532788161",nocase; classtype:attempted-recon; sid:200007636; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pinkoliveentertainment.com",nocase; http_uri; content:"/wp-messages/passport%20alibaba/index.html?email=&amp\;email&amp\;url_type=footer_term&amp\;biz_type=&amp\;crm_mtn_tracelog_template=200412047&amp\;crm_mtn_tracelog_task_id=a72ad2ca-ce11-4a70-b2e8-76fb3ff77ddc&amp\;crm_mtn_tracelog_from_sys=service_feedback&amp\;crm_mtn_tracelog_log_id=15532788161",nocase; classtype:attempted-recon; sid:200007637; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pinkoliveentertainment.com",nocase; http_uri; content:"/wp-messages/passport%20alibaba/index.html?url_type=header_homepage&amp\;biz_type=&amp\;crm_mtn_tracelog_template=200412047&amp\;crm_mtn_tracelog_task_id=a72ad2ca-ce11-4a70-b2e8-76fb3ff77ddc&amp\;crm_mtn_tracelog_from_sys=service_feedback&amp\;crm_mtn_tracelog_log_id=15532788161",nocase; classtype:attempted-recon; sid:200007638; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plytecfi-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/pasi_puumalainen_plytec_fi/eviubi-o5_rgorvtg1ptinyb5th9mqv-2ev_l8ujkorojg?e=5%3a8603ib&at=9",nocase; classtype:attempted-recon; sid:200007639; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"plytecfi-my.sharepoint.com",nocase; http_uri; content:"/personal/pasi_puumalainen_plytec_fi/_layouts/15/wopiframe.aspx?sourcedoc={8f0414f2-e7a8-46f4-a2bb-d38353ed20d6}&amp\;action=default&amp\;originalpath=ahr0chm6ly9wbhl0zwnmas1tes5zagfyzxbvaw50lmnvbs86bzovzy9wzxjzb25hbc9wyxnpx3b1dw1hbgfpbmvux3bsexrly19mas9fdklvqkktbzvfukdvcnzuzzfqdelowui1vgg5bxf2ltjlvl9mohvka09sb2pnp3j0aw1lpxvysjgtvnb2mtbn",nocase; classtype:attempted-recon; sid:200007640; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"policyfest.com",nocase; http_uri; content:"/logs/sup/index.php",nocase; classtype:attempted-recon; sid:200007641; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"policyfest.com",nocase; http_uri; content:"/verify",nocase; classtype:attempted-recon; sid:200007642; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pomoc.o2.pl",nocase; http_uri; content:"/polityka-prywatnosci",nocase; classtype:attempted-recon; sid:200007643; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"portal.mailsphere.co.uk",nocase; http_uri; content:"/archives/%3c17bb1b72.aa4aabambdsaachbnjiaaagn5iaaaaaajbganduyabbhkabgnaaw%40mailjet.com%3e%7cxntjjt7d%2bpgxnycpm8zjag%3d%3d",nocase; classtype:attempted-recon; sid:200007644; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"post-office-delivery-support.com",nocase; http_uri; content:"/postal/index?id=252f1349dc6b82ca7c374e9a4ca35e71252f1349dc6b82ca7c374e9a4ca35e71&amp\;session=252f1349dc6b82ca7c374e9a4ca35e71252f1349dc6b82ca7c374e9a4ca35e71",nocase; classtype:attempted-recon; sid:200007645; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"powr.io",nocase; http_uri; content:"/form-builder/i/28221802",nocase; classtype:attempted-recon; sid:200007646; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"powr.io",nocase; http_uri; content:"/form-builder/i/28221802#page",nocase; classtype:attempted-recon; sid:200007647; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"powr.io",nocase; http_uri; content:"/form-builder/i/29149732#page",nocase; classtype:attempted-recon; sid:200007648; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"powr.io",nocase; http_uri; content:"/form-builder/i/29291212#page",nocase; classtype:attempted-recon; sid:200007649; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"predirect.net",nocase; http_uri; content:"/kd_nz/?show_pop=1&amp\;pname=bitcoin%20code&amp\;affiliate_id=1864&amp\;offer_id=104&amp\;sys_id=1&amp\;aff_sub=466491&amp\;aff_sub2=15402544&amp\;aff_sub3=466491&amp\;aff_sub4=5ecb81115fbe34549af602a570d1ab6e&amp\;aff_sub5=1454474&amp\;source=adsterra_41&amp\;entity=super",nocase; classtype:attempted-recon; sid:200007650; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"principleclinic.com",nocase; http_uri; content:"/cil/wells%20fargo%20page/wells/home.html?vhx1r8suq9qojvdjjyoqlexdfiftfbri67ntirpm4nf5quus63doiprls2iwgisjywpmsecdrbkhadzdrg6mziqxws0t4mdpz01r0mbdgsrjolhuiizeb805fvsol3lxb8avf=",nocase; classtype:attempted-recon; sid:200007651; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"privatewealth.academy",nocase; http_uri; content:"/elite-tax-secrets?affiliate_id=3264153",nocase; classtype:attempted-recon; sid:200007652; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=1rt3s",nocase; classtype:attempted-recon; sid:200007653; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=4j21b",nocase; classtype:attempted-recon; sid:200007654; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=bt-broadband-and-private-policy-support_2",nocase; classtype:attempted-recon; sid:200007655; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=bt-broadband-and-private-policy-support_20",nocase; classtype:attempted-recon; sid:200007656; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=bt-broadband-and-private-policy-support_9",nocase; classtype:attempted-recon; sid:200007657; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=bt-broadband-uk",nocase; classtype:attempted-recon; sid:200007658; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=bt-broadband_1",nocase; classtype:attempted-recon; sid:200007659; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=bt-broardband-services",nocase; classtype:attempted-recon; sid:200007660; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=diaa0",nocase; classtype:attempted-recon; sid:200007661; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=hiatb",nocase; classtype:attempted-recon; sid:200007662; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=what-is-the-usage-policy-for-bt-email_2",nocase; classtype:attempted-recon; sid:200007663; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=x5wo8",nocase; classtype:attempted-recon; sid:200007664; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proprofs.com",nocase; http_uri; content:"/survey/t/?title=xnvq4",nocase; classtype:attempted-recon; sid:200007665; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"protect2.fireeye.com",nocase; http_uri; content:"/url?k=1d4614ec17334d4a.1d465a2d-45b66b5f372e82c4&amp\;u=http://www.standrew.co.kr/bluead/editor/uploaded/img/caslog1/cas.auth.sc.edu/uofsc.html",nocase; classtype:attempted-recon; sid:200007666; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proxima-net.com",nocase; http_uri; content:"/0193/webscr",nocase; classtype:attempted-recon; sid:200007667; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"proxima-net.com",nocase; http_uri; content:"/0193/webscr/",nocase; classtype:attempted-recon; sid:200007668; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pse.is",nocase; http_uri; content:"/amazon_co_jp",nocase; classtype:attempted-recon; sid:200007669; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pub43.bravenet.com",nocase; http_uri; content:"/emailfwd/show.php?usernum=3669541711&amp\;formid=3811",nocase; classtype:attempted-recon; sid:200007670; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pxlme.me",nocase; http_uri; content:"/eg8osty0/",nocase; classtype:attempted-recon; sid:200007671; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pxlme.me",nocase; http_uri; content:"/pfbgzhkd",nocase; classtype:attempted-recon; sid:200007672; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"pxlme.me",nocase; http_uri; content:"/umjjyvmr",nocase; classtype:attempted-recon; sid:200007673; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qare.nl",nocase; http_uri; content:"/0/?i=i&amp\;0=info@google.com",nocase; classtype:attempted-recon; sid:200007674; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qualitasc-my.sharepoint.com",nocase; http_uri; content:"/personal/lrodriguez_qualita_es/_layouts/15/wopiframe.aspx?guestaccesstoken=x6egjunw ncgnemfdqjrmoajqkuc9c41sq13edqfoeu=&amp\;docid=1_16dc35173dd06466fa8c37e332833f0bd&amp\;wdformid={67d0feef-08d4-4d0a-8a25-0d2c9b0a2eed}/&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200007675; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qualitasc-my.sharepoint.com",nocase; http_uri; content:"/personal/lrodriguez_qualita_es/_layouts/15/wopiframe.aspx?guestaccesstoken=x6egjunw%2bncgnemfdqjrmoajqkuc9c41sq13edqfoeu%3d&docid=1_16dc35173dd06466fa8c37e332833f0bd&wdformid=%7b67d0feef%2d08d4%2d4d0a%2d8a25%2d0d2c9b0a2eed%7d%2f&action=formsubmit",nocase; classtype:attempted-recon; sid:200007676; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qualitasc-my.sharepoint.com",nocase; http_uri; content:"/personal/lrodriguez_qualita_es/_layouts/15/wopiframe.aspx?guestaccesstoken=x6egjunw%2bncgnemfdqjrmoajqkuc9c41sq13edqfoeu%3d&docid=1_16dc35173dd06466fa8c37e332833f0bd&wdformid=%7b67d0feef%2d08d4%2d4d0a%2d8a25%2d0d2c9b0a2eed%7d%3e%2f&action=formsubmit",nocase; classtype:attempted-recon; sid:200007677; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"qualitasc-my.sharepoint.com",nocase; http_uri; content:"/personal/lrodriguez_qualita_es/_layouts/15/wopiframe.aspx?guestaccesstoken=x6egjunw%2bncgnemfdqjrmoajqkuc9c41sq13edqfoeu%3d&docid=1_16dc35173dd06466fa8c37e332833f0bd&wdformid=%7b67d0feef%2d08d4%2d4d0a%2d8a25%2d0d2c9b0a2eed%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200007678; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"quip.com",nocase; http_uri; content:"/qv7malu8n7cz/you-have-some-messages-pending",nocase; classtype:attempted-recon; sid:200007679; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r.smore.com",nocase; http_uri; content:"/c?u=https://yanamholidays.com/b00-b26n5-82m-c04b-o84v-13h-e66-t38e-c90?m5=eric.stockland@iextrading.com",nocase; classtype:attempted-recon; sid:200007680; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r2.dotdigital-pages.com",nocase; http_uri; content:"/p/74kv-45k",nocase; classtype:attempted-recon; sid:200007681; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r3g34.fra1.digitaloceanspaces.com",nocase; http_uri; content:"/77ll23ween.html",nocase; classtype:attempted-recon; sid:200007682; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"r3qp3rcsrrch044psduser.sgp1.digitaloceanspaces.com",nocase; http_uri; content:"/index.html",nocase; classtype:attempted-recon; sid:200007683; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rabofree.blogspot.com",nocase; http_uri; content:"/2020/05",nocase; classtype:attempted-recon; sid:200007684; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rabofree.blogspot.com",nocase; http_uri; content:"/2020/05?m=1",nocase; classtype:attempted-recon; sid:200007685; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rabofree.blogspot.com",nocase; http_uri; content:"/2020?m=1",nocase; classtype:attempted-recon; sid:200007686; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"read-38224786.ht-egypt.com",nocase; http_uri; content:"/gate.html?location=4a27a26a8cadcc4f91bb4ef0b17bc4e2",nocase; classtype:attempted-recon; sid:200007687; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"read-84014482.ht-egypt.com",nocase; http_uri; content:"/gate.html?location=26e7e69de4f4497d88ff3883bdcdfea4",nocase; classtype:attempted-recon; sid:200007688; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/3ads20",nocase; classtype:attempted-recon; sid:200007689; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/4yc7w4o",nocase; classtype:attempted-recon; sid:200007690; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/668b5",nocase; classtype:attempted-recon; sid:200007691; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/8k8kt",nocase; classtype:attempted-recon; sid:200007692; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/96s871",nocase; classtype:attempted-recon; sid:200007693; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/a7n4y3x",nocase; classtype:attempted-recon; sid:200007694; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/ahcz51u",nocase; classtype:attempted-recon; sid:200007695; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/w1lrupp",nocase; classtype:attempted-recon; sid:200007696; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/wjqi04k",nocase; classtype:attempted-recon; sid:200007697; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/z83ig2n?rb.routing.mode=proxy&amp\;rb.routing.signature=123 836",nocase; classtype:attempted-recon; sid:200007698; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/zikqv8f?email=eimaste@stinpriza.org&amp\;domain=stinpriza.orgwebapp*",nocase; classtype:attempted-recon; sid:200007699; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rebrand.ly",nocase; http_uri; content:"/zitln6v",nocase; classtype:attempted-recon; sid:200007700; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redelivery.grupouniprint.com.br",nocase; http_uri; content:"/dhl/index.php",nocase; classtype:attempted-recon; sid:200007701; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redelivery.grupouniprint.com.br",nocase; http_uri; content:"/dhl/info.php",nocase; classtype:attempted-recon; sid:200007702; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redirect.viglink.com",nocase; http_uri; content:"/?ed&amp\;key=fd5de1d096b38be9fffd6ddc1948df4f&amp\;u=%61%70%69%2e%61%64%64%74%68%69%73%2e%63%6f%6d%2f%6f%65%78%63%68%61%6e%67%65%2f%30%2e%38%2f%77%72%61%70%2f%6f%70%65%6e%67%72%61%70%68%e2%80%8c%75%72%6c%3dahr0chm6ly9ua3yuchvil3h5nt9sdwvlchpyanvtegtvdnpjzxhqehn2dgdnzm5hbhntewp3bwtwdnb0cxl2awvozxnjewnvdxvkywzkcm9za2tqamviyxpnjmfsdd1tzwrpysnkmlzpyldgemrhvnlrr04xym1rdvkzbz0=",nocase; classtype:attempted-recon; sid:200007703; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redirect.voici-news.fr",nocase; http_uri; content:"/p-351075-95303b56fd8597a1946dc433811ae477-239262-78/?cl=1&amp\;n=39&amp\;l=o&amp\;u=https%3a%2f%2fwww.google.com%2furl%3fsa%3dt%26rct%3dj%26q%3d%26esrc%3ds%26source%3dweb%26cd%3d%26cad%3drja%26uact%3d8%26ved%3d2ahukewiz1pcljixqahweoxekhqkhbggqfjacegqiarab%26url%3dhttps%253a%252f%252fwww.lab4rent.it%252fofferte%252fhonda-sh-150-abs-bauletto-e-parabrezza%252f%26usg%3daovvaw0uufychhtdy_ozq1pxdtip",nocase; classtype:attempted-recon; sid:200007704; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redlinerecruitment353-my.sharepoint.com:443",nocase; http_uri; content:"/:o:/g/personal/beverley_latham_redlinerecruitment_com/elyngikq5ufbqvwgcsqwtt4b1njgntt_lj45lr_y-735iw?e=5%3ajitv78&amp\;at=9",nocase; classtype:attempted-recon; sid:200007705; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"redlinerecruitment353-my.sharepoint.com:443",nocase; http_uri; content:"/:o:/g/personal/beverley_latham_redlinerecruitment_com/elyngikq5ufbqvwgcsqwtt4b1njgntt_lj45lr_y-735iw?e=5:jitv78&amp\;at=9",nocase; classtype:attempted-recon; sid:200007706; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"registroslbknet.com",nocase; http_uri; content:"/cliente",nocase; classtype:attempted-recon; sid:200007707; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reurl.cc",nocase; http_uri; content:"/1xrr1y",nocase; classtype:attempted-recon; sid:200007708; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reurl.cc",nocase; http_uri; content:"/brkoqe",nocase; classtype:attempted-recon; sid:200007709; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reurl.cc",nocase; http_uri; content:"/dvk4gd",nocase; classtype:attempted-recon; sid:200007710; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reurl.cc",nocase; http_uri; content:"/gvjolp?co=muj3e",nocase; classtype:attempted-recon; sid:200007711; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reurl.cc",nocase; http_uri; content:"/jdegy2",nocase; classtype:attempted-recon; sid:200007712; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reurl.cc",nocase; http_uri; content:"/oleeqj",nocase; classtype:attempted-recon; sid:200007713; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reurl.cc",nocase; http_uri; content:"/qd7na2",nocase; classtype:attempted-recon; sid:200007714; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"reurl.cc",nocase; http_uri; content:"/xgmxr1",nocase; classtype:attempted-recon; sid:200007715; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rezwanit.com",nocase; http_uri; content:"/telekom/",nocase; classtype:attempted-recon; sid:200007716; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rhinodriedfruit.co.za",nocase; http_uri; content:"/xwixwixwixwi",nocase; classtype:attempted-recon; sid:200007717; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rhinodriedfruit.co.za",nocase; http_uri; content:"/xwixwixwixwi/",nocase; classtype:attempted-recon; sid:200007718; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"riderctposten.blogspot.com",nocase; http_uri; content:"/2021/02/blog-post.html",nocase; classtype:attempted-recon; sid:200007719; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rmact-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/srichlin_rmact_com/_layouts/15/wopiframe.aspx?guestaccesstoken=492wqqtzlbznzq7qdpemrme%2bi%2bhghqqnqlo250fbc9i%3d&docid=1_10c4e2ffbd9ec47cbbc6f0253baa7b64d&wdformid=%7b914c12ed%2d68e0%2d4419%2db8b0%2ded5f7e09de29%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200007720; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roldanlogistica2-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/comercial1_rolcoshipping_com1/eruuxky76yxlk7vzdfzrfzybicm0kmv7-914pwcpo9g4mq?e=ppogt",nocase; classtype:attempted-recon; sid:200007721; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ronigelo.blogspot.com",nocase; http_uri; content:"/2020/10/roni-gelo.html",nocase; classtype:attempted-recon; sid:200007722; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"rotf.lol",nocase; http_uri; content:"/verifikasifacebook",nocase; classtype:attempted-recon; sid:200007723; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"roxburycommunitycolleg798-my.sharepoint.com:443",nocase; http_uri; content:"/:b:/g/personal/enebelitsky_rcc_mass_edu/er4mnitiqezdprvsiljksn4bexpjqkfwl8c3bunhudv4ww?e=4%3a2anva6&at=9",nocase; classtype:attempted-recon; sid:200007724; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/2019conta",nocase; classtype:attempted-recon; sid:200007725; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/abngeleid",nocase; classtype:attempted-recon; sid:200007726; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/amex-homemerchant",nocase; classtype:attempted-recon; sid:200007727; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/aoeje",nocase; classtype:attempted-recon; sid:200007728; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/aw12n",nocase; classtype:attempted-recon; sid:200007729; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/b-6ni",nocase; classtype:attempted-recon; sid:200007730; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/blessedhotega",nocase; classtype:attempted-recon; sid:200007731; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/bnk2n",nocase; classtype:attempted-recon; sid:200007732; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/brueh",nocase; classtype:attempted-recon; sid:200007733; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/ck48o",nocase; classtype:attempted-recon; sid:200007734; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/cnivi",nocase; classtype:attempted-recon; sid:200007735; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/cx6bz",nocase; classtype:attempted-recon; sid:200007736; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/d4pyp/",nocase; classtype:attempted-recon; sid:200007737; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/eelog",nocase; classtype:attempted-recon; sid:200007738; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/fb_login",nocase; classtype:attempted-recon; sid:200007739; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/fhzgr",nocase; classtype:attempted-recon; sid:200007740; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/fx9xc",nocase; classtype:attempted-recon; sid:200007741; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/gi3wg",nocase; classtype:attempted-recon; sid:200007742; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/gi3zf",nocase; classtype:attempted-recon; sid:200007743; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/ing-update",nocase; classtype:attempted-recon; sid:200007744; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/international-services",nocase; classtype:attempted-recon; sid:200007745; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/kerosine8",nocase; classtype:attempted-recon; sid:200007746; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/kpkkpkkpk",nocase; classtype:attempted-recon; sid:200007747; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/login-fb",nocase; classtype:attempted-recon; sid:200007748; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/login-fb?",nocase; classtype:attempted-recon; sid:200007749; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/onlnedesk",nocase; classtype:attempted-recon; sid:200007750; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/peringatan-fb",nocase; classtype:attempted-recon; sid:200007751; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/roadrun3",nocase; classtype:attempted-recon; sid:200007752; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/sparka-de",nocase; classtype:attempted-recon; sid:200007753; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/super-cocovnla/",nocase; classtype:attempted-recon; sid:200007754; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/woning",nocase; classtype:attempted-recon; sid:200007755; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/woning-web",nocase; classtype:attempted-recon; sid:200007756; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/wpyih",nocase; classtype:attempted-recon; sid:200007757; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/xsdbx",nocase; classtype:attempted-recon; sid:200007758; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/xzod5",nocase; classtype:attempted-recon; sid:200007759; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/yqnun",nocase; classtype:attempted-recon; sid:200007760; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/ytk-r",nocase; classtype:attempted-recon; sid:200007761; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/yw5o-",nocase; classtype:attempted-recon; sid:200007762; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/yz3zs",nocase; classtype:attempted-recon; sid:200007763; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s.id",nocase; http_uri; content:"/zrg9b",nocase; classtype:attempted-recon; sid:200007764; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"s3.amazonaws.com",nocase; http_uri; content:"/progressivebank-uat/index.html",nocase; classtype:attempted-recon; sid:200007765; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sachpazis.xyz",nocase; http_uri; content:"/https/",nocase; classtype:attempted-recon; sid:200007766; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sagliklisuaritmacihazi.com",nocase; http_uri; content:"/wp-includes/fonts/ik/of1/nusqc8jdwhxy2kmavtf153gp094ieob7lzr6gm9pbd6jzirxoly21f45uk0vnac7e8w3tshqnrwsg8dkelza370x5hq9mbc46piy21ojfuvt?data=bwfza2vkqg1hc2tlzc5jb20=",nocase; classtype:attempted-recon; sid:200007767; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sajkd12.blogspot.com",nocase; http_uri; content:"/?m=0",nocase; classtype:attempted-recon; sid:200007768; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sandert12.blogspot.com",nocase; http_uri; content:"/p/la-banque-postale.html",nocase; classtype:attempted-recon; sid:200007769; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sandygift.com",nocase; http_uri; content:"/we/wetransfer/?email=info@diehl-patent.de",nocase; classtype:attempted-recon; sid:200007770; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sanjoaquinvalleybrewfest.com",nocase; http_uri; content:"/backup/wp-content/plugins/dude/configuration/themes/mak/index.php?email=&amp\;amp",nocase; classtype:attempted-recon; sid:200007771; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sanjoaquinvalleybrewfest.com",nocase; http_uri; content:"/backup/wp-content/plugins/dude/configuration/themes/mak/index.php?email=contact@ironscales.com&amp\;id=432526cfdsd6567656dgvdhytdfbhjgff4536365353",nocase; classtype:attempted-recon; sid:200007772; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sateegourmet.com",nocase; http_uri; content:"/sbot",nocase; classtype:attempted-recon; sid:200007773; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"script.google.com",nocase; http_uri; content:"/macros/s/akfycbwc6y7yuxmti0kr8e5d3m62ucmsuhkihk-zzxby7xngxeopneyy/exec",nocase; classtype:attempted-recon; sid:200007774; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-online-payeemagement.com",nocase; http_uri; content:"/halifax",nocase; classtype:attempted-recon; sid:200007775; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure-online-payeemagement.com",nocase; http_uri; content:"/halifax/login.php",nocase; classtype:attempted-recon; sid:200007776; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"secure.puandih.com",nocase; http_uri; content:"/r/banjirejeki?utm_source=dlvr.it&utm_medium=twitter",nocase; classtype:attempted-recon; sid:200007777; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securematicsrecruitment.co.uk",nocase; http_uri; content:"/vendor/phpunit/phpunit/src/util/php/logs.php",nocase; classtype:attempted-recon; sid:200007778; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securevpn.co.uk",nocase; http_uri; content:"/3f2b99533752cd703192d30158de5a07/qes.php?cmd=_account-details&session=3f047e72e55743482b76689c82028d1d&dispatch=2c8341369795284714ca23021a57e34069d4d1e3",nocase; classtype:attempted-recon; sid:200007779; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securevpn.co.uk",nocase; http_uri; content:"/3f2b99533752cd703192d30158de5a07/security.php?cmd=_account-details&session=58296c27a43b1d5c749bc307e56fd758&dispatch=fafb53210855f02fd23114aff4a9d9863f06e942",nocase; classtype:attempted-recon; sid:200007780; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securevpn.co.uk",nocase; http_uri; content:"/ad582be1f7f15cb3094f3c9c0e1efeb6",nocase; classtype:attempted-recon; sid:200007781; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securevpn.co.uk",nocase; http_uri; content:"/ad582be1f7f15cb3094f3c9c0e1efeb6/qes.php?cmd=_account-details&session=ac39620b8a9dbb587245ecf83bb2fb45&dispatch=f17bc2fedba4c7971662c203dd188d696670cbe4",nocase; classtype:attempted-recon; sid:200007782; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"securevpn.co.uk",nocase; http_uri; content:"/ad582be1f7f15cb3094f3c9c0e1efeb6/security.php?cmd=_account-details&session=ceacd8b82366ca6c224e7767d7b821e3&dispatch=8c1973501971185bff325e517c8e48c1a55afe42",nocase; classtype:attempted-recon; sid:200007783; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"security-pages-fb.blogspot.com",nocase; http_uri; content:"/2021/07/blog-post.html",nocase; classtype:attempted-recon; sid:200007784; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sehzademarket.com",nocase; http_uri; content:"/nmj.php",nocase; classtype:attempted-recon; sid:200007785; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"seonewsservic.blogspot.com",nocase; http_uri; content:"/p/postenno_9.html",nocase; classtype:attempted-recon; sid:200007786; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servermtbsecure0o.dnset.com",nocase; http_uri; content:"/m&t/login.php?online_id=4ed869c5a93941df9169b0dd0&country=united+states&iso=us",nocase; classtype:attempted-recon; sid:200007787; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"servicefacture.blogspot.com",nocase; http_uri; content:"/2020/04/blog-post_10.html",nocase; classtype:attempted-recon; sid:200007788; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sg3plvwcpnl378889.prod.sin3.secureserver.net",nocase; http_uri; content:"/~aloyst/index/cpwebmail/index.php?email=afortescue@btinternet.com",nocase; classtype:attempted-recon; sid:200007789; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sg3plvwcpnl378889.prod.sin3.secureserver.net",nocase; http_uri; content:"/~sitcrr/wp-includes/fonts/advance/cpwebmail/index.php?email=a.s.l.campbell@btinternet.com",nocase; classtype:attempted-recon; sid:200007790; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sgp1.digitaloceanspaces.com",nocase; http_uri; content:"/3gpredrainbowwestrow582brownqwer02im/index.html",nocase; classtype:attempted-recon; sid:200007791; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sgp1.digitaloceanspaces.com",nocase; http_uri; content:"/umwr09west783cumzigvicemxwteus/index.html",nocase; classtype:attempted-recon; sid:200007792; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sgtbimit.com",nocase; http_uri; content:"/public/ckeditor_full/login.html?to=",nocase; classtype:attempted-recon; sid:200007793; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"share.hsforms.com",nocase; http_uri; content:"/1fni_ent2sao6wqv0vzdn7g8nl9d",nocase; classtype:attempted-recon; sid:200007794; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"share.hsforms.com",nocase; http_uri; content:"/1owoqghkbqdo-dfbltgexeq4g63f",nocase; classtype:attempted-recon; sid:200007795; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shared-document.com",nocase; http_uri; content:"/basic.php?k=d63621ef3dc01735479befc13f97ec7fdb68991d",nocase; classtype:attempted-recon; sid:200007796; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sho.cat",nocase; http_uri; content:"/xc",nocase; classtype:attempted-recon; sid:200007797; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shortlink.net",nocase; http_uri; content:"/verify-atm",nocase; classtype:attempted-recon; sid:200007798; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shorturl.at",nocase; http_uri; content:"/nqgu1",nocase; classtype:attempted-recon; sid:200007799; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shorturl.at",nocase; http_uri; content:"/pdlp9",nocase; classtype:attempted-recon; sid:200007800; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shoutout.wix.com",nocase; http_uri; content:"/so/29nxdzhlu/c?w=6cqhoe6cvp5sgmmsaghxgp5ym3iyanqygauqwdhnqmi.eyj1ijoiahr0chm6ly93yxrhc2lpcmpyawjoys5ibg9ilmnvcmuud2luzg93cy5uzxqvdgvzdgluzy9tcgxuynzjegrmlmh0bwwilcjyijoinzewowuwzgitnjy5mi00ngrhltuzm2qtnjaynzk1zje0ymuxiiwibsi6im1hawwilcjjijoimdawmdawmdatmdawmc0wmdawltawmdatmdawmdawmdawmdawin0#qs=r-agikbadkfkgdhdjaehfdidgafgccdigaehkkdaehkkdababaibadccaccaccjhackcjaibjfhacb",nocase; classtype:attempted-recon; sid:200007801; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"shrunken.com",nocase; http_uri; content:"/url_redirector.php?url=a6yt8",nocase; classtype:attempted-recon; sid:200007802; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"siasky.net",nocase; http_uri; content:"/oaddp_mbyvqeyn2a39cojjjejdbbw60b6qye8gntzoyl1g",nocase; classtype:attempted-recon; sid:200007803; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sibautomation.com",nocase; http_uri; content:"/cm.html?id=3693089#trans=0&amp\;user_id=1",nocase; classtype:attempted-recon; sid:200007804; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sibautomation.com",nocase; http_uri; content:"/cm.html?id=3693089#trans=0&amp\;user_id=2",nocase; classtype:attempted-recon; sid:200007805; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simp.ly",nocase; http_uri; content:"/p/3cd35d",nocase; classtype:attempted-recon; sid:200007806; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simp.ly",nocase; http_uri; content:"/p/h45c89",nocase; classtype:attempted-recon; sid:200007807; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simp.ly",nocase; http_uri; content:"/p/hqtfwb",nocase; classtype:attempted-recon; sid:200007808; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simp.ly",nocase; http_uri; content:"/p/jwj7gr",nocase; classtype:attempted-recon; sid:200007809; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simp.ly",nocase; http_uri; content:"/p/jylrtp",nocase; classtype:attempted-recon; sid:200007810; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simp.ly",nocase; http_uri; content:"/p/wlgtvw",nocase; classtype:attempted-recon; sid:200007811; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"simp.ly",nocase; http_uri; content:"/publish/xhrdvc",nocase; classtype:attempted-recon; sid:200007812; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/a/sy4norton.com/setup/home",nocase; classtype:attempted-recon; sid:200007813; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/grossohooperlaw.com/grossohooperlaw/home",nocase; classtype:attempted-recon; sid:200007814; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/buayomuarobtp/",nocase; classtype:attempted-recon; sid:200007815; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/cilakourangma/",nocase; classtype:attempted-recon; sid:200007816; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/clamingidentify008754501/",nocase; classtype:attempted-recon; sid:200007817; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/confrimationsacounst/home",nocase; classtype:attempted-recon; sid:200007818; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/e9d24c72/23524457",nocase; classtype:attempted-recon; sid:200007819; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/habbotuttogratis",nocase; classtype:attempted-recon; sid:200007820; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/habbotuttogratis/assignments",nocase; classtype:attempted-recon; sid:200007821; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/help74540110104104014100/",nocase; classtype:attempted-recon; sid:200007822; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/libretyreserve",nocase; classtype:attempted-recon; sid:200007823; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/libretyreserve/",nocase; classtype:attempted-recon; sid:200007824; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/maxsecureacc564988/",nocase; classtype:attempted-recon; sid:200007825; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/policyclaming99008767/",nocase; classtype:attempted-recon; sid:200007826; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/protectedinmprovmnt44/",nocase; classtype:attempted-recon; sid:200007827; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/verifycheckpointpaqes/",nocase; classtype:attempted-recon; sid:200007828; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/site/wwwinfopages091/",nocase; classtype:attempted-recon; sid:200007829; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/103gn-securefacebook-page",nocase; classtype:attempted-recon; sid:200007830; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/114g/bt",nocase; classtype:attempted-recon; sid:200007831; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/122qw/btconneect",nocase; classtype:attempted-recon; sid:200007832; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/1nepmw6/",nocase; classtype:attempted-recon; sid:200007833; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/2021o728/bt",nocase; classtype:attempted-recon; sid:200007834; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/23456yu/btconecct?authuser=1",nocase; classtype:attempted-recon; sid:200007835; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/2498475825728fe/bt",nocase; classtype:attempted-recon; sid:200007836; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/276e/bt",nocase; classtype:attempted-recon; sid:200007837; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/33wq/btconnecct",nocase; classtype:attempted-recon; sid:200007838; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/344rtfg/btconneec",nocase; classtype:attempted-recon; sid:200007839; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/3uyrdfg/bt",nocase; classtype:attempted-recon; sid:200007840; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/434ef/btcoonneecc",nocase; classtype:attempted-recon; sid:200007841; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/4354hjg/bt",nocase; classtype:attempted-recon; sid:200007842; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/435rre/btconneecct",nocase; classtype:attempted-recon; sid:200007843; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/4567yu/btconneect",nocase; classtype:attempted-recon; sid:200007844; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/45ty/bt",nocase; classtype:attempted-recon; sid:200007845; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/47653jgfgfhgf/bt",nocase; classtype:attempted-recon; sid:200007846; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/50898t0tvucjbtbusiness/office365",nocase; classtype:attempted-recon; sid:200007847; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/534rty/btconnecctt",nocase; classtype:attempted-recon; sid:200007848; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/56he/btconnect",nocase; classtype:attempted-recon; sid:200007849; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/57ytdf/bt",nocase; classtype:attempted-recon; sid:200007850; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/58658-5795-btrefundoffice365/office365",nocase; classtype:attempted-recon; sid:200007851; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/62374ytu/btconnecc?authuser=1",nocase; classtype:attempted-recon; sid:200007852; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/657yttr/btconnecct",nocase; classtype:attempted-recon; sid:200007853; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/7458694584hjgg/bt",nocase; classtype:attempted-recon; sid:200007854; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/76767jkk/btbillpay",nocase; classtype:attempted-recon; sid:200007855; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/78578g/btconnnecct",nocase; classtype:attempted-recon; sid:200007856; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/8097tr6e56tyfhgjkl/office",nocase; classtype:attempted-recon; sid:200007857; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/98yuk/bt",nocase; classtype:attempted-recon; sid:200007858; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/abtbusinesx/home",nocase; classtype:attempted-recon; sid:200007859; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/access-office-docxpdf-call-net/home",nocase; classtype:attempted-recon; sid:200007860; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/acct-bt-service-upgrade/home",nocase; classtype:attempted-recon; sid:200007861; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/accueil-b-p-postale/accueil",nocase; classtype:attempted-recon; sid:200007862; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/adesdaw/bt-business",nocase; classtype:attempted-recon; sid:200007863; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/airaixe",nocase; classtype:attempted-recon; sid:200007864; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/akgthrjfigjiosjfszdio/office365",nocase; classtype:attempted-recon; sid:200007865; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/app-mobile-pages/",nocase; classtype:attempted-recon; sid:200007866; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/asddfgfdsdffggghhjjkkhg/bt",nocase; classtype:attempted-recon; sid:200007867; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/asdfghjklhgfdsdfgh/home",nocase; classtype:attempted-recon; sid:200007868; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/askdnhojajs/office365",nocase; classtype:attempted-recon; sid:200007869; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/asloke",nocase; classtype:attempted-recon; sid:200007870; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/atguytrewr/home",nocase; classtype:attempted-recon; sid:200007871; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/att-communications/home",nocase; classtype:attempted-recon; sid:200007872; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/att-managements/home",nocase; classtype:attempted-recon; sid:200007873; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/att-yahoomail",nocase; classtype:attempted-recon; sid:200007874; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/attupdatinglog/home",nocase; classtype:attempted-recon; sid:200007875; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/attyahoo-connect/home",nocase; classtype:attempted-recon; sid:200007876; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/audio-call-net/home",nocase; classtype:attempted-recon; sid:200007877; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ball4l/bt-business",nocase; classtype:attempted-recon; sid:200007878; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bbtbt-loginnnn/secure-bt-com",nocase; classtype:attempted-recon; sid:200007879; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bdhfewew/home",nocase; classtype:attempted-recon; sid:200007880; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/before-we-proceed-chase",nocase; classtype:attempted-recon; sid:200007881; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/before-we-proceed-chase-com",nocase; classtype:attempted-recon; sid:200007882; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/before-we-proceed-chasecom",nocase; classtype:attempted-recon; sid:200007883; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/billbtnew/bt",nocase; classtype:attempted-recon; sid:200007884; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/billready/btconnect",nocase; classtype:attempted-recon; sid:200007885; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/billsbt/bt",nocase; classtype:attempted-recon; sid:200007886; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bkjfeghrege438t/bt",nocase; classtype:attempted-recon; sid:200007887; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/boardbrand/home",nocase; classtype:attempted-recon; sid:200007888; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/boardbrandd/home",nocase; classtype:attempted-recon; sid:200007889; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/boardbrands/home",nocase; classtype:attempted-recon; sid:200007890; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/boardbrantd/home",nocase; classtype:attempted-recon; sid:200007891; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bosiness/home",nocase; classtype:attempted-recon; sid:200007892; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bradescodigital",nocase; classtype:attempted-recon; sid:200007893; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/brandboardsuppor/home%3e%3chttps:/sites.google.com/view/brandboard/home",nocase; classtype:attempted-recon; sid:200007894; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/broadbrands/home",nocase; classtype:attempted-recon; sid:200007895; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-b/home?authuser=6",nocase; classtype:attempted-recon; sid:200007896; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-billlive/bt",nocase; classtype:attempted-recon; sid:200007897; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-cloud-voice-review-voice/bt-voice-cloud",nocase; classtype:attempted-recon; sid:200007898; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-cloud-work-work/home?authuser=3",nocase; classtype:attempted-recon; sid:200007899; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-clould-preview000112/voice010101010bt-cloud?authuser=8",nocase; classtype:attempted-recon; sid:200007900; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-defund/bt",nocase; classtype:attempted-recon; sid:200007901; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-jobs-page001/home?authuser=3",nocase; classtype:attempted-recon; sid:200007902; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-log-1/bt",nocase; classtype:attempted-recon; sid:200007903; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-loginbt/bt",nocase; classtype:attempted-recon; sid:200007904; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-newbill/bt",nocase; classtype:attempted-recon; sid:200007905; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-notification/home",nocase; classtype:attempted-recon; sid:200007906; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-pdf-receipt-payment/www-bt-pdf?authuser=8",nocase; classtype:attempted-recon; sid:200007907; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-readybill-/bt",nocase; classtype:attempted-recon; sid:200007908; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-recover-id/home?authuser=1",nocase; classtype:attempted-recon; sid:200007909; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-upgrade2021/home?authuser=1",nocase; classtype:attempted-recon; sid:200007910; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-viewmybill/bt",nocase; classtype:attempted-recon; sid:200007911; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-viewyourbill/bt",nocase; classtype:attempted-recon; sid:200007912; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt-voice1010010/bt-voicemesaage10120201002?authuser=8",nocase; classtype:attempted-recon; sid:200007913; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt1btconnectbusinesss/btconnect",nocase; classtype:attempted-recon; sid:200007914; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bt1business/btconnect",nocase; classtype:attempted-recon; sid:200007915; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btaccess-review/bt",nocase; classtype:attempted-recon; sid:200007916; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btaccess/bt",nocase; classtype:attempted-recon; sid:200007917; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btaccessnow/bt",nocase; classtype:attempted-recon; sid:200007918; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btanalystic/home",nocase; classtype:attempted-recon; sid:200007919; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbill-/bt",nocase; classtype:attempted-recon; sid:200007920; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbill-7/bt",nocase; classtype:attempted-recon; sid:200007921; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbill-paymentwu82/bt",nocase; classtype:attempted-recon; sid:200007922; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbill-ready/bt",nocase; classtype:attempted-recon; sid:200007923; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbillbusiness-1/bt",nocase; classtype:attempted-recon; sid:200007924; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbillingbusiness/bt",nocase; classtype:attempted-recon; sid:200007925; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbillpayment-bt/bt",nocase; classtype:attempted-recon; sid:200007926; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbillpayment/bt",nocase; classtype:attempted-recon; sid:200007927; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbillreadynow/bt",nocase; classtype:attempted-recon; sid:200007928; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbillsecure/btconnect",nocase; classtype:attempted-recon; sid:200007929; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbillview/bt",nocase; classtype:attempted-recon; sid:200007930; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btboardbrand/home",nocase; classtype:attempted-recon; sid:200007931; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btboardbrands/home",nocase; classtype:attempted-recon; sid:200007932; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbrandboarddd/home",nocase; classtype:attempted-recon; sid:200007933; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbroadcfbandbills",nocase; classtype:attempted-recon; sid:200007934; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbtbt-preview-voice-page-/bt-cloud-voice",nocase; classtype:attempted-recon; sid:200007935; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbtbt/bt",nocase; classtype:attempted-recon; sid:200007936; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbtbtb-cloud-voice00111/home",nocase; classtype:attempted-recon; sid:200007937; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbtbtbtbtb-upgrade-mailbox/bt-com",nocase; classtype:attempted-recon; sid:200007938; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbtbtbtbtbtcomm/home",nocase; classtype:attempted-recon; sid:200007939; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbtbtbtcloudvoice/bt-cloud-voice",nocase; classtype:attempted-recon; sid:200007940; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbuiss/home",nocase; classtype:attempted-recon; sid:200007941; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbusiness-bt/home",nocase; classtype:attempted-recon; sid:200007942; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbusiness-viewyournewbill/bt",nocase; classtype:attempted-recon; sid:200007943; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbusinessbillready/btconnect",nocase; classtype:attempted-recon; sid:200007944; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbusinesssecures/btconnect",nocase; classtype:attempted-recon; sid:200007945; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btbusinessx/bt",nocase; classtype:attempted-recon; sid:200007946; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btcloud-1/bt",nocase; classtype:attempted-recon; sid:200007947; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btcloudpaymentinvoice202000/httpsbtcloudvm-voice-new?authuser=1",nocase; classtype:attempted-recon; sid:200007948; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnect-group-plc/home",nocase; classtype:attempted-recon; sid:200007949; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnect2021/home",nocase; classtype:attempted-recon; sid:200007950; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnectbusiness/btconnect",nocase; classtype:attempted-recon; sid:200007951; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnectgroupplc/home",nocase; classtype:attempted-recon; sid:200007952; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnectmailserver/home",nocase; classtype:attempted-recon; sid:200007953; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnectready-bill/bt",nocase; classtype:attempted-recon; sid:200007954; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btconnectvoicemail-weebly-com/btconnectvm-com",nocase; classtype:attempted-recon; sid:200007955; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btdhjjbtbtbusiness/btbusiness",nocase; classtype:attempted-recon; sid:200007956; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btfhdbsjuhjf/btconnect",nocase; classtype:attempted-recon; sid:200007957; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btfsdbkmvxcbusinesss/office365",nocase; classtype:attempted-recon; sid:200007958; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bthomelog1/home",nocase; classtype:attempted-recon; sid:200007959; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btinserve2/home",nocase; classtype:attempted-recon; sid:200007960; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btinternetco/home",nocase; classtype:attempted-recon; sid:200007961; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btinternetconectey/home",nocase; classtype:attempted-recon; sid:200007962; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btinternetonline/home",nocase; classtype:attempted-recon; sid:200007963; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btinternetverificatioamil/home",nocase; classtype:attempted-recon; sid:200007964; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btissecurelogin/btconnect",nocase; classtype:attempted-recon; sid:200007965; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btlogin-n/home",nocase; classtype:attempted-recon; sid:200007966; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btloginfo/bt",nocase; classtype:attempted-recon; sid:200007967; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btlsecurelog/bt",nocase; classtype:attempted-recon; sid:200007968; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btmonthlybill-1/bt",nocase; classtype:attempted-recon; sid:200007969; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btmonthlybill/bt",nocase; classtype:attempted-recon; sid:200007970; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btmonthlynewbill/bt",nocase; classtype:attempted-recon; sid:200007971; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btmonthlynewpayment/bt",nocase; classtype:attempted-recon; sid:200007972; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btmonthlypayment/bt",nocase; classtype:attempted-recon; sid:200007973; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btmv-voice-notice011/btvoicemessage?authuser=8",nocase; classtype:attempted-recon; sid:200007974; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btnet/home",nocase; classtype:attempted-recon; sid:200007975; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btnew-bill/bt",nocase; classtype:attempted-recon; sid:200007976; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btnewbill-1/bt",nocase; classtype:attempted-recon; sid:200007977; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btnewbill-payment/bt",nocase; classtype:attempted-recon; sid:200007978; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btnewbill/bt",nocase; classtype:attempted-recon; sid:200007979; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btnewbills/bt",nocase; classtype:attempted-recon; sid:200007980; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btnewloginbill/bt",nocase; classtype:attempted-recon; sid:200007981; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btnewweekbill/bt",nocase; classtype:attempted-recon; sid:200007982; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btnvm-urgentnotice/btvmnew-note?authuser=1",nocase; classtype:attempted-recon; sid:200007983; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btoffice-log/bt",nocase; classtype:attempted-recon; sid:200007984; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btofficeaccess/bt",nocase; classtype:attempted-recon; sid:200007985; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btoficialbusiness20i21/office365",nocase; classtype:attempted-recon; sid:200007986; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btonlineserver/btpasswordsector",nocase; classtype:attempted-recon; sid:200007987; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btooolgoooozzzz/home?authuser=3",nocase; classtype:attempted-recon; sid:200007988; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btpayment-31st/bt",nocase; classtype:attempted-recon; sid:200007989; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btpaymentbill/bt",nocase; classtype:attempted-recon; sid:200007990; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btpaymentnew/bt",nocase; classtype:attempted-recon; sid:200007991; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btpdfbill-002/bt-home",nocase; classtype:attempted-recon; sid:200007992; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btpermanentbill/bt",nocase; classtype:attempted-recon; sid:200007993; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btplcgroup/home",nocase; classtype:attempted-recon; sid:200007994; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btready-bill-/bt",nocase; classtype:attempted-recon; sid:200007995; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btrequestbill/bt",nocase; classtype:attempted-recon; sid:200007996; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btreset/bt",nocase; classtype:attempted-recon; sid:200007997; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btsportl/home",nocase; classtype:attempted-recon; sid:200007998; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bttboardbrand/home",nocase; classtype:attempted-recon; sid:200007999; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bttbusinesssss/home",nocase; classtype:attempted-recon; sid:200008000; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/bttnet/home",nocase; classtype:attempted-recon; sid:200008001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btupdate-1/bt",nocase; classtype:attempted-recon; sid:200008002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btupdate-bill/bt",nocase; classtype:attempted-recon; sid:200008003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btupdatepage/bt",nocase; classtype:attempted-recon; sid:200008004; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btvailmus/home",nocase; classtype:attempted-recon; sid:200008005; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btview-/bt",nocase; classtype:attempted-recon; sid:200008006; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btview-bill-bt/bt",nocase; classtype:attempted-recon; sid:200008007; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btview-bills/bt",nocase; classtype:attempted-recon; sid:200008008; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btviewbill-/bt",nocase; classtype:attempted-recon; sid:200008009; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btviewbill-11/bt",nocase; classtype:attempted-recon; sid:200008010; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btviewbill/bt",nocase; classtype:attempted-recon; sid:200008011; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/btviewebill/bt",nocase; classtype:attempted-recon; sid:200008012; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/businesbill-view/bt",nocase; classtype:attempted-recon; sid:200008013; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/businessbtsecure/bt-business",nocase; classtype:attempted-recon; sid:200008014; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/businessofficebt/bt-business",nocase; classtype:attempted-recon; sid:200008015; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/cancel-deactivate/bt-com",nocase; classtype:attempted-recon; sid:200008016; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/capitaloneloginus/home",nocase; classtype:attempted-recon; sid:200008017; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/carinapwapw/bt-business",nocase; classtype:attempted-recon; sid:200008018; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/certicodeplus2/accueil",nocase; classtype:attempted-recon; sid:200008019; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/checkbillbt/bt",nocase; classtype:attempted-recon; sid:200008020; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/checkbt/bt",nocase; classtype:attempted-recon; sid:200008021; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/checkinbt/bt",nocase; classtype:attempted-recon; sid:200008022; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/chjh-yjbucy-nngfv-hnfgmnx-bt/office365",nocase; classtype:attempted-recon; sid:200008023; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ciix/home",nocase; classtype:attempted-recon; sid:200008024; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/clickbtconnect/home?authuser=1",nocase; classtype:attempted-recon; sid:200008025; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/coinsbuysellswapcryptocurrency/?fbclid=iwar2isl9xfxxgcxtftml2hmcl_dglhshlkfkpdotycyqu-qjqqfdqm9whtfm",nocase; classtype:attempted-recon; sid:200008026; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/communication-serveurrdpg/accueil",nocase; classtype:attempted-recon; sid:200008027; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/credit-agricole-faccueilca/accueil",nocase; classtype:attempted-recon; sid:200008028; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ctz03",nocase; classtype:attempted-recon; sid:200008029; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/currentlyatt/home",nocase; classtype:attempted-recon; sid:200008030; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dashesdl00",nocase; classtype:attempted-recon; sid:200008031; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dedehyhg/home",nocase; classtype:attempted-recon; sid:200008032; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dfbjkzdmktmhzlhdjtgzdjzzjs/office365",nocase; classtype:attempted-recon; sid:200008033; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dfghjhckuyf/home",nocase; classtype:attempted-recon; sid:200008034; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dfghjhl/home",nocase; classtype:attempted-recon; sid:200008035; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dfghjkllkgfdfghkljkkjhg/office365",nocase; classtype:attempted-recon; sid:200008036; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dfhjklkjhgfddfzhxjcjk/office365",nocase; classtype:attempted-recon; sid:200008037; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/djgfdgzogjsm-js-riyavet-hbt/office365",nocase; classtype:attempted-recon; sid:200008038; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/djkfghwug75/bt",nocase; classtype:attempted-recon; sid:200008039; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/djklgfnj-jkjxukyuip97/office365",nocase; classtype:attempted-recon; sid:200008040; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dododokido/home",nocase; classtype:attempted-recon; sid:200008041; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dosfdhdgkbmdzgjzoalzgk/office365",nocase; classtype:attempted-recon; sid:200008042; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/drakio/bt-business",nocase; classtype:attempted-recon; sid:200008043; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dsjbnsdkfgndhjfjzoim/365office",nocase; classtype:attempted-recon; sid:200008044; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/dsvhv74t43/bt",nocase; classtype:attempted-recon; sid:200008045; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/duf/bt",nocase; classtype:attempted-recon; sid:200008046; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/efdgfkdsdjfvsizobkl/office365",nocase; classtype:attempted-recon; sid:200008047; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ekofederal/bt-business",nocase; classtype:attempted-recon; sid:200008048; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/esfgjdgfshggd58-btbillrepaymnt/office365",nocase; classtype:attempted-recon; sid:200008049; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/espacemessagerieorangesms/accueil",nocase; classtype:attempted-recon; sid:200008050; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/esuniketegbe/bt-business",nocase; classtype:attempted-recon; sid:200008051; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/etyajdnxnskoeprlwyaxbdhfkrituy/btconnect",nocase; classtype:attempted-recon; sid:200008052; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/facturemob-boxligne/accueil",nocase; classtype:attempted-recon; sid:200008053; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/fbs-confrim/",nocase; classtype:attempted-recon; sid:200008054; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/fdbt-bsuinesskbcksfjz/office365",nocase; classtype:attempted-recon; sid:200008055; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/feelblessed/bt-business",nocase; classtype:attempted-recon; sid:200008056; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ffjhgfnbgbpdjbvduvbwv/bt",nocase; classtype:attempted-recon; sid:200008057; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/fgbhlzjcsn/bt",nocase; classtype:attempted-recon; sid:200008058; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/fggtg/home",nocase; classtype:attempted-recon; sid:200008059; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/fghjgjfhjmmfngc/home",nocase; classtype:attempted-recon; sid:200008060; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/fghjgjfhjmmfngc/home/",nocase; classtype:attempted-recon; sid:200008061; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/fhfv-btcoplc/bt",nocase; classtype:attempted-recon; sid:200008062; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/freshtotal/bt",nocase; classtype:attempted-recon; sid:200008063; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/gduhjzfughbfld/office365",nocase; classtype:attempted-recon; sid:200008064; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/gfgherbviughegbn/bt",nocase; classtype:attempted-recon; sid:200008065; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ghdgehe/home?authuser=4",nocase; classtype:attempted-recon; sid:200008066; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ghgjlkhfjgggwgwgr/bt",nocase; classtype:attempted-recon; sid:200008067; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ghjkuytrdfgh/home",nocase; classtype:attempted-recon; sid:200008068; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/gjhjhkj/home",nocase; classtype:attempted-recon; sid:200008069; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/googluxxk/bt-business",nocase; classtype:attempted-recon; sid:200008070; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hccwc/home",nocase; classtype:attempted-recon; sid:200008071; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hgdfwer/bt",nocase; classtype:attempted-recon; sid:200008072; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hiudrfsdgh/home",nocase; classtype:attempted-recon; sid:200008073; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hjyuhijhiukhghjk/home",nocase; classtype:attempted-recon; sid:200008074; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/home-bt-updates/bt-com",nocase; classtype:attempted-recon; sid:200008075; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/home-btconnect-bills/home",nocase; classtype:attempted-recon; sid:200008076; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/homebt/bt-home",nocase; classtype:attempted-recon; sid:200008077; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/hornygirlc/home",nocase; classtype:attempted-recon; sid:200008078; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/htvvss/home?authuser=3",nocase; classtype:attempted-recon; sid:200008079; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/i86edssertuilmjuj00u7trr45r4/home",nocase; classtype:attempted-recon; sid:200008080; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ichaba-lavish/bt-businexs",nocase; classtype:attempted-recon; sid:200008081; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/identyyc-helpsm20/",nocase; classtype:attempted-recon; sid:200008082; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ieurf/bt",nocase; classtype:attempted-recon; sid:200008083; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/invoice-payment-pdf/home",nocase; classtype:attempted-recon; sid:200008084; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/invoice-payment/home",nocase; classtype:attempted-recon; sid:200008085; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/iuyggdt/bt",nocase; classtype:attempted-recon; sid:200008086; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/jcnvvn/home",nocase; classtype:attempted-recon; sid:200008087; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/jfrijsufe0rjgplsvkdm/office365",nocase; classtype:attempted-recon; sid:200008088; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/jgvh-thtssmvvhhvcvyghbjnkgrdty/office365",nocase; classtype:attempted-recon; sid:200008089; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/jhddd/bt",nocase; classtype:attempted-recon; sid:200008090; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/jkfdskghw8484/bt",nocase; classtype:attempted-recon; sid:200008091; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/jmjmnhvdc/home",nocase; classtype:attempted-recon; sid:200008092; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/jmnhgdfvasxhjfk/office365",nocase; classtype:attempted-recon; sid:200008093; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/johnbullmysonisenttttiyoutosch/home",nocase; classtype:attempted-recon; sid:200008094; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/jsdfkhjfjhfjgkumf-dhf/office365",nocase; classtype:attempted-recon; sid:200008095; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/jsdkfdggstjhkgdfshj-bts-bgnhdg/office365",nocase; classtype:attempted-recon; sid:200008096; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/kayodemi/home",nocase; classtype:attempted-recon; sid:200008097; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/keepcurrentbt/bt",nocase; classtype:attempted-recon; sid:200008098; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ktaonline",nocase; classtype:attempted-recon; sid:200008099; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/labred-authentification-source/accueil",nocase; classtype:attempted-recon; sid:200008100; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/lateatnight/bt-business",nocase; classtype:attempted-recon; sid:200008101; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/login-bt/bt",nocase; classtype:attempted-recon; sid:200008102; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/loginbt/btconnect",nocase; classtype:attempted-recon; sid:200008103; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/loginyourbill/bt",nocase; classtype:attempted-recon; sid:200008104; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/maillogobt/home",nocase; classtype:attempted-recon; sid:200008105; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mailnlinkbtmila/home",nocase; classtype:attempted-recon; sid:200008106; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mapeeeeemipaapaodkdjrrddd/home",nocase; classtype:attempted-recon; sid:200008107; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mcwdbvefjberjrwgnwriviwr/home",nocase; classtype:attempted-recon; sid:200008108; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/micraosaftefficei/bt",nocase; classtype:attempted-recon; sid:200008109; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mmse/home",nocase; classtype:attempted-recon; sid:200008110; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mobile-pages-/",nocase; classtype:attempted-recon; sid:200008111; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mobile-redirect-pages/",nocase; classtype:attempted-recon; sid:200008112; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/monsitewebfacture888/accueil",nocase; classtype:attempted-recon; sid:200008113; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/monthly-bill-reveiw00o0o1/bt-com",nocase; classtype:attempted-recon; sid:200008114; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mv-voicepage/home?authuser=8",nocase; classtype:attempted-recon; sid:200008115; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mybillready/btconect",nocase; classtype:attempted-recon; sid:200008116; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mybt273ehdjsecure/bt-business",nocase; classtype:attempted-recon; sid:200008117; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mybtbill--1/bt",nocase; classtype:attempted-recon; sid:200008118; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mybtbill-1/bt",nocase; classtype:attempted-recon; sid:200008119; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mybtbill-new/bt",nocase; classtype:attempted-recon; sid:200008120; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mybtbilllogin/bt",nocase; classtype:attempted-recon; sid:200008121; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mybtbillpayment/bt",nocase; classtype:attempted-recon; sid:200008122; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mybtnewbill/bt",nocase; classtype:attempted-recon; sid:200008123; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mybtsececurvaytvfcigfdtcvbd/bt",nocase; classtype:attempted-recon; sid:200008124; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/mymailbox/home",nocase; classtype:attempted-recon; sid:200008125; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/new-btbill/bt",nocase; classtype:attempted-recon; sid:200008126; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/newbtbill/bt",nocase; classtype:attempted-recon; sid:200008127; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/newbtmissedcall/home",nocase; classtype:attempted-recon; sid:200008128; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/newvoicemail/home?authuser=1",nocase; classtype:attempted-recon; sid:200008129; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/notificationpublicpage",nocase; classtype:attempted-recon; sid:200008130; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/offiice-voice-com/home",nocase; classtype:attempted-recon; sid:200008131; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/oihgf/bt",nocase; classtype:attempted-recon; sid:200008132; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/oiugfdhbjnk/bt",nocase; classtype:attempted-recon; sid:200008133; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/oiuyfdsdfghj/bt",nocase; classtype:attempted-recon; sid:200008134; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/oiuytf/bt",nocase; classtype:attempted-recon; sid:200008135; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/oixdfjdfjzkkbt-76-business/office365",nocase; classtype:attempted-recon; sid:200008136; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/omobabaolowonofitdie/home",nocase; classtype:attempted-recon; sid:200008137; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/operateur-communication999/accueil",nocase; classtype:attempted-recon; sid:200008138; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/orange-bank/accueil",nocase; classtype:attempted-recon; sid:200008139; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/orangebankfrance/accueil?utm_source=newsletter&utm_medium=email&utm_campaign=bienvenue+solde+80%25",nocase; classtype:attempted-recon; sid:200008140; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/orangemsg/accueil",nocase; classtype:attempted-recon; sid:200008141; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/paginadetectada",nocase; classtype:attempted-recon; sid:200008142; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/passoip/accueil",nocase; classtype:attempted-recon; sid:200008143; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/payment-1/bt",nocase; classtype:attempted-recon; sid:200008144; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/paypal-customer-services/",nocase; classtype:attempted-recon; sid:200008145; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/paypal-loginn/",nocase; classtype:attempted-recon; sid:200008146; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/paypalloginsignin",nocase; classtype:attempted-recon; sid:200008147; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/paypalloginsignin/",nocase; classtype:attempted-recon; sid:200008148; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/payyourbill/bt",nocase; classtype:attempted-recon; sid:200008149; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/pfherjwlsnmcyelwudy/home?authuser=3",nocase; classtype:attempted-recon; sid:200008150; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/plkbf/bt",nocase; classtype:attempted-recon; sid:200008151; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/plugtopeckham/bt-business",nocase; classtype:attempted-recon; sid:200008152; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/pompomsx/bt-business",nocase; classtype:attempted-recon; sid:200008153; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/postacerticodplusaccaccueil/accueil",nocase; classtype:attempted-recon; sid:200008154; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/readybillbt/btconnec",nocase; classtype:attempted-recon; sid:200008155; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/readynewbill/bt",nocase; classtype:attempted-recon; sid:200008156; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/reviewbt/home",nocase; classtype:attempted-recon; sid:200008157; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/richcoff/bt-business",nocase; classtype:attempted-recon; sid:200008158; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/rkgjhfkgnkgfgdkzxkzdx/office365",nocase; classtype:attempted-recon; sid:200008159; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/rtsadyffuvfoi/home",nocase; classtype:attempted-recon; sid:200008160; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/s00420122kl-t2",nocase; classtype:attempted-recon; sid:200008161; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/sadsvfghnjdmackngd/office365",nocase; classtype:attempted-recon; sid:200008162; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/sdfhjkjhasdghj/home",nocase; classtype:attempted-recon; sid:200008163; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/secure-bt-homevoice01010120/home?authuser=8",nocase; classtype:attempted-recon; sid:200008164; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/securebtweebly/bt",nocase; classtype:attempted-recon; sid:200008165; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/securemybt/bt",nocase; classtype:attempted-recon; sid:200008166; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/serveur-communication-box/accueil",nocase; classtype:attempted-recon; sid:200008167; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/serveur-communication-pro/accueil",nocase; classtype:attempted-recon; sid:200008168; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/sghbjyx/btconnect",nocase; classtype:attempted-recon; sid:200008169; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/shootup/bt-business",nocase; classtype:attempted-recon; sid:200008170; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/simpleswapofficialsite/home",nocase; classtype:attempted-recon; sid:200008171; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/soeyankandi5/bt-business",nocase; classtype:attempted-recon; sid:200008172; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/strtm-statr/strtym-statr?fbclid=iwar2z7e7ynueypheqdawlqj8xflososlpfqiskb5c2j3lhtn0j-dlmw5pkj0",nocase; classtype:attempted-recon; sid:200008173; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/surveypagelogin/home",nocase; classtype:attempted-recon; sid:200008174; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/tebgbu/bt",nocase; classtype:attempted-recon; sid:200008175; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/tr129/btconneccc",nocase; classtype:attempted-recon; sid:200008176; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/transect/",nocase; classtype:attempted-recon; sid:200008177; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/trjhhklfjzgujsumkgn-bt/office365",nocase; classtype:attempted-recon; sid:200008178; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/trsrthhggfghj/home",nocase; classtype:attempted-recon; sid:200008179; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ugerfg5bv/bt",nocase; classtype:attempted-recon; sid:200008180; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/uoiytrewsdfgfhjhkjn/office365",nocase; classtype:attempted-recon; sid:200008181; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/updatenewaccess/home",nocase; classtype:attempted-recon; sid:200008182; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/upgrade-bt/home",nocase; classtype:attempted-recon; sid:200008183; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/upgrade-btbtbtb/bt-com",nocase; classtype:attempted-recon; sid:200008184; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/uyfyresfcgvjkl/home",nocase; classtype:attempted-recon; sid:200008185; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/va139/btcomms?authuser=1",nocase; classtype:attempted-recon; sid:200008186; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/va779/btcomm?authuser=1",nocase; classtype:attempted-recon; sid:200008187; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/venmo-loginusa/",nocase; classtype:attempted-recon; sid:200008188; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/vfbjf/btconnect",nocase; classtype:attempted-recon; sid:200008189; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/vgjg/bt-business",nocase; classtype:attempted-recon; sid:200008190; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/view%20-your-bills/home",nocase; classtype:attempted-recon; sid:200008191; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/view-btbilll/bt",nocase; classtype:attempted-recon; sid:200008192; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/viewbill-bt-1/bt",nocase; classtype:attempted-recon; sid:200008193; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/viewbill-bt1/bt",nocase; classtype:attempted-recon; sid:200008194; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/viewbillbtnow/bt",nocase; classtype:attempted-recon; sid:200008195; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/viewbtbillbusiness/btconnect",nocase; classtype:attempted-recon; sid:200008196; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/viewbtbusinessbill/btconnect",nocase; classtype:attempted-recon; sid:200008197; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/viewmybill/btconnect",nocase; classtype:attempted-recon; sid:200008198; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/viewmybt-/bt",nocase; classtype:attempted-recon; sid:200008199; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/viewmybtbill-2/bt",nocase; classtype:attempted-recon; sid:200008200; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/viewyournewbill/bt-business-btconnect",nocase; classtype:attempted-recon; sid:200008201; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/vjsdhdfidjasi/btconnect",nocase; classtype:attempted-recon; sid:200008202; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/voice-cloud-cloud/home?authuser=3",nocase; classtype:attempted-recon; sid:200008203; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/voicenote-office365/home",nocase; classtype:attempted-recon; sid:200008204; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/watueru/bt-business",nocase; classtype:attempted-recon; sid:200008205; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/webmail12bt/home",nocase; classtype:attempted-recon; sid:200008206; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/webservice123/home",nocase; classtype:attempted-recon; sid:200008207; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/wefgb/bt",nocase; classtype:attempted-recon; sid:200008208; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/wkkdbillz7z/bt-business",nocase; classtype:attempted-recon; sid:200008209; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/wnbhkfjfoie5ur9/office365",nocase; classtype:attempted-recon; sid:200008210; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/wsdxcvvbnb/bt",nocase; classtype:attempted-recon; sid:200008211; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/xcccjcdhasks/btconnect",nocase; classtype:attempted-recon; sid:200008212; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/xfinityupgrad/home?authuser=3",nocase; classtype:attempted-recon; sid:200008213; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/xfojnbvijozhd-mfjv-bt/office365",nocase; classtype:attempted-recon; sid:200008214; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/xinmywin/bt-business",nocase; classtype:attempted-recon; sid:200008215; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/xmicrosoftoficew/home",nocase; classtype:attempted-recon; sid:200008216; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/xsuooma/bt-business",nocase; classtype:attempted-recon; sid:200008217; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/xuaok/home",nocase; classtype:attempted-recon; sid:200008218; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/xvhfefef/bt-business",nocase; classtype:attempted-recon; sid:200008219; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/yanyan7/bt-business",nocase; classtype:attempted-recon; sid:200008220; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/yktvyessir/bt-business",nocase; classtype:attempted-recon; sid:200008221; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ymaiiil109/",nocase; classtype:attempted-recon; sid:200008222; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/yorku-ca-hayford",nocase; classtype:attempted-recon; sid:200008223; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/youronlneserviceinfo/home?authuser=6",nocase; classtype:attempted-recon; sid:200008224; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/yt89ougjio/bt",nocase; classtype:attempted-recon; sid:200008225; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/ytesdfxfgvjikjnm/bt",nocase; classtype:attempted-recon; sid:200008226; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/zsgkjdhgjitjgbnzl/office365",nocase; classtype:attempted-recon; sid:200008227; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/zxchooloshi/bt",nocase; classtype:attempted-recon; sid:200008228; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sites.google.com",nocase; http_uri; content:"/view/zxcvbnmjkhsdfghj/home",nocase; classtype:attempted-recon; sid:200008229; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sjdkjkdfdk-jnfkff-nfjkfk.s3.amazonaws.com",nocase; http_uri; content:"/index.html",nocase; classtype:attempted-recon; sid:200008230; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"skrtysupport.com",nocase; http_uri; content:"/home/login.php",nocase; classtype:attempted-recon; sid:200008231; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"slack-redir.net",nocase; http_uri; content:"/link?url=http://taijishentie.com/js/index.htm?http://us.battle.net/login/en/?ref=http://xwnrssfus.battle.net/d3/en/index&amp\;app=com-d3",nocase; classtype:attempted-recon; sid:200008232; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"slack-redir.net",nocase; http_uri; content:"/link?url=https://bit.ly/3lefgwg",nocase; classtype:attempted-recon; sid:200008233; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"slack-redir.net",nocase; http_uri; content:"/link?url=https://dhtgfhxfgs.com/doc",nocase; classtype:attempted-recon; sid:200008234; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"smartklick.biz",nocase; http_uri; content:"/?p=gntdomrwme5gi3bpge3temry",nocase; classtype:attempted-recon; sid:200008235; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"solutionsaec-my.sharepoint.com",nocase; http_uri; content:"/:x:/g/personal/jblanquart_solutions-aec_com/eco5jmdevefltbrj2rnwypgbnoisgm3og8kg4u7uxbmefa?e=rge5mf",nocase; classtype:attempted-recon; sid:200008236; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"solutionsaec-my.sharepoint.com",nocase; http_uri; content:"/personal/jblanquart_solutions-aec_com/_layouts/15/doc2.aspx?sourcedoc={602639ca-54c4-4b41-b41a-c9dab9d66298}&amp\;action=default&amp\;slrid=e91ed59f-406c-c000-3041-75a88e0b5689&amp\;originalpath=ahr0chm6ly9zb2x1dglvbnnhzwmtbxkuc2hhcmvwb2ludc5jb20vong6l2cvcgvyc29uywwvamjsyw5xdwfydf9zb2x1dglvbnmtywvjx2nvbs9fy281sm1ervzfrkx0qnjkmnjuv1lwz0jut0ltr20zb0c4a0c0vtd1wejnruzbp3j0aw1lpvlwvu1lrkezmlvn&amp\;cid=abd2b9bf-cc2a-4d1b-b944-a06977d53e19",nocase; classtype:attempted-recon; sid:200008237; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sparkasse-scert.com",nocase; http_uri; content:"/yscf2noceq",nocase; classtype:attempted-recon; sid:200008238; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"spikenow.com",nocase; http_uri; content:"/collab/?id=bhyaaypay0mizbywaw0ockqgxxza6tjjy0mveuavwj6",nocase; classtype:attempted-recon; sid:200008239; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sportrecent.com",nocase; http_uri; content:"/docu084",nocase; classtype:attempted-recon; sid:200008240; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sportrecent.com",nocase; http_uri; content:"/docu084/",nocase; classtype:attempted-recon; sid:200008241; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sqft.co.in",nocase; http_uri; content:"/wp-admin/secumds.org_focusnew/secumds.org_focusnew",nocase; classtype:attempted-recon; sid:200008242; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starnetlegal-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/kimanistarnet_starnetlegal_com_au/_layouts/15/wopiframe.aspx",nocase; classtype:attempted-recon; sid:200008243; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starnetlegal-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/kimanistarnet_starnetlegal_com_au/_layouts/15/wopiframe.aspx?guestaccesstoken=pv890fkaw3j3sxii8ccetsfxta1sij%2fjet9rdeg8oow%3d&docid=1_1c7b4face5780498ab995b86b5b2dcaff&wdformid=%7bbc8906f7%2d715e%2d4df9%2d8716%2d058d26a1426c%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200008244; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starnetlegal-my.sharepoint.com",nocase; http_uri; content:"/personal/kimanistarnet_starnetlegal_com_au/_layouts/15/wopiframe.aspx",nocase; classtype:attempted-recon; sid:200008245; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starnetlegal-my.sharepoint.com",nocase; http_uri; content:"/personal/kimanistarnet_starnetlegal_com_au/_layouts/15/wopiframe.aspx?cid=06b1de42-a36f-49e7-afc9-feebd6a06c07",nocase; classtype:attempted-recon; sid:200008246; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starnetlegal-my.sharepoint.com",nocase; http_uri; content:"/personal/kimanistarnet_starnetlegal_com_au/_layouts/15/wopiframe.aspx?guestaccesstoken=pv890fkaw3j3sxii8ccetsfxta1sij%2fjet9rdeg8oow%3d&docid=1_1c7b4face5780498ab995b86b5b2dcaff&wdformid=%7bbc8906f7%2d715e%2d4df9%2d8716%2d058d26a1426c%7d&action=formsubmit&cid=875889c4-4530-43af-a869-cf468b381692",nocase; classtype:attempted-recon; sid:200008247; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"starnetlegal-my.sharepoint.com",nocase; http_uri; content:"/personal/kimanistarnet_starnetlegal_com_au/_layouts/15/wopiframe2.aspx?",nocase; classtype:attempted-recon; sid:200008248; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"startimes.com",nocase; http_uri; content:"/f.aspx?t=37",nocase; classtype:attempted-recon; sid:200008249; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"steinercoza-my.sharepoint.com",nocase; http_uri; content:"/:b:/g/personal/mandyb_steiner_co_za/exxq1passetnrojoe83fzboboxufoggwb7uvmyfqbionla?e=4:su8jhq&amp\;at=9",nocase; classtype:attempted-recon; sid:200008250; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stephensfloorcovering-my.sharepoint.com",nocase; http_uri; content:"/personal/river_stephensfloorcovering_com/_layouts/15/onedrive.aspx?id=/personal/river_stephensfloorcovering_com/documents/invoice.pdf&amp\;parent=/personal/river_stephensfloorcovering_com/documents&amp\;originalpath=ahr0chm6ly9zdgvwagvuc2zsb29yy292zxjpbmctbxkuc2hhcmvwb2ludc5jb20vomi6l3avcml2zxivrvrjc05taepzaljkczzxsnf6bnpnd2tcuwjucnnzvmfrdezlodnlmzfsthhmqt9ydgltzt10zzdkegvatdjvzw",nocase; classtype:attempted-recon; sid:200008251; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stephensfloorcovering-my.sharepoint.com",nocase; http_uri; content:"/personal/river_stephensfloorcovering_com/_layouts/15/onedrive.aspx?id=/personal/river_stephensfloorcovering_com/documents/invoice.pdf&amp\;parent=/personal/river_stephensfloorcovering_com/documents&amp\;originalpath=ahr0chm6ly9zdgvwagvuc2zsb29yy292zxjpbmctbxkuc2hhcmvwb2ludc5jb20vomi6l3avcml2zxivrvrjc05taepzaljkczzxsnf6bnpnd2tcuwjucnnzvmfrdezlodnlmzfsthhmqt9ydgltzt12dgvinhzotdjvzw",nocase; classtype:attempted-recon; sid:200008252; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stephensfloorcovering-my.sharepoint.com",nocase; http_uri; content:"/personal/river_stephensfloorcovering_com/_layouts/15/onedrive.aspx?id=/personal/river_stephensfloorcovering_com/documents/invoice.pdf&amp\;parent=/personal/river_stephensfloorcovering_com/documents&amp\;originalpath=ahr0chm6ly9zdgvwagvuc2zsb29yy292zxjpbmctbxkuc2hhcmvwb2ludc5jb20vomi6l3avcml2zxivrvrjc05taepzaljkczzxsnf6bnpnd2tcuwjucnnzvmfrdezlodnlmzfsthhmqt9ydgltzt1lblbjd3zotdjvzw",nocase; classtype:attempted-recon; sid:200008253; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stephensfloorcovering-my.sharepoint.com:443",nocase; http_uri; content:"/:b:/p/river/etcsnshjyjrjs6qjqznzgwkbqbnrsyvaktfk83k31llxfa?e=4:gr4asj&amp\;at=9",nocase; classtype:attempted-recon; sid:200008254; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stimulusgovt.com",nocase; http_uri; content:"/apply-now/",nocase; classtype:attempted-recon; sid:200008255; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stolizaparketa.ru",nocase; http_uri; content:"/wp-content/themes/twentyfifteen/css/read/chinavali/index.php?email=jsmith@imaphost.com",nocase; classtype:attempted-recon; sid:200008256; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/1lordman1man3/kelmanco2.html#user@cslanet.calstatela.edu",nocase; classtype:attempted-recon; sid:200008257; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/1lordman1man3/oscman.html",nocase; classtype:attempted-recon; sid:200008258; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/1lordman1man3/oscman.html#samba@jubileegroup.co.uk",nocase; classtype:attempted-recon; sid:200008259; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/1lordman1man3/oscman2.html#@osgoode.yorku.ca",nocase; classtype:attempted-recon; sid:200008260; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/1lordman1man3/oscman2.html#user@calstatela.edu",nocase; classtype:attempted-recon; sid:200008261; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/1lordman1man3/oscman2.html#user@cslanet.calstatela.edu",nocase; classtype:attempted-recon; sid:200008262; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/algebraic-pact-316913.appspot.com/index.html#jbell@legalshield.com",nocase; classtype:attempted-recon; sid:200008263; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/appspotv450i7r8h9vf9y6yt8uiuft58f7uf5yye36u0jtyf78uuyfyy/index.html",nocase; classtype:attempted-recon; sid:200008264; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/aurrhorot3a3xwr03orxwxwuowas.appspot.com/index.html#craig@legalshield.com",nocase; classtype:attempted-recon; sid:200008265; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/aurrhorot3a3xwr03orxwxwuowas.appspot.com/index.html#frank.o@legalshield.com",nocase; classtype:attempted-recon; sid:200008266; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/aurrhorot3a3xwr03orxwxwuowas.appspot.com/index.html#stevewilliamson@legalshield.com",nocase; classtype:attempted-recon; sid:200008267; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/be8be8qabe88aqpa8userpp.appspot.com/index.html#stevewilliamson@legalshield.com",nocase; classtype:attempted-recon; sid:200008268; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/ciat3tdtttd53c3e5userp.appspot.com/index.html#jr@legalshield.com",nocase; classtype:attempted-recon; sid:200008269; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/ciat3tdtttd53c3e5userp.appspot.com/index.html#laura@legalshield.com",nocase; classtype:attempted-recon; sid:200008270; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/ciat3tdtttd53c3e5userp.appspot.com/index.html#paul@legalshield.com",nocase; classtype:attempted-recon; sid:200008271; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/cq22cc22a0wqcaawasauerip.appspot.com/index.html#a.roldan@legalshield.com",nocase; classtype:attempted-recon; sid:200008272; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/dhngw6p6rwrwnuv6vnuse.appspot.com/index.html#brianvillacarlos@legalshieldcorp.com",nocase; classtype:attempted-recon; sid:200008273; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/dhngw6p6rwrwnuv6vnuse.appspot.com/index.html#stevewilliamson@legalshield.com",nocase; classtype:attempted-recon; sid:200008274; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/employt44to49cclrlolcrl94lnlxo.appspot.com/index.html#mclifton36@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200008275; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/g58t3e588ddgmdeddauth.appspot.com/index.html#jbell@legalshield.com",nocase; classtype:attempted-recon; sid:200008276; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/g58t3e588ddgmdeddauth.appspot.com/index.html#jim-shelvy@legalshield.com",nocase; classtype:attempted-recon; sid:200008277; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/genuine-rope-318401.appspot.com/index.html#stevewilliamson@legalshield.com",nocase; classtype:attempted-recon; sid:200008278; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/kkkqkl633qn6kq3lqssiiddnenen.appspot.com/index.html#jbell@legalshield.com",nocase; classtype:attempted-recon; sid:200008279; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/kkkqkl633qn6kq3lqssiiddnenen.appspot.com/index.html#roger@legalshield.com",nocase; classtype:attempted-recon; sid:200008280; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/kkkqkl633qn6kq3lqssiiddnenen.appspot.com/index.html#rosalefua@legalshield.com",nocase; classtype:attempted-recon; sid:200008281; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/kkkqkl633qn6kq3lqssiiddnenen.appspot.com/index.html#stevewilliamson@legalshield.com",nocase; classtype:attempted-recon; sid:200008282; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/kkkqkl633qn6kq3lqssiiddnenen.appspot.com/index.html#t.voit@legalshield.com",nocase; classtype:attempted-recon; sid:200008283; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/maintainancecomponeta.appspot.com/donperezbigsam.html#@yorku.ca",nocase; classtype:attempted-recon; sid:200008284; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/maintainancecomponeta.appspot.com/fcocwetindex.html",nocase; classtype:attempted-recon; sid:200008285; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/maintainancecomponeta.appspot.com/kayindex.html#eimaste@stinpriza.org",nocase; classtype:attempted-recon; sid:200008286; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/maintainancecomponeta.appspot.com/kayindex.html#jbcavin@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200008287; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/maintainancecomponeta.appspot.com/kayindex.html#jtucker@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200008288; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/maintainancecomponeta.appspot.com/kayindex.html#rikeoka@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200008289; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/maintainancecomponeta.appspot.com/mineindex.html#@yorku.ca",nocase; classtype:attempted-recon; sid:200008290; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/maintainancecomponeta.appspot.com/sydlasguygendomain.html",nocase; classtype:attempted-recon; sid:200008291; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/noomooonplotoon-ogt0098709lot/mlindex.html#user@domain.org",nocase; classtype:attempted-recon; sid:200008292; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/officpcpspbcncuser.appspot.com/index.htm#jbell@legalshield.com",nocase; classtype:attempted-recon; sid:200008293; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/ost9ptpttt9ttztqpttt9tureh.appspot.com/index.html",nocase; classtype:attempted-recon; sid:200008294; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/ost9ptpttt9ttztqpttt9tureh.appspot.com/index.html#antonio@legalshield.com",nocase; classtype:attempted-recon; sid:200008295; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/ost9ptpttt9ttztqpttt9tureh.appspot.com/index.html#hmark@legalshield.com",nocase; classtype:attempted-recon; sid:200008296; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/ost9ptpttt9ttztqpttt9tureh.appspot.com/index.html#me@legalshield.com",nocase; classtype:attempted-recon; sid:200008297; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/owuddqd9dqqdddq9qd0caerq.appspot.com/index.html#stevewilliamson@legalshield.com",nocase; classtype:attempted-recon; sid:200008298; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/prprhrhprc.appspot.com/index.htm#oncall-infra@eqiom.com",nocase; classtype:attempted-recon; sid:200008299; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/qq85e0p8ae05qb55buser.appspot.com/index.html#jbell@legalshield.com",nocase; classtype:attempted-recon; sid:200008300; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/r0090a0p0090pb0ppba9owan.appspot.com/index.html#a@b.com",nocase; classtype:attempted-recon; sid:200008301; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/rqraaqqax3xa.appspot.com/index.htm#memberservices@legalshield.com",nocase; classtype:attempted-recon; sid:200008302; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/rqraaqqax3xa.appspot.com/index.htm#no@nope.com",nocase; classtype:attempted-recon; sid:200008303; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/servicech3kernow/index",nocase; classtype:attempted-recon; sid:200008304; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/staging.maintainancecomponeta.appspot.com/bsnnindex.html",nocase; classtype:attempted-recon; sid:200008305; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/staging.maintainancecomponeta.appspot.com/fcocnew.html",nocase; classtype:attempted-recon; sid:200008306; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/user517497679326978.appspot.com/index.html",nocase; classtype:attempted-recon; sid:200008307; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/user517497679326978.appspot.com/index.html#samsnow@tjsnow.com",nocase; classtype:attempted-recon; sid:200008308; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/user7773578ixh1092839.appspot.com/index.html",nocase; classtype:attempted-recon; sid:200008309; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/user7773578ixh1092839.appspot.com/index.html#estewart30@legalshield.com",nocase; classtype:attempted-recon; sid:200008310; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/user7773578ixh1092839.appspot.com/index.html#john.smith@gmail.com",nocase; classtype:attempted-recon; sid:200008311; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/uth0uax3t3uh30ttna0nnuser.appspot.com/index.html#jbell@legalshield.com",nocase; classtype:attempted-recon; sid:200008312; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/uth0uax3t3uh30ttna0nnuser.appspot.com/index.html#kpinson@legalshield.com",nocase; classtype:attempted-recon; sid:200008313; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/xzrdzcdruerp.appspot.com/index.html#ricardo.rodriguez@cgexchange.org",nocase; classtype:attempted-recon; sid:200008314; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/y5r50f5ur5ryufsu66rruser.appspot.com/index.htm#a.roldan@legalshield.com",nocase; classtype:attempted-recon; sid:200008315; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/yyw77ywnn68weyew6euserq.appspot.com/index.html#azaleajones@legalshield.com",nocase; classtype:attempted-recon; sid:200008316; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/yyw77ywnn68weyew6euserq.appspot.com/index.html#gerzineduncan@legalshield.com",nocase; classtype:attempted-recon; sid:200008317; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/yyw77ywnn68weyew6euserq.appspot.com/index.html#leta@legalshield.com",nocase; classtype:attempted-recon; sid:200008318; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/yyw77ywnn68weyew6euserq.appspot.com/index.html#roger@legalshield.com",nocase; classtype:attempted-recon; sid:200008319; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.cloud.google.com",nocase; http_uri; content:"/yyw77ywnn68weyew6euserq.appspot.com/index.html#rosalefua@legalshield.com",nocase; classtype:attempted-recon; sid:200008320; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/1827435283/1827435283.html",nocase; classtype:attempted-recon; sid:200008321; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/advertorial010/789654nu57r.html",nocase; classtype:attempted-recon; sid:200008322; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/awydjhabjcakucajjbhsa7.appspot.com/eafdcas/kakvajdbvkjdbadvujk.html",nocase; classtype:attempted-recon; sid:200008323; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/emailaccess324/gho/indexautoss.html?email=identitytheft@legalshield.com",nocase; classtype:attempted-recon; sid:200008324; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/emailaccess324/gho/indexautoss.html?email=user@domain.ch",nocase; classtype:attempted-recon; sid:200008325; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/emailaccess324/gho/indexautoss.html?email=user@example.org",nocase; classtype:attempted-recon; sid:200008326; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/hmosrwfggcwzbcyjpndfmmzbpmaxzdiq/yrtyrhgfghvhgftrytdfghchgrtyfghcvghfhgdw.html",nocase; classtype:attempted-recon; sid:200008327; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/lopmpm/dfgdfg.html#/redirect.html?od=1syq612292b23e0fb_vl_weekvl_0zak.cvswn0.c0000r2jnzr1b453i9_xn1270.2jnzrmdviedjjltbtbzlkc3q0t59rh",nocase; classtype:attempted-recon; sid:200008328; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/navy/nfcu.htm",nocase; classtype:attempted-recon; sid:200008329; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/ngicwagnbntzrwhnkodcqgicigddbzkl/yrtyrhyhghsfgfzrzpoiortyfghcvghfhgdw.html",nocase; classtype:attempted-recon; sid:200008330; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/ntwe4nkt4e.appspot.com/20770.html",nocase; classtype:attempted-recon; sid:200008331; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/otlinks/trafrp.html",nocase; classtype:attempted-recon; sid:200008332; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/prgxsqydsktkvzgnkrnhyrmwewzmfnd/yturfggtrefgfkuhfddpoicfwrtetyrtfseuytrw.html",nocase; classtype:attempted-recon; sid:200008333; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/regularizeambiente/acesso.html",nocase; classtype:attempted-recon; sid:200008334; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/segurocomcliente/acesso.html",nocase; classtype:attempted-recon; sid:200008335; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/ylffhg/redireck.html",nocase; classtype:attempted-recon; sid:200008336; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/ylffhg/redirecvxxx.html",nocase; classtype:attempted-recon; sid:200008337; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/ylffhg/redplan.html",nocase; classtype:attempted-recon; sid:200008338; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.googleapis.com",nocase; http_uri; content:"/zloogqmltxvgfjbtlbfvuoewunkzscyr/ytrtyrcgfserdffeaezddfyiouiuyutytrw.html",nocase; classtype:attempted-recon; sid:200008339; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"storage.ning.com",nocase; http_uri; content:"/topology/rest/1.0/file/get/8122054091/",nocase; classtype:attempted-recon; sid:200008340; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stormadjust.com",nocase; http_uri; content:"/ex/excel/quotation",nocase; classtype:attempted-recon; sid:200008341; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stormadjust.com",nocase; http_uri; content:"/ex/excel/quotation/",nocase; classtype:attempted-recon; sid:200008342; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stormadjust.com",nocase; http_uri; content:"/ex/excel/quotation/algoni.php",nocase; classtype:attempted-recon; sid:200008343; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stormadjust.com",nocase; http_uri; content:"/ex/excel/quotation/algoni.php?cmd=login_submit&amp\;id=67f44f34b1007a28ef8be6ac1ef336c867f44f34b1007a28ef8be6ac1ef336c8&amp\;session=67f44f34b1007a28ef8be6ac1ef336c867f44f34b1007a28ef8be6ac1ef336c8",nocase; classtype:attempted-recon; sid:200008344; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stormadjust.com",nocase; http_uri; content:"/ex/excel/quotation/algoni.php?cmd=login_submit&id=666086fc9b4d91c39a0d03e11816dd1c666086fc9b4d91c39a0d03e11816dd1c&session=666086fc9b4d91c39a0d03e11816dd1c666086fc9b4d91c39a0d03e11816dd1c",nocase; classtype:attempted-recon; sid:200008345; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"stormadjust.com",nocase; http_uri; content:"/ex/excel/quotation/algoni.php?cmd=login_submit&id=c2ce40f177bea74a0727867fafcbc454c2ce40f177bea74a0727867fafcbc454&session=c2ce40f177bea74a0727867fafcbc454c2ce40f177bea74a0727867fafcbc454",nocase; classtype:attempted-recon; sid:200008346; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"structin-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/p_brouwer_structin_nl/ehu4nhcxmmlmrmou4we1fpsb5lqpufe4sslse_xjh33dea?e=9dtcpc",nocase; classtype:attempted-recon; sid:200008347; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"studentsimperial-my.sharepoint.com",nocase; http_uri; content:"/personal/vcarrion_students_imperial_edu/_layouts/15/wopiframe.aspx?guestaccesstoken=rvz44awzcpdubusreabukfouvj04snc94kmlpod04h4%3d&amp\;docid=1_1acb4510b85ac413f9ea166e72d4bbca4&amp\;wdformid=%7b3cad2e15%2d9297%2d423e%2d87b0%2db890b72dfaa2%7d&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200008348; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"studentsimperial-my.sharepoint.com",nocase; http_uri; content:"/personal/vcarrion_students_imperial_edu/_layouts/15/wopiframe.aspx?guestaccesstoken=rvz44awzcpdubusreabukfouvj04snc94kmlpod04h4%3d&docid=1_1acb4510b85ac413f9ea166e72d4bbca4&wdformid=%7b3cad2e15%2d9297%2d423e%2d87b0%2db890b72dfaa2%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200008349; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sumeret.com",nocase; http_uri; content:"/wp.chinadomin/china/?login=replaced@us.sika.com&amp\;mc_phishing_protection_id=28396-c4a8rukna38tf30kt56g",nocase; classtype:attempted-recon; sid:200008350; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sumeret.com",nocase; http_uri; content:"/wp.chinadomin/china?login=replaced@us.sika.com&amp\;mc_phishing_protection_id=28396-c4a8rukna38tf30kt56g",nocase; classtype:attempted-recon; sid:200008351; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"sunypotsdam-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/caniasj_potsdam_edu/_layouts/15/wopiframe.aspx?guestaccesstoken=3iraoz5qrcw0w4%2frehotcj25mgvldlzenlokue%2bfudw%3d&docid=1_10850bdc012e8450fb8f3297a80b3ecbb&wdformid=%7b955fb703-afe5-44b1-b0ca-d52fccb3199c%7d&action=formsubmit&cid=5df7ddf9-38f3-4abe-b529-7a3c4779e246",nocase; classtype:attempted-recon; sid:200008352; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"superpark-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/adrian_ramos_superpark_com_hk/_layouts/15/wopiframe.aspx?guestaccesstoken=vofjngnui%2fslbameorlq62qlg8mcdnpo1dizu6i%2bc1m%3d&amp\;docid=1_124bbb2f682ca4c7daba6cec6ee34dfb9&amp\;wdformid=%7ba85c8abe%2d68be%2d43dd%2d91f3%2db397386186be%7d&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200008353; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"support-amazonreport.com",nocase; http_uri; content:"/72234/",nocase; classtype:attempted-recon; sid:200008354; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/5e23c40fb533f62621f5252d#form/0",nocase; classtype:attempted-recon; sid:200008355; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/5e5b8d772e417841d96ee7af#form/0",nocase; classtype:attempted-recon; sid:200008356; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/5f7840827687c759eed006a1#welcome",nocase; classtype:attempted-recon; sid:200008357; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/608bca7586919c70a2066ef7",nocase; classtype:attempted-recon; sid:200008358; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60a058fc9006c7136837a91d#welcome",nocase; classtype:attempted-recon; sid:200008359; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60a94371b2b62b3fc765f8d6#form/0",nocase; classtype:attempted-recon; sid:200008360; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60a965d7f248866d4bfaa2e1",nocase; classtype:attempted-recon; sid:200008361; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60b6ccf8f448b239642ef416#welcome",nocase; classtype:attempted-recon; sid:200008362; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60bda82df448b2396434c877",nocase; classtype:attempted-recon; sid:200008363; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60bda82df448b2396434c877#form/0",nocase; classtype:attempted-recon; sid:200008364; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60c1eb6bda9e5d578a03ff44#welcome",nocase; classtype:attempted-recon; sid:200008365; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60c7e129d519fc79691fa39e#welcome",nocase; classtype:attempted-recon; sid:200008366; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60c9c5d0f448b2396441605e#form/0",nocase; classtype:attempted-recon; sid:200008367; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60e16548acc3670c142bc20f",nocase; classtype:attempted-recon; sid:200008368; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60f4eb89eec7723cc29b78c0",nocase; classtype:attempted-recon; sid:200008369; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60f4eb89eec7723cc29b78c0#form/0",nocase; classtype:attempted-recon; sid:200008370; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60fa5369257c2c6100a5f1b1#form/0",nocase; classtype:attempted-recon; sid:200008371; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveyheart.com",nocase; http_uri; content:"/form/60fa5369257c2c6100a5f1b1#welcome",nocase; classtype:attempted-recon; sid:200008372; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"surveylegend.com",nocase; http_uri; content:"/s/2vze",nocase; classtype:attempted-recon; sid:200008373; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"svkmmumbai-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/pranjali_chandurkar_nmims_edu/_layouts/15/wopiframe.aspx?guestaccesstoken=668cyp4s%2fwcmx8rj223bvjfwdvtryffzfpyarbrueha%3d&amp\;docid=1_1916b69db182644fead12e874cad930c4&amp\;wdformid=%7bcd4093b9%2ddfae%2d49f1%2dadde%2df32fbe93b271%7d&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200008374; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"swisscoat.com.cn",nocase; http_uri; content:"/index.html",nocase; classtype:attempted-recon; sid:200008375; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"switch.com.kw",nocase; http_uri; content:"/.kw",nocase; classtype:attempted-recon; sid:200008376; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"switch.com.kw",nocase; http_uri; content:"/.kw/",nocase; classtype:attempted-recon; sid:200008377; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"switch.com.kw",nocase; http_uri; content:"/.si/",nocase; classtype:attempted-recon; sid:200008378; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/4idnrqspjc?amp=1",nocase; classtype:attempted-recon; sid:200008379; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/8oqjd0lcjo?amp=1?trackingid=chrzmpae&amp\;signature=newsletter",nocase; classtype:attempted-recon; sid:200008380; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/bez0scjtp9?amp=1?id=htgsjhisuu",nocase; classtype:attempted-recon; sid:200008381; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/bznnttpwyc?amp=1?trackingid=lhgy4czf&amp\;signature=newsletter",nocase; classtype:attempted-recon; sid:200008382; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/egwwg2u26h?amp=1",nocase; classtype:attempted-recon; sid:200008383; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/ejvjcj61gf?amp=1",nocase; classtype:attempted-recon; sid:200008384; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/eyojzroijp?amp=1",nocase; classtype:attempted-recon; sid:200008385; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/gkg8qifan6",nocase; classtype:attempted-recon; sid:200008386; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/h7acl0jhzk",nocase; classtype:attempted-recon; sid:200008387; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/h7acl0jhzk?amp=1?trackingid=ncpvnlmx&signature=newsletter",nocase; classtype:attempted-recon; sid:200008388; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/hau7jfzq6w?amp=1?trackingid=duv7ggf5&amp\;signature=newsletter",nocase; classtype:attempted-recon; sid:200008389; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/hau7jfzq6w?amp=1?trackingid=upvqjzrm&amp\;signature=newsletter",nocase; classtype:attempted-recon; sid:200008390; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/hau7jfzq6w?amp=1?trackingid=v3hqk4lo&amp\;signature=newsletter",nocase; classtype:attempted-recon; sid:200008391; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/mo6udulxss?amp=1",nocase; classtype:attempted-recon; sid:200008392; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/o0qawzpm7a?amp=1?trackingid=oz9ujyp7&signature=newsletter",nocase; classtype:attempted-recon; sid:200008393; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/pidf3lkzfq?amp=1",nocase; classtype:attempted-recon; sid:200008394; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/vq4q53mozw?amp=1",nocase; classtype:attempted-recon; sid:200008395; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/xysalvvopk?amp=1",nocase; classtype:attempted-recon; sid:200008396; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/yzq6afs3sj?amp=1",nocase; classtype:attempted-recon; sid:200008397; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.co",nocase; http_uri; content:"/zrd6j5rq4u?amp=1",nocase; classtype:attempted-recon; sid:200008398; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.mail-svc.evernote.com",nocase; http_uri; content:"/f/a/7vnazmxjrqjeu2yhcuso2a~~/aadd_wa~/rgri2drap0qxahr0chm6ly9rbm93bgvkz2vhbmr0cmfpbmluzy5jb20vbwvkymlsbhnwyxkymdixl1cdc3bjqgpg9dq19wcmnbtxuhptyw50b3zhbmkuyw5kcmvhqgdtywlslmnvbvgeaaaabg~~",nocase; classtype:attempted-recon; sid:200008399; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"t.marketing1.william-reed.com",nocase; http_uri; content:"/r/?id=h4b503239,418a056e,416f6e60",nocase; classtype:attempted-recon; sid:200008400; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tawk.link",nocase; http_uri; content:"/5e9f607835bcbb0c9ab3656a/t/new-ticket/d3e5f86dddb76aaf581d0c09b5b91b2c034004c0/task_payment_doe1.pdf",nocase; classtype:attempted-recon; sid:200008401; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tbbalpharetta.com",nocase; http_uri; content:"/wellsfargo_login/wells.htm",nocase; classtype:attempted-recon; sid:200008402; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tbbalpharetta.com",nocase; http_uri; content:"/wellsfargo_login?email=undefined",nocase; classtype:attempted-recon; sid:200008403; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tcta-my.sharepoint.com",nocase; http_uri; content:"/:w:/g/personal/covid_tcta_co_za1/ebjxoc27czhhowhytqdp-3ibzjxhp5dd9_a-vm8e5vzs0a?e=tehygt",nocase; classtype:attempted-recon; sid:200008404; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"teamgrouppcl-my.sharepoint.com",nocase; http_uri; content:"/:u:/g/personal/nongluck_m_attconsult_com/eumhzaoxwpngi0mled8_gs0blnumsbrsk_gjzqcnte543g?download=1&amp\;utm_content=newclient&amp\;utm_campaign=website&amp\;utm_source=julywazepromo&amp\;utm_medium=email",nocase; classtype:attempted-recon; sid:200008405; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tecsuport.com.br",nocase; http_uri; content:"/files/system32/procesosdeseguridadhb/170.51.165.16679791/agregar/telefono/contacto/logonoperacionservlet.html",nocase; classtype:attempted-recon; sid:200008406; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"telegra.ph",nocase; http_uri; content:"/pua-10-09",nocase; classtype:attempted-recon; sid:200008407; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"telenorkandklimsupoort.blogspot.com",nocase; http_uri; content:"/2021/03/blog-post_48.html",nocase; classtype:attempted-recon; sid:200008408; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"test102760.test-account.com",nocase; http_uri; content:"/at&t-login.htm",nocase; classtype:attempted-recon; sid:200008409; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"test103126.test-account.com",nocase; http_uri; content:"/at&t-login.htm",nocase; classtype:attempted-recon; sid:200008410; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"thedigirocket.com",nocase; http_uri; content:"/wp-content/plugins/form.htm",nocase; classtype:attempted-recon; sid:200008411; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"themarbleshop.sharepoint.com",nocase; http_uri; content:"/:x:/r/_layouts/15/wopiframe.aspx?guestaccesstoken=b0tjq7uw13ohhsvlvr6vq189xb2ed7p3yoiuxgzs5xu%3d&amp\;docid=1_127b97513b5664db7a2c23beec6cbdf50&amp\;wdformid=%7b8bd84c70-967f-4172-8b3b-973c5f74f5a8%7d&amp\;action=formsubmit&amp\;cid=18e6e320-2aeb-4aa0-befe-ed946b2e8bd0",nocase; classtype:attempted-recon; sid:200008412; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tiny.one",nocase; http_uri; content:"/mj76nxhf",nocase; classtype:attempted-recon; sid:200008413; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/2742uwk2",nocase; classtype:attempted-recon; sid:200008414; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/335nb9dd?email=user@calstatela.edu",nocase; classtype:attempted-recon; sid:200008415; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/3j3k2mzd",nocase; classtype:attempted-recon; sid:200008416; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/48rzxpne",nocase; classtype:attempted-recon; sid:200008417; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/5mhr8xz2",nocase; classtype:attempted-recon; sid:200008418; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/b8wjtbep",nocase; classtype:attempted-recon; sid:200008419; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/btinternet56",nocase; classtype:attempted-recon; sid:200008420; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/di9mnobebi",nocase; classtype:attempted-recon; sid:200008421; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/evyu688y",nocase; classtype:attempted-recon; sid:200008422; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/kdtvp",nocase; classtype:attempted-recon; sid:200008423; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/m6t9puyd",nocase; classtype:attempted-recon; sid:200008424; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/n2p8adtb?email=ndanatsei.nyamhunga@sc.comorganization",nocase; classtype:attempted-recon; sid:200008425; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/nycgovtgrant",nocase; classtype:attempted-recon; sid:200008426; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/relief-for-pandemic",nocase; classtype:attempted-recon; sid:200008427; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/sd9t35n/?cliente=multiconexoes@terra.com.br/jhyyw8hlac3s5ao9r7mr22fe/imprimir.cgi",nocase; classtype:attempted-recon; sid:200008428; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/toqjl4j/?email=firstregistration6@dvla.gov.uk",nocase; classtype:attempted-recon; sid:200008429; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/v73y9jk",nocase; classtype:attempted-recon; sid:200008430; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/y2czr3ag",nocase; classtype:attempted-recon; sid:200008431; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/y3hkttk5",nocase; classtype:attempted-recon; sid:200008432; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/y3xk7mt7/",nocase; classtype:attempted-recon; sid:200008433; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/yhgdwa3h",nocase; classtype:attempted-recon; sid:200008434; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/yxb48kqj",nocase; classtype:attempted-recon; sid:200008435; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/yxry9vf5",nocase; classtype:attempted-recon; sid:200008436; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tinyurl.com",nocase; http_uri; content:"/yyvm8qr5",nocase; classtype:attempted-recon; sid:200008437; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"toancaupumps.com",nocase; http_uri; content:"/bk/v.html",nocase; classtype:attempted-recon; sid:200008438; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tong464-my.sharepoint.com",nocase; http_uri; content:"/personal/parevalo_tong464_org/_layouts/15/onedrive.aspx?id=/personal/parevalo_tong464_org/documents/northgate.pdf&amp\;parent=/personal/parevalo_tong464_org/documents&amp\;originalpath=ahr0chm6ly90b25nndy0lw15lnnoyxjlcg9pbnquy29tlzpioi9nl3blcnnvbmfsl3bhcmv2ywxvx3rvbmc0njrfb3jnl0vvq0nhshlxmflkrxa5cm1ravlyzklnqjfiz2jsvghqowroel9evvbxumvvngc_cnrpbwu9q0lkatrhlveyrwc",nocase; classtype:attempted-recon; sid:200008439; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tr.im",nocase; http_uri; content:"/alertaslbcp",nocase; classtype:attempted-recon; sid:200008440; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tracking-posta.sk.dellcont.com.br",nocase; http_uri; content:"/3b1c3966f252225/",nocase; classtype:attempted-recon; sid:200008441; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"translate.sogoucdn.com",nocase; http_uri; content:"/pcvtsnapshotorigin?_t=1527230263291&amp\;from=en&amp\;notrans=0&amp\;query=&amp\;tabmode=1&amp\;tfr=englishpc&amp\;to=zh-chs&amp\;url=https://www.wellsfargo.com",nocase; classtype:attempted-recon; sid:200008442; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"translate.sogoucdn.com",nocase; http_uri; content:"/pcvtsnapshotorigin?_t=1572026205262%20open_in_new%20add%20link&amp\;from=en&amp\;notrans=0&amp\;query=paypal%20account&amp\;tabmode=2&amp\;tfr=englishpc&amp\;to=zh-chs&amp\;url=https://www.paypal.com/us/signin",nocase; classtype:attempted-recon; sid:200008443; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"translate.sogoucdn.com",nocase; http_uri; content:"/pcvtsnapshotorigin?url=https://www.paypal.com/us/signin&amp\;query=paypal%20account&amp\;tabmode=2&amp\;n",nocase; classtype:attempted-recon; sid:200008444; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"translate.sogoucdn.com",nocase; http_uri; content:"/pcvtsnapshotorigin?url=https://www.paypal.com/us/signin&amp\;query=paypal%20account&amp\;tabmode=2&amp\;notrans=0&amp\;tfr=englishpc&amp\;from=en&amp\;to=zh-chs&amp\;securl=&amp\;_t=1572026205262%20open_in_new%20add%20link%20open_in_new%20add%20link",nocase; classtype:attempted-recon; sid:200008445; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"tregollsschool-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/dbullen_tregolls_cornwall_sch_uk/_layouts/15/wopiframe.aspx?guestaccesstoken=4w7nbxyv%2be5q5h6ifvqsvt%2ba0azuzpfgpywxpwtq6mu%3d&amp\;docid=1_1114d83a63e0f489b93e746d8b241db70&amp\;wdformid=%7bfff4536c%2d404d%2d410d%2da3b7%2d4cc8a8841296%7d&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200008446; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"triathlonontario-my.sharepoint.com",nocase; http_uri; content:"/:x:/r/personal/ed_triathlonontario_com/_layouts/15/wopiframe.aspx?guestaccesstoken=tx4pjpe6j3l456dw6h5p4rjclnpql4gy3umalpcsbgc%3d&docid=1_15c1c05a0348c406b917721edd22b400e&wdformid=%7b743b2d9a-465e-4a2d-a672-3b480e7184ff%7d&action=formsubmit&cid=2b766ac1-60f6-4883-8ff0-3a53524a1f1c",nocase; classtype:attempted-recon; sid:200008447; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"triathlonontario-my.sharepoint.com",nocase; http_uri; content:"/personal/ed_triathlonontario_com/_layouts/15/wopiframe.aspx?guestaccesstoken=tx4pjpe6j3l456dw6h5p4rjclnpql4gy3umalpcsbgc%3d&docid=1_15c1c05a0348c406b917721edd22b400e&wdformid=%7b743b2d9a-465e-4a2d-a672-3b480e7184ff%7d&action=formsubmit&cid=2b766ac1-60f6-4883-8ff0-3a53524a1f1c",nocase; classtype:attempted-recon; sid:200008448; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u.to",nocase; http_uri; content:"/32megq",nocase; classtype:attempted-recon; sid:200008449; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u.to",nocase; http_uri; content:"/479857v984h7je9fuke987thd9e8jt7fr48e9th7e8f9csjudiufydskj/xrkggw",nocase; classtype:attempted-recon; sid:200008450; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u.to",nocase; http_uri; content:"/_picgw?yhjzos7ve80",nocase; classtype:attempted-recon; sid:200008451; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u.to",nocase; http_uri; content:"/isx3gg?notification-identity-office",nocase; classtype:attempted-recon; sid:200008452; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u.to",nocase; http_uri; content:"/umxggg",nocase; classtype:attempted-recon; sid:200008453; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u.to",nocase; http_uri; content:"/unrpgg",nocase; classtype:attempted-recon; sid:200008454; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"u.to",nocase; http_uri; content:"/wsddga",nocase; classtype:attempted-recon; sid:200008455; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"umconnectumt-my.sharepoint.com",nocase; http_uri; content:"/personal/es127759_umconnect_umt_edu/_layouts/15/wopiframe.aspx?guestaccesstoken=e%2f5p4lmr7oxtbuuzst9ihpacebtz%2bhbogl5i950bhau%3d&docid=1_151b39d9e7dd54cfba500875349d3beb6&wdformid=%7bda6fcad9%2d9684%2d43af%2db959%2de2fa774eaba6%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200008456; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"umconnectumt-my.sharepoint.com",nocase; http_uri; content:"/personal/es127759_umconnect_umt_edu/_layouts/15/wopiframe.aspx?guestaccesstoken=h2b5qkvlooc%2bfvhpo6qkbxdfdzwzpa7doqhaikfrj08%3d&docid=1_1cab74931edec4bf39e6f4768e7830a02&wdformid=%7b6a702647%2db560%2d40c5%2d8890%2d109ec5ad9bc5%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200008457; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"umconnectumt-my.sharepoint.com",nocase; http_uri; content:"/personal/es127759_umconnect_umt_edu/_layouts/15/wopiframe.aspx?guestaccesstoken=inau9tsjk5bvaoypx/gfkvgo0iz4rq47kvts4tkb8yq=&amp\;docid=1_19c7a48ea3a0448c78765a480857920f0&amp\;wdformid={d8f70a7d-4204-4a87-a88e-bad6b0e4129e}&amp\;action=formsubmit",nocase; classtype:attempted-recon; sid:200008458; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"umconnectumt-my.sharepoint.com",nocase; http_uri; content:"/personal/es127759_umconnect_umt_edu/_layouts/15/wopiframe.aspx?guestaccesstoken=uh9hjveaooebgqolme%2f5qft71pw2stg2ojiiqxebzce%3d&docid=1_11e28ca5d86c6416f926736ea3e8ad885&wdformid=%7b70256f91%2df178%2d4e5f%2d847a%2df748294a79c9%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200008459; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"umeacademy.com",nocase; http_uri; content:"/wine",nocase; classtype:attempted-recon; sid:200008460; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unauthorised-request.com",nocase; http_uri; content:"/lloyds",nocase; classtype:attempted-recon; sid:200008461; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unauthorised-request.com",nocase; http_uri; content:"/lloyds/",nocase; classtype:attempted-recon; sid:200008462; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unauthorised-request.com",nocase; http_uri; content:"/lloyds/login.php",nocase; classtype:attempted-recon; sid:200008463; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unauthorisedpayeerequest.com",nocase; http_uri; content:"/lloyds",nocase; classtype:attempted-recon; sid:200008464; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unclaimed-moneysearch.com",nocase; http_uri; content:"/?pid=405&utm_source=405&utm_campaign=405&chk=1&cid=669ca57cbbc8475ba2314fd339e262c0",nocase; classtype:attempted-recon; sid:200008465; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unef.edu.br",nocase; http_uri; content:"/mofiles/z1v17xnm2o211yxxs9qsg0kq.php?secure&share=5ii6i3161907542327469989da34b13e2e4cfafd9127aa1127469989da34b13e2e4cfafd9127aa1127469989da34b13e2e4cfafd9127aa1127469989da34b13e2e4cfafd9127aa1127469989da34b13e2e4cfafd9127aa11",nocase; classtype:attempted-recon; sid:200008466; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unef.edu.br",nocase; http_uri; content:"/oldfile/4ve4ydqk581f45nsvwwoshtu.php",nocase; classtype:attempted-recon; sid:200008467; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unef.edu.br",nocase; http_uri; content:"/oldfile/proposal/common/?login.srf",nocase; classtype:attempted-recon; sid:200008468; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unef.edu.br",nocase; http_uri; content:"/ues/swe/signln.php?email=nooruddin@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200008469; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unef.edu.br",nocase; http_uri; content:"/verify/login.php?cmd=login_submit&amp\;id=2f450dca7d9c5757fdd8f47c3521c9cd2f450dca7d9c5757fdd8f47c3521c9cd&amp\;session=2f450dca7d9c5757fdd8f47c3521c9cd2f450dca7d9c5757fdd8f47c3521c9cd",nocase; classtype:attempted-recon; sid:200008470; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unef.edu.br",nocase; http_uri; content:"/verify/login.php?cmd=login_submit&amp\;id=b031e524548632bda97c28367fe1d929b031e524548632bda97c28367fe1d929&amp\;session=b031e524548632bda97c28367fe1d929b031e524548632bda97c28367fe1d929",nocase; classtype:attempted-recon; sid:200008471; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unef.edu.br",nocase; http_uri; content:"/verify/step2.php",nocase; classtype:attempted-recon; sid:200008472; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unef.edu.br",nocase; http_uri; content:"/verify/step3.php",nocase; classtype:attempted-recon; sid:200008473; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unef.edu.br",nocase; http_uri; content:"/xec/ain/excelz/bizmail.php?email=&amp\;.rand=13vqcr8bp0gud&amp\;lc=1033&amp\;id=64855&amp\;mkt=en-us&amp\;cbcxt=mai&amp\;snsc=1",nocase; classtype:attempted-recon; sid:200008474; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uniquesexygirls.net",nocase; http_uri; content:"/cgi-bin/atc/out.cgi?id=19&u=http:/www.experiencebrettjackson.dreamhosters.com/wp-content/plugins/inc/.b6a0e0f97b98509200cbe8dc8a90813a/96478879526111436369212b881ee965/5efe4ee1cde8b3df84ef4dea939aa5b0/e4e1205f7238e90b308e29077e32e81a473fe78d/db43c8397d81b9af8eeefc39b3ce1d77aa6e7ad9/e3f74ab593863dfc0ac6cd4216b662149754a5ab/1c51f70a771f31724e803a541e6aa7ad1f412527/e4458c837adb31b10124b969de4c8f73b5be8c01/",nocase; classtype:attempted-recon; sid:200008475; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitib.com",nocase; http_uri; content:"/hu/lorincmeszarosnews",nocase; classtype:attempted-recon; sid:200008476; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unitib.com",nocase; http_uri; content:"/hu/lorincmeszarosnews/",nocase; classtype:attempted-recon; sid:200008477; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unrecognisedpayeerequest.com",nocase; http_uri; content:"/lloyds",nocase; classtype:attempted-recon; sid:200008478; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"unrecognisedpayeerequest.com",nocase; http_uri; content:"/lloyds/login.php",nocase; classtype:attempted-recon; sid:200008479; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uofc-my.sharepoint.com",nocase; http_uri; content:"/:b:/g/personal/arnuv_mayank1_ucalgary_ca/evgtz_pcletgonwkwyagc0wbkezwceoq_0hzi8h3ezxpnw",nocase; classtype:attempted-recon; sid:200008480; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"upconcretepipe-my.sharepoint.com",nocase; http_uri; content:"/personal/sdelaire_upconcretepipe_net/_layouts/15/doc.aspx?sourcedoc=%7b01466817-0a09-49f7-a646-12f1a7f04b1e%7d&amp\;action=default&amp\;slrid=454fdf9f-10c9-c000-5b23-b65ba66f4b23&amp\;originalpath=ahr0chm6ly91cgnvbmnyzxrlcglwzs1tes5zagfyzxbvaw50lmnvbs86bzovzy9wzxjzb25hbc9zzgvsywlyzv91cgnvbmnyzxrlcglwzv9uzxqvrwhkb1jnrupddmrkcgtzuzhhzndtedrcndc1bdv2bkhlamxsa25umwfllxvmzz9ydgltzt1rr2gxavrcutjvzw&amp\;cid=fc47738a-755f-4d0b-b2ae-453938c9b41a",nocase; classtype:attempted-recon; sid:200008481; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"update-walletasset.com",nocase; http_uri; content:"/ronin",nocase; classtype:attempted-recon; sid:200008482; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uploads.codesandbox.io",nocase; http_uri; content:"/uploads/user/05f89058-061c-48b2-856d-a88922dc294e/5r8g-index.html",nocase; classtype:attempted-recon; sid:200008483; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"upscri.be",nocase; http_uri; content:"/l4ucvi",nocase; classtype:attempted-recon; sid:200008484; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"uqr.to",nocase; http_uri; content:"/kr14?userid=1401523827",nocase; classtype:attempted-recon; sid:200008485; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlwee.com",nocase; http_uri; content:"/hzlugg1/",nocase; classtype:attempted-recon; sid:200008486; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/cbmp?0y=s0xwgzdgw1nekhohrmkkptrgjtjiijcootj1eujadhcpb7e5q8vbdox0zh6gjqgbbwl6pe007o3iylvjb9zluudsm0ohckjcxgf1xwwrzx33yf6",nocase; classtype:attempted-recon; sid:200008487; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/cbmp?b0y=ixziezoedgqp4x3dcttiovfvlgvwz5pyjnrk6zldj5qsbahkcalxkmrp4hg66nl0oegdhzbwkauqqpsasbddvvqhzzbm0pzkqtnzhwetosybf6z",nocase; classtype:attempted-recon; sid:200008488; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/cbmp?fu3r=nvmnwugybw81iq7gfcqsr29jfvkd4aeesnz8tdsiuzjlzkilseboqx3zu2r7sm8zew71keo2ugtmvjdv0t5sw6wek7o33xlhep3qonwegbfuiql",nocase; classtype:attempted-recon; sid:200008489; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/cbmp?lfd=djaslon8mlsyflzsegjpghhzikih86eiyhhoxrhjhs74e4bhhgbltmcwg0s1plbgettxgg1btiksqb7fbqipcgknazqohtchqlnwpkxaduml0am",nocase; classtype:attempted-recon; sid:200008490; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/cfxw?znqq?tco=w3a8wkqu",nocase; classtype:attempted-recon; sid:200008491; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/dfdu",nocase; classtype:attempted-recon; sid:200008492; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/dfsg",nocase; classtype:attempted-recon; sid:200008493; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/dhi5",nocase; classtype:attempted-recon; sid:200008494; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/dhxo",nocase; classtype:attempted-recon; sid:200008495; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/dqoq",nocase; classtype:attempted-recon; sid:200008496; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/dr7v",nocase; classtype:attempted-recon; sid:200008497; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/dwzw",nocase; classtype:attempted-recon; sid:200008498; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/dya0",nocase; classtype:attempted-recon; sid:200008499; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/dzin",nocase; classtype:attempted-recon; sid:200008500; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/eclu",nocase; classtype:attempted-recon; sid:200008501; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/ef96",nocase; classtype:attempted-recon; sid:200008502; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/ekkz",nocase; classtype:attempted-recon; sid:200008503; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/eu9x",nocase; classtype:attempted-recon; sid:200008504; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/evyg",nocase; classtype:attempted-recon; sid:200008505; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/exvb",nocase; classtype:attempted-recon; sid:200008506; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/eztn",nocase; classtype:attempted-recon; sid:200008507; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/f0cd",nocase; classtype:attempted-recon; sid:200008508; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/f9nb",nocase; classtype:attempted-recon; sid:200008509; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/fbqd",nocase; classtype:attempted-recon; sid:200008510; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/fixz",nocase; classtype:attempted-recon; sid:200008511; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/fjc9",nocase; classtype:attempted-recon; sid:200008512; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/fnog",nocase; classtype:attempted-recon; sid:200008513; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"urlz.fr",nocase; http_uri; content:"/g2bd",nocase; classtype:attempted-recon; sid:200008514; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"us6.list-manage.com",nocase; http_uri; content:"/survey?u=30dcf0671c07ea7995901ac2c&id=4ac0e6514c&attribution=false",nocase; classtype:attempted-recon; sid:200008515; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"us6.list-manage.com",nocase; http_uri; content:"/survey?u=a0de668519da12283a5dd2280&id=dcbef4991f&attribution=false&e=50fd152abb",nocase; classtype:attempted-recon; sid:200008516; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"v.gd",nocase; http_uri; content:"/eoauyu",nocase; classtype:attempted-recon; sid:200008517; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"v.gd",nocase; http_uri; content:"/ymvvn6",nocase; classtype:attempted-recon; sid:200008518; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"v.ht",nocase; http_uri; content:"/airdrop-v3",nocase; classtype:attempted-recon; sid:200008519; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"val-gardena.net",nocase; http_uri; content:"/it/_islink.asp?url=26102549657133712.jijid.yoga",nocase; classtype:attempted-recon; sid:200008520; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vellingekommun-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/karin_strand_vellinge_se/egyldcpw7zzet71gx887vwobrnhahqfmwqw5rejh4cib9a?e=sdoqrc",nocase; classtype:attempted-recon; sid:200008521; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"velvet.by",nocase; http_uri; content:"/drupal-7.56/scripts/bp",nocase; classtype:attempted-recon; sid:200008522; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"velvet.by",nocase; http_uri; content:"/drupal-7.56/scripts/bp/",nocase; classtype:attempted-recon; sid:200008523; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"velvet.by",nocase; http_uri; content:"/drupal-7.56/scripts/bp/2277e0f3c4c5c98e848c0e64d76d6fb5/",nocase; classtype:attempted-recon; sid:200008524; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"velvet.by",nocase; http_uri; content:"/drupal-7.56/scripts/bp/d03ef074f8887403b084d613916df607/",nocase; classtype:attempted-recon; sid:200008525; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"velvet.by",nocase; http_uri; content:"/drupal-7.56/scripts/bp/d4810797ed4ec28eeb047934428f14a1/",nocase; classtype:attempted-recon; sid:200008526; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"verificationinfo03huntington.otzo.com",nocase; http_uri; content:"/secure/mlogin2.html",nocase; classtype:attempted-recon; sid:200008527; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"viamobte.blogspot.com",nocase; http_uri; content:"/2021/03/blog-post.html",nocase; classtype:attempted-recon; sid:200008528; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.cc",nocase; http_uri; content:"/9mjize",nocase; classtype:attempted-recon; sid:200008529; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f13.77.220.204?key=a8umj",nocase; classtype:attempted-recon; sid:200008530; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2f20.90.154.8/asu1",nocase; classtype:attempted-recon; sid:200008531; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vk.com",nocase; http_uri; content:"/away.php?to=http%3a%2f%2frajeshkhanal.com.np%2fwp-config.php&amp\;post=521188519_100&amp\;cc_key=",nocase; classtype:attempted-recon; sid:200008532; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"vodafonenotice.com",nocase; http_uri; content:"/banks/firstdirect.com/",nocase; classtype:attempted-recon; sid:200008533; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wallieget.com",nocase; http_uri; content:"/8jdu/sb6/index.php?_",nocase; classtype:attempted-recon; sid:200008534; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wallieget.com",nocase; http_uri; content:"/8jdu/sb6/index.php?_&amp\;_",nocase; classtype:attempted-recon; sid:200008535; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wallieget.com",nocase; http_uri; content:"/8jdu/sb6/index.php?_&amp\;_&amp\;_",nocase; classtype:attempted-recon; sid:200008536; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"warriorplus.com",nocase; http_uri; content:"/o2/a/f5s4y/0",nocase; classtype:attempted-recon; sid:200008537; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"watsontruck-my.sharepoint.com",nocase; http_uri; content:"/:w:/p/fsmith/eaquumvjy5bahivo2ewv-6ebebnpl4k8qd6onbtt3c-sgw?e=rzivtb",nocase; classtype:attempted-recon; sid:200008538; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webmail.serviceunit.co.uk",nocase; http_uri; content:"/upgrade/",nocase; classtype:attempted-recon; sid:200008539; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"websitebouwen.net",nocase; http_uri; content:"/hgs/accounting@charityvillage.com",nocase; classtype:attempted-recon; sid:200008540; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"websitebouwen.net",nocase; http_uri; content:"/hgs/akelso@pbaland.com",nocase; classtype:attempted-recon; sid:200008541; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"websitebouwen.net",nocase; http_uri; content:"/hgs/arete@aretefinancial.ca",nocase; classtype:attempted-recon; sid:200008542; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"websitebouwen.net",nocase; http_uri; content:"/hgs/authorize_client_id:1vaowidb-zdx6-l7bg-7lcw-xkhca3p0wgj9_rf2o6dijkmy1suv8alc4tzqeh7935nwxg0pbmouv470wdbyr81jzshlpxq6ekfa32tgcn59i5gioyw0m84l1knvc7e9puh2bqrxf3dtazj6s?data=&email=dispatch@giggexpress.ca",nocase; classtype:attempted-recon; sid:200008543; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"websitebouwen.net",nocase; http_uri; content:"/hgs/authorize_client_id:7i50jw8h-i57y-42al-9q5i-blzyawdp5j6t_brmzvieg4ylt512uxnf97ckas30q6jdhop8wsu89yrg0vwik7jx14p5tn2mle3bzhfoacqd68g2zw47o91pulryjktanqhcmf6sd3xvi05be?data=&email=accounting@charityvillage.com",nocase; classtype:attempted-recon; sid:200008544; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"websitebouwen.net",nocase; http_uri; content:"/hgs/authorize_client_id:bi0qwcus-mvig-szxe-13ya-m2hab60iz7tj_5j87xprgzn3v0wl692eihfs1kqcuymad4otbcewhnf8174ar3o0slxy59mjkv2uzbtqigd6phq0z3f7w4y2mrxjulv8pkscot5a69gbiedn1?data=&email=arete@aretefinancial.ca",nocase; classtype:attempted-recon; sid:200008545; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"websitebouwen.net",nocase; http_uri; content:"/hgs/authorize_client_id:f3iqt1sl-1bdt-re6f-n7l6-zsqp1tu70rk2_16nb52tyhm9dfjqr8zipc0lgux4oa73vwkseliuc37kjnz8bmfdwah65vqpe4ysg02rt9o1xbkmlsqvnu037heya6xw5pgfor8tj9d24z1ic?data=&email=dave.staudt@canline.ca",nocase; classtype:attempted-recon; sid:200008546; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"websitebouwen.net",nocase; http_uri; content:"/hgs/authorize_client_id:hbxo3s1u-gwfa-x6qi-9dh6-rwc0485uaifb_jocqvwxafnge2srd1iykl968m30t4zb7uph52zhve41jyqptdkm0aib7rswo6gln5ux9cf38l8ytrjev6kao5h7p29iuq3dbc01xmfwgs4zn?data=&email=info@armi.ca",nocase; classtype:attempted-recon; sid:200008547; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"websitebouwen.net",nocase; http_uri; content:"/hgs/authorize_client_id:wi6mpc8u-zv6d-j7ra-4v9o-76bx3j4hdawn_5forghnudlv9texszpijq0a7wc183ky42m6b53f4hmj6lingka2tsdep0yo7zxr8wqubcv19504ta3deb68ksorumfh7pgjxn2wq1yzlv9ci?data=&email=careers@gridforce.ca",nocase; classtype:attempted-recon; sid:200008548; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"websitebouwen.net",nocase; http_uri; content:"/hgs/authorize_client_id:yt1ge4do-63zp-jwxm-fg52-u1rbofadvcxy_deb93wpqu7alk8xist6024rvjz1oc5gmynhfoympu9eqslbw5rt3g7jfhi82cv1anzx0kd46r1zbw4jh7eftiyxgalnvkcm0p3u98q6os5d2?data=&email=akelso@pbaland.com",nocase; classtype:attempted-recon; sid:200008549; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"websitebouwen.net",nocase; http_uri; content:"/hgs/charanjit@jaskotfamilylaw.ca",nocase; classtype:attempted-recon; sid:200008550; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"websitebouwen.net",nocase; http_uri; content:"/hgs/familymatters@boulbyweinberg.com",nocase; classtype:attempted-recon; sid:200008551; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"websitebouwen.net",nocase; http_uri; content:"/hgs/info@armi.ca",nocase; classtype:attempted-recon; sid:200008552; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webuyworkshopequipment.com",nocase; http_uri; content:"/wp-content/themes/sketch/js/sf_trash/c45b222914e3c78d",nocase; classtype:attempted-recon; sid:200008553; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"webuyworkshopequipment.com",nocase; http_uri; content:"/wp-content/themes/sketch/js/sf_trash/c45b222914e3c78d/",nocase; classtype:attempted-recon; sid:200008554; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wellingtoncloud-my.sharepoint.com",nocase; http_uri; content:"/personal/lynne_barron_eaglehouseschool_com/_layouts/15/wopiframe.aspx?guestaccesstoken=5r%2fl6nh%2bt0nfkb7xwynvz8n1wumz0wz%2fpwkgri5p6%2fs%3d&docid=1_192cb7c38faeb476cb58ce8f71598361c&wdformid=%7b3e42bd82%2db59e%2d403b%2d9998%2d0c2dd21bd5e6%7d&action=formsubmit",nocase; classtype:attempted-recon; sid:200008555; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"whitefordkenworth-my.sharepoint.com",nocase; http_uri; content:"/personal/bwalters_lglk_com/_layouts/15/doc.aspx?sourcedoc={1d96cb1e-0031-41b8-8774-24bb2f7c4caa}&amp\;action=default&amp\;slrid=9ebb659f-7054-a000-b19b-7cb962889fc8&amp\;originalpath=ahr0chm6ly93agl0zwzvcmrrzw53b3j0ac1tes5zagfyzxbvaw50lmnvbs86bzovzy9wzxjzb25hbc9id2fsdgvyc19sz2xrx2nvbs9faddmbggweefmaejom1frdxk5ofrlb0jpn09poghoxzd0dfzfcw56wwr1yknbp3j0aw1lpvn3cwtevjhumkvn&amp\;cid=2ae6d679-a1b4-4b0f-a76a-46e32d437c42",nocase; classtype:attempted-recon; sid:200008556; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wilsonvaluation602-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/brian_wilsonvaluation_com/evgzsh2f49natji6i_lnklcbz46ledpzwpckxs6jgi7zmw?e=un6z",nocase; classtype:attempted-recon; sid:200008557; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"winfreyandco-my.sharepoint.com",nocase; http_uri; content:"/:o:/g/personal/brandon_wincodc_com/esxchyyuht1diztxkz0fzm8boma-_ssknhdzjbh7xexnxa?e=vapt5b",nocase; classtype:attempted-recon; sid:200008558; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"withkoji.com",nocase; http_uri; content:"/@coxupdate78",nocase; classtype:attempted-recon; sid:200008559; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wonder-tonic.com",nocase; http_uri; content:"/geocitiesizer/content.php?music=6&theme=2&url=https://steamcommunity.com",nocase; classtype:attempted-recon; sid:200008560; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"wvk12-my.sharepoint.com",nocase; http_uri; content:"/personal/pklewis_k12_wv_us/_layouts/15/wopiframe.aspx?guestaccesstoken=tqintdtuii%2bam%2fbqmtnjkenggs2dptoi8hs2jqftjkq%3d&docid=1_1446052cffa4c4871bd24bb98fe86ed6d&wdformid=%7bdf30d25d%2d0b59%2d47e5%2d956e%2dc601397ea4d7%7d&action=formsubmit&cid=57cdb8ab-426b-4eff-a51f-903ee3684f96",nocase; classtype:attempted-recon; sid:200008561; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"www-paypoy.banks-jfnch-co-jp.chuiqu.top",nocase; http_uri; content:"/wctx?routekey=v3",nocase; classtype:attempted-recon; sid:200008562; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--80aafkatpetleclg.xn--p1ai",nocase; http_uri; content:"/?domain=benjamas.vantanatavatot@sc.com",nocase; classtype:attempted-recon; sid:200008563; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--80aafkatpetleclg.xn--p1ai",nocase; http_uri; content:"/?domain=benjamas.vantanatavatot@sc.com2.",nocase; classtype:attempted-recon; sid:200008564; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xn--80aafkatpetleclg.xn--p1ai",nocase; http_uri; content:"/?domain=organization",nocase; classtype:attempted-recon; sid:200008565; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"xurl.es",nocase; http_uri; content:"/l0f93",nocase; classtype:attempted-recon; sid:200008566; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yarwoodfineart.com",nocase; http_uri; content:"/chpost/ch/",nocase; classtype:attempted-recon; sid:200008567; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yastatic.net",nocase; http_uri; content:"/awaps-ad-sdk-js-bundles/1.0-3871/bundles-es2017/inpage.bundle.js",nocase; classtype:attempted-recon; sid:200008568; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"youengage.me",nocase; http_uri; content:"/p/61164367233af501000121a2",nocase; classtype:attempted-recon; sid:200008569; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"youtube.com",nocase; http_uri; content:"/redirect?event=video_description&amp\;redir_token=quffluhqazjnrtryamdoudhsmxhgbfzqvnm4ymrczlk5d3xbq3jtc0trauh6afm2v2zrzjzzwvdwlxqxwtvntvjkx19olvbmbkg2whdradbnmlzon2jxoudezdjium5hqtnpav9qsgtfufjizeltb0jgr1ddr0d0vk5qsurlmewtrvfnnmg2n28xswlcujzla2t4bfloewzsaw&amp\;q=https%3a%2f%2fbit.ly%2f2qq1myh",nocase; classtype:attempted-recon; sid:200008570; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"ytthn.com",nocase; http_uri; content:"/click-dqkla3al-hfdqch9w?bt=25&amp\;tl=1&amp\;url=http://www.microsoft.com/&amp\;sa=k4cph5afjt010fz50ihbd",nocase; classtype:attempted-recon; sid:200008571; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yun.ir",nocase; http_uri; content:"/0561j6",nocase; classtype:attempted-recon; sid:200008572; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yun.ir",nocase; http_uri; content:"/2s45v2",nocase; classtype:attempted-recon; sid:200008573; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yun.ir",nocase; http_uri; content:"/b0al9f",nocase; classtype:attempted-recon; sid:200008574; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"yun.ir",nocase; http_uri; content:"/cc42w",nocase; classtype:attempted-recon; sid:200008575; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zdcdrtfguh-vuhjjiu-bjnnjnj.s3.amazonaws.com",nocase; http_uri; content:"/index.html",nocase; classtype:attempted-recon; sid:200008576; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpr.io",nocase; http_uri; content:"/kms8u47zlxwk",nocase; classtype:attempted-recon; sid:200008577; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpr.io",nocase; http_uri; content:"/rafby#%0%",nocase; classtype:attempted-recon; sid:200008578; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpr.io",nocase; http_uri; content:"/rafby#camilgeyer@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200008579; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpr.io",nocase; http_uri; content:"/rafby#clarencecalhoun@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200008580; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpr.io",nocase; http_uri; content:"/rafby#jaygallagher@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200008581; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpr.io",nocase; http_uri; content:"/rafby#omflavin@legalshieldcorp.com",nocase; classtype:attempted-recon; sid:200008582; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpr.io",nocase; http_uri; content:"/rb7bg#camilgeyer@prepaidlegal.com",nocase; classtype:attempted-recon; sid:200008583; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpr.io",nocase; http_uri; content:"/ruttb",nocase; classtype:attempted-recon; sid:200008584; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zpr.io",nocase; http_uri; content:"/twq3f",nocase; classtype:attempted-recon; sid:200008585; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"phishing-filter phishing website detected"; http_header:field host; content:"zroei-pccnb.flounderfit.com",nocase; http_uri; content:"/#jaekyeum.kim@sc.com",nocase; classtype:attempted-recon; sid:200008586; rev:1;)